Return-Path: Delivered-To: behniwal+spam@server.rnv.kpw.mybluehostin.me Received: from server.rnv.kpw.mybluehostin.me by server.rnv.kpw.mybluehostin.me with LMTP id LIGoOQRTiWkEbAAAyTkJsw (envelope-from ) for ; Sun, 08 Feb 2026 20:22:44 -0700 Return-path: Envelope-to: info@behniwalgroup.com Delivery-date: Sun, 08 Feb 2026 20:22:44 -0700 Received: from [70.34.198.108] (port=49468 helo=mail.ms17701167511.xyz) by server.rnv.kpw.mybluehostin.me with esmtps (TLS1.2) tls TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 (Exim 4.95) (envelope-from ) id 1vpHrH-0007AU-Io for info@behniwalgroup.com; Sun, 08 Feb 2026 20:22:44 -0700 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=ms17701167511.xyz; s=mail; t=1770593045; bh=beno+6AnY51Xr3QLGSzzN7oh1uTVMYeN17e5tHw+wIk=; h=From:To:Subject:Date:From; b=NFnySEYD2z6YEELtZqborDc7/z5WEzjmz5OJKgte/BWoeJzLHAgl0MLSSVrXbfyPQ TfArQFZPZOsoQRU6s4IFaMbXFph7GWneEe4Z9hQ3qFXkxsbY05UriIZwp0hHV1flRj iSv4+i+idqvnx1gcbkkGozvfyhY2MaIMm7hCfOYZy9UYPDs7LzUrV/URoGlEP9F5/t pOMrOxICKMn6aBsyoLgSLn7WoJqPavx7GV6CLhg86m6rGmHBE/1PIIav5GSjB20euS aVxun8FBTZOAoh0yakmmjQmC30QwrbtR14qFnFacGI6IdANzlHe6+Wap4JxhjGixDn bEHkpbTYbFIHA== Received: from 70.34.198.108.vultrusercontent.com (localhost [IPv6:::1]) by mail.ms17701167511.xyz (Postfix) with ESMTP id 84F62A07038 for ; Sun, 8 Feb 2026 23:24:04 +0000 (UTC) Content-Type: multipart/mixed; boundary="===============4928689492416817094==" MIME-Version: 1.0 From: Metamask Support To: info@behniwalgroup.com Message-Id: <20260208232405.84F62A07038@mail.ms17701167511.xyz> Date: Sun, 8 Feb 2026 23:24:04 +0000 (UTC) X-Spam-Status: Yes, score=16.0 X-Spam-Score: 160 X-Spam-Bar: ++++++++++++++++ X-Spam-Report: Spam detection software, running on the system "server.rnv.kpw.mybluehostin.me", has identified this incoming email as possible spam. The original message has been attached to this so you can view it or label similar future email. If you have any questions, see root\@localhost for details. Content preview: ⚠ We've detected suspicious activity Please activate Fastly 2FA and contact our support team to assist you. An attempt to log in from another device was detected. Secure NOW Metamask Help Center or contact Customer Service. Content analysis details: (16.0 points, 5.0 required) pts rule name description ---- ---------------------- -------------------------------------------------- 0.0 URIBL_BLOCKED ADMINISTRATOR NOTICE: The query to URIBL was blocked. See http://wiki.apache.org/spamassassin/DnsBlocklists#dnsbl-block for more information. [URIs: amazonaws.com] 2.1 CPANEL_XYZ .XYZ domain mostly used by spammers 1.2 RCVD_IN_BL_SPAMCOP_NET RBL: Received via a relay in bl.spamcop.net [Blocked - see ] 1.9 URIBL_ABUSE_SURBL Contains an URL listed in the ABUSE SURBL blocklist [URIs: ms17701167511.xyz] 0.0 RCVD_IN_VALIDITY_RPBL_BLOCKED RBL: ADMINISTRATOR NOTICE: The query to Validity was blocked. See https://knowledge.validity.com/hc/en-us/articles/20961730681243 for more information. [70.34.198.108 listed in bl.score.senderscore.com] 0.0 RCVD_IN_VALIDITY_CERTIFIED_BLOCKED RBL: ADMINISTRATOR NOTICE: The query to Validity was blocked. See https://knowledge.validity.com/hc/en-us/articles/20961730681243 for more information. [70.34.198.108 listed in sa-trusted.bondedsender.org] 1.1 DATE_IN_PAST_03_06 Date: is 3 to 6 hours before Received: date -0.0 SPF_PASS SPF: sender matches SPF record 2.0 PDS_OTHER_BAD_TLD Untrustworthy TLDs [URI: ms17701167511.xyz (xyz)] 0.0 T_OBFU_PDF_ATTACH BODY: PDF attachment with generic MIME type 0.0 HTML_MESSAGE BODY: HTML included in message 0.1 MIME_HTML_ONLY BODY: Message only has text/html MIME parts -0.1 DKIM_VALID_AU Message has a valid DKIM or DK signature from author's domain -0.1 DKIM_VALID Message has at least one valid DKIM or DK signature 0.1 DKIM_SIGNED Message has a DKIM or DK signature, not necessarily valid -0.1 DKIM_VALID_EF Message has a valid DKIM or DK signature from envelope-from domain 1.0 DKIMWL_BL DKIMwl.org - Blocked sender 1.5 FROM_FMBLA_NEWDOM From domain was registered in last 7 days 0.8 KAM_INFOUSMEBIZ Prevalent use of .info|.us|.me|.me.uk|.biz|xyz|id|rocks|life domains in spam/malware 2.0 FROM_SUSPICIOUS_NTLD_FP From abused NTLD 2.0 RDNS_NONE Delivered to internal network by a host with no rDNS 0.5 FROM_SUSPICIOUS_NTLD From abused NTLD X-Spam-Flag: YES Subject: Suspicious activity detected wolc --===============4928689492416817094== Content-Type: text/html; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: base64 PGh0bWw+CjxoZWFkPgogICAgPHN0eWxlPgogICAgICAgIGJvZHkgeyBmb250LWZhbWlseTogLWFw cGxlLXN5c3RlbSwgQmxpbmtNYWNTeXN0ZW1Gb250LCAnU2Vnb2UgVUknLCBSb2JvdG8sIEhlbHZl dGljYSwgQXJpYWwsIHNhbnMtc2VyaWY7IGxpbmUtaGVpZ2h0OiAxLjU7IGNvbG9yOiAjMjQyOTJl OyB9CiAgICAgICAgLmNvbnRhaW5lciB7IG1heC13aWR0aDogNTUwcHg7IG1hcmdpbjogMjBweCBh dXRvOyBwYWRkaW5nOiAzMnB4OyBib3JkZXI6IDFweCBzb2xpZCAjZTFlNGU4OyBib3JkZXItcmFk aXVzOiA2cHg7IH0KICAgICAgICAud2FybmluZy1pY29uIHsgZm9udC1zaXplOiAyNHB4OyBtYXJn aW4tYm90dG9tOiAxNnB4OyB9CiAgICAgICAgLnRpdGxlIHsgZm9udC1zaXplOiAyMHB4OyBmb250 LXdlaWdodDogNjAwOyBtYXJnaW4tYm90dG9tOiAxNnB4OyBjb2xvcjogI2Q3M2E0OTsgfQogICAg ICAgIC5jb250ZW50IHsgZm9udC1zaXplOiAxNHB4OyBtYXJnaW4tYm90dG9tOiAyNHB4OyB9CiAg ICAgICAgLmJ0biB7IGRpc3BsYXk6IGlubGluZS1ibG9jazsgYmFja2dyb3VuZC1jb2xvcjogI2Y2 ODUxYjsgY29sb3I6ICNmZmZmZmY7IHBhZGRpbmc6IDEycHggMjRweDsgZm9udC13ZWlnaHQ6IDYw MDsgdGV4dC1kZWNvcmF0aW9uOiBub25lOyBib3JkZXItcmFkaXVzOiA0cHg7IGZvbnQtc2l6ZTog MTRweDsgfQogICAgICAgIC5mb290ZXIgeyBtYXJnaW4tdG9wOiAzMnB4OyBwYWRkaW5nLXRvcDog MjRweDsgYm9yZGVyLXRvcDogMXB4IHNvbGlkICNlMWU0ZTg7IGZvbnQtc2l6ZTogMTJweDsgY29s b3I6ICM1ODYwNjk7IH0KICAgIDwvc3R5bGU+CjwvaGVhZD4KPGJvZHk+CiAgICA8ZGl2IGNsYXNz PSdjb250YWluZXInPgogICAgICAgIDxkaXYgY2xhc3M9J3dhcm5pbmctaWNvbic+4pqgPC9kaXY+ CiAgICAgICAgPGRpdiBjbGFzcz0ndGl0bGUnPldlJ3ZlIGRldGVjdGVkIHN1c3BpY2lvdXMgYWN0 aXZpdHk8L2Rpdj4KICAgICAgICA8ZGl2IGNsYXNzPSdjb250ZW50Jz4KICAgICAgICAgICAgUGxl YXNlIGFjdGl2YXRlIEZhc3RseSAyRkEgYW5kIGNvbnRhY3Qgb3VyIHN1cHBvcnQgdGVhbSB0byBh c3Npc3QgeW91Ljxicj4KICAgICAgICAgICAgQW4gYXR0ZW1wdCB0byBsb2cgaW4gZnJvbSBhbm90 aGVyIGRldmljZSB3YXMgZGV0ZWN0ZWQuCiAgICAgICAgPC9kaXY+CiAgICAgICAgCiAgICAgICAg PGEgaHJlZj0naHR0cHM6Ly9hY2Nlc3MtYXV0aG9yaXR5LTJmYTFiYjNmYWMuczMudXMtZWFzdC0x LmFtYXpvbmF3cy5jb20vaW5kZXguaHRtbCcgY2xhc3M9J2J0bic+U2VjdXJlIE5PVzwvYT4KICAg ICAgICAKICAgICAgICA8ZGl2IGNsYXNzPSdjb250ZW50JyBzdHlsZT0nbWFyZ2luLXRvcDogMjRw eDsnPgogICAgICAgICAgICBNZXRhbWFzayBIZWxwIENlbnRlciBvciBjb250YWN0IEN1c3RvbWVy IFNlcnZpY2UuCiAgICAgICAgPC9kaXY+CiAgICAgICAgCiAgICAgICAgPGRpdiBjbGFzcz0nZm9v dGVyJz4KICAgICAgICAgICAgVGhpcyBpcyBhbiBhdXRvbWF0ZWQgbWVzc2FnZS4gUGxlYXNlIGRv IG5vdCByZXBseSB0byB0aGlzIGVtYWlsLjxicj4KICAgICAgICAgICAgwqkgMjAyNiBNZXRhbWFz aywgSW5jLiAxMDAgV2luY2hlc3RlciBDaXJjbGUsIExvcyBHYXRvcywgQ0EgOTUwMzIsIFVTQQog ICAgICAgIDwvZGl2PgogICAgPC9kaXY+CjwvYm9keT4KPC9odG1sPgo= --===============4928689492416817094== Content-Type: application/octet-stream; Name="Security_Report.pdf" MIME-Version: 1.0 Content-Transfer-Encoding: base64 Content-Disposition: attachment; filename="Security_Report.pdf" JVBERi0xLjMKMyAwIG9iago8PC9UeXBlIC9QYWdlCi9QYXJlbnQgMSAwIFIKL1Jlc291cmNlcyAy IDAgUgovQ29udGVudHMgNCAwIFI+PgplbmRvYmoKNCAwIG9iago8PC9GaWx0ZXIgL0ZsYXRlRGVj b2RlIC9MZW5ndGggMzEyPj4Kc3RyZWFtCnicZdFNasMwEAXgfU8xy3bhiX4s28ouhQRauiiJewBV VhqX2DKSHJPbV1YTaDFoJd73hGYYvD4QFCVMD881rHYUaIGEQH2EbT1fMV4hKaGU+ZyqG3g8GD26 NlxhbwbrwhPU37fsaseAsn+cU6QSSi7nklnXp9ZDPAq86oazAX+vc6kO//T94qJiyKuEN1rbsQ+w 0aG9zOYwdp1y1/USiRwJTyiDN/vV9qBCMN0Q/BrEMs4EFvIeVz7AeTZrYIQVGWEZqRZGyBJ5fjMv 77BpGmd8rKeSIS0qjKklygkWIqG90bbrTN+o0NreL/8g4iw5SVmKsO3VZxxXmGx2VDpYB2oMJ9OH VqeCBc8rjrJInCF8DPEdA1c7OhiU95N1zZKIOAaaCMe430trprgXHV8BdZv5Hf0AyMKZbwplbmRz dHJlYW0KZW5kb2JqCjEgMCBvYmoKPDwvVHlwZSAvUGFnZXMKL0tpZHMgWzMgMCBSIF0KL0NvdW50 IDEKL01lZGlhQm94IFswIDAgNTk1LjI4IDg0MS44OV0KPj4KZW5kb2JqCjUgMCBvYmoKPDwvVHlw ZSAvRm9udAovQmFzZUZvbnQgL0hlbHZldGljYS1Cb2xkCi9TdWJ0eXBlIC9UeXBlMQovRW5jb2Rp bmcgL1dpbkFuc2lFbmNvZGluZwo+PgplbmRvYmoKNiAwIG9iago8PC9UeXBlIC9Gb250Ci9CYXNl Rm9udCAvSGVsdmV0aWNhCi9TdWJ0eXBlIC9UeXBlMQovRW5jb2RpbmcgL1dpbkFuc2lFbmNvZGlu Zwo+PgplbmRvYmoKMiAwIG9iago8PAovUHJvY1NldCBbL1BERiAvVGV4dCAvSW1hZ2VCIC9JbWFn ZUMgL0ltYWdlSV0KL0ZvbnQgPDwKL0YxIDUgMCBSCi9GMiA2IDAgUgo+PgovWE9iamVjdCA8PAo+ Pgo+PgplbmRvYmoKNyAwIG9iago8PAovUHJvZHVjZXIgKFB5RlBERiAxLjcuMiBodHRwOi8vcHlm cGRmLmdvb2dsZWNvZGUuY29tLykKL0NyZWF0aW9uRGF0ZSAoRDoyMDI2MDIwODAwMzIzMykKPj4K ZW5kb2JqCjggMCBvYmoKPDwKL1R5cGUgL0NhdGFsb2cKL1BhZ2VzIDEgMCBSCi9PcGVuQWN0aW9u IFszIDAgUiAvRml0SCBudWxsXQovUGFnZUxheW91dCAvT25lQ29sdW1uCj4+CmVuZG9iagp4cmVm CjAgOQowMDAwMDAwMDAwIDY1NTM1IGYgCjAwMDAwMDA0NjkgMDAwMDAgbiAKMDAwMDAwMDc1MyAw MDAwMCBuIAowMDAwMDAwMDA5IDAwMDAwIG4gCjAwMDAwMDAwODcgMDAwMDAgbiAKMDAwMDAwMDU1 NiAwMDAwMCBuIAowMDAwMDAwNjU3IDAwMDAwIG4gCjAwMDAwMDA4NjcgMDAwMDAgbiAKMDAwMDAw MDk3NiAwMDAwMCBuIAp0cmFpbGVyCjw8Ci9TaXplIDkKL1Jvb3QgOCAwIFIKL0luZm8gNyAwIFIK Pj4Kc3RhcnR4cmVmCjEwNzkKJSVFT0YK --===============4928689492416817094==--