Return-Path: <no-reply@1sourceschedule.com>
Delivered-To: behniwal+spam@server.rnv.kpw.mybluehostin.me
Received: from server.rnv.kpw.mybluehostin.me
	by server.rnv.kpw.mybluehostin.me with LMTP
	id A2PBLJJdKWdtYQAAyTkJsw
	(envelope-from <no-reply@1sourceschedule.com>)
	for <behniwal+spam@server.rnv.kpw.mybluehostin.me>; Mon, 04 Nov 2024 16:49:38 -0700
Return-path: <no-reply@1sourceschedule.com>
Envelope-to: info@behniwalgroup.com
Delivery-date: Mon, 04 Nov 2024 16:49:38 -0700
Received: from [67.199.112.98] (port=37882 helo=vps28965-3472.1capapp.com)
	by server.rnv.kpw.mybluehostin.me with esmtps  (TLS1.2) tls TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384
	(Exim 4.95)
	(envelope-from <no-reply@1sourceschedule.com>)
	id 1t86pF-0006T3-Dl
	for info@behniwalgroup.com;
	Mon, 04 Nov 2024 16:49:38 -0700
Received: from [185.95.84.74] (port=56120 helo=static-84-74.corelux.net)
	by vps28965-3472.1capapp.com with esmtpsa  (TLS1.2) tls TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384
	(Exim 4.98)
	(envelope-from <no-reply@1sourceschedule.com>)
	id 1t86ob-0000000FN7g-3MX6
	for info@behniwalgroup.com;
	Mon, 04 Nov 2024 18:48:56 -0500
Content-Type: multipart/alternative; boundary="===============5969034241118219750=="
MIME-Version: 1.0
From: Theodore Mason <no-reply@1sourceschedule.com>
To: <info@behniwalgroup.com>
X-AntiAbuse: This header was added to track abuse, please include it with any abuse report
X-AntiAbuse: Primary Hostname - vps28965-3472.1capapp.com
X-AntiAbuse: Original Domain - behniwalgroup.com
X-AntiAbuse: Originator/Caller UID/GID - [47 12] / [47 12]
X-AntiAbuse: Sender Address Domain - 1sourceschedule.com
X-Get-Message-Sender-Via: vps28965-3472.1capapp.com: authenticated_id: no-reply@1sourceschedule.com
X-Authenticated-Sender: vps28965-3472.1capapp.com: no-reply@1sourceschedule.com
X-Source: 
X-Source-Args: 
X-Source-Dir: 
X-Spam-Status: Yes, score=17.3
X-Spam-Score: 173
X-Spam-Bar: +++++++++++++++++
X-Spam-Report: Spam detection software, running on the system "server.rnv.kpw.mybluehostin.me",
 has identified this incoming email as possible spam.  The original
 message has been attached to this so you can view it or label
 similar future email.  If you have any questions, see
 root\@localhost for details.
 Content preview:  Good day! Hey! I would like to enlighten you about a very
    dreadful condition for you. Nonetheless, you can profit from it, if you will
    react wisely. 
 Content analysis details:   (17.3 points, 5.0 required)
  pts rule name              description
 ---- ---------------------- --------------------------------------------------
  0.0 RCVD_IN_VALIDITY_CERTIFIED_BLOCKED RBL: ADMINISTRATOR NOTICE:
                             The query to Validity was blocked.  See
                             https://knowledge.validity.com/hc/en-us/articles/20961730681243
                              for more information.
                             [67.199.112.98 listed in sa-accredit.habeas.com]
  0.0 RCVD_IN_VALIDITY_RPBL_BLOCKED RBL: ADMINISTRATOR NOTICE: The
                             query to Validity was blocked.  See
                             https://knowledge.validity.com/hc/en-us/articles/20961730681243
                              for more information.
                             [67.199.112.98 listed in bl.score.senderscore.com]
  0.0 T_SPF_PERMERROR        SPF: test of record failed (permerror)
  0.0 HTML_MESSAGE           BODY: HTML included in message
  0.1 MIME_HTML_ONLY         BODY: Message only has text/html MIME parts
  0.7 MPART_ALT_DIFF         BODY: HTML and text parts are different
  0.0 MIME_HTML_ONLY_MULTI   Multipart message only has text/html MIME
                             parts
  1.4 MISSING_DATE           Missing Date: header
  0.0 KAM_DMARC_STATUS       Test Rule for DKIM or SPF Failure with Strict
                             Alignment
  8.5 KAM_CRIM               Extortion Email
  2.0 RDNS_NONE              Delivered to internal network by a host with no rDNS
  1.5 BITCOIN_SPAM_09        BitCoin spam pattern 09
  0.5 PDS_BTC_ID             FP reduced Bitcoin ID
  2.5 ADVANCE_FEE_3_NEW      Appears to be advance fee fraud (Nigerian 419)
X-Spam-Flag: YES
Subject:    Please change password

--===============5969034241118219750==
Content-Type: text/html; charset="utf-8"
MIME-Version: 1.0
Content-Transfer-Encoding: quoted-printable

<!DOCTYPE html><html>
<body style=3D"background-color:#ffffff;">
<table width=3D"350" border=3D"0" cellspacing=3D"0" cellpadding=3D"0" style=
=3D"font-size:16px;line-height:1.6;font-family: Roboto,RobotoDraft,Helvetic=
a,Arial,sans-serif"><tbody><tr><td>
Good day!<br><br>
Hey!<br><br>
I would like to enlighten you about a very dreadful condition for you. None=
theless, you can profit from it, if you will react wisely.<br><br>
Have you heard about Pegasus? This is a malware tool that sets up on machin=
es and cell phones and allows hackers to track the activity of machine user=
s. It provides entry to your camera, messengers, emails, voice records, etc=
. It works well on Android, iOS, Windows. I guess, you already figured out =
where I am going.<br><br>
It's been some weeks since I set up it on each your devices because of you =
wasn't quite selective about what URLs to click on on the web. During this =
period, I've discovered about all facets of your personal life, but one is =
of particular significance to me.<br><br>
I've documented many clips of you masturbating to extremely controversial a=
dult footage. Given that the "questionable" type is almost always the same,=
 I can conclude that you have sick fetish.<br><br>
I also saved each your important files - records, photos, videos, etc. - to=
 a remote system.<br><br>
I question you'd want your friends, loved ones, and co-workers to be aware =
about it. Nonetheless, I can accomplish it in a handful of clicks. Every en=
try in your phone list will suddenly obtain these clips - on Whats App, on =
Telegram, on Skype, on e-mail - everywhere. It is set to be a tsunami that =
will erase everything in its course, and first of all, your former situatio=
n. Don't consider of yourself as an guiltless victim. No one knows where yo=
ur corruption might take in the times to come, so consider this a kind of e=
arned retribution to prevent you. Sooner delayed than never. I am some kind=
 of Divinity who sees everything. But, don't freak out. As we understand, D=
eity is compassionate and forgiving, and so do I. However my mercy is not c=
omplimentary.<br><br>
Transfer $1300 USD to this BTC crypto wallet:<br>
16Je8T9dZ8VrPGYjmEmcwaV5WZuj2dSVZp
<br><br>
Let's confront it, that's a fairly insignificant quantity in current societ=
y.<br><br>
After I get affirmation of the deal, I will irrevocably erase each footage =
compromising you, uninstall Pegasus from all of your items, and disappear f=
rom your existence. You can be certain - my advantage is only cash. Otherwi=
se, I wouldn't be writing to you, nevertheless ruin your life without a sta=
tement in a moment.<br><br>
I'll be alerted when you view my email, and from that moment, you have exac=
tly 12 hours to transfer the funds. If digital currencies are unchartered w=
aters for you, do not worry; it's quite easy. Just search "crypto market" a=
nd then it will be no harder than acquiring a few pointless stuff on Amazon=
.<br><br>
I strongly warn you against the following:<br><br>
- Do not respond to this email. I sent it from a temporary e-mail so I am u=
ntraceable.<br><br>
- Don't contact the law enforcement. I have access to every your equipment,=
 and at what time I find out you sprinted to the authorities, clips will be=
 published.<br><br>
- Do not try to reset or destroy your devices. As I noted above: I'm monito=
ring each your activity, so you either accept to my demands or the videos a=
re published.<br><br>
In addition, do not overlook that cryptocurrencies are untraceable, so it i=
s difficult to find me using the provided address. Good fortune, my pervert=
ed friend. I genuinely trust=20
you will take the appropriate decision and this is the final time we hear f=
rom each other.<br><br>
And some helpful suggestions: as of now, don't be so careless about your on=
line protection.
</td></tr></tbody></table>
</body>
</html>
--===============5969034241118219750==--

