Return-Path: Delivered-To: behniwal+spam@server.rnv.kpw.mybluehostin.me Received: from server.rnv.kpw.mybluehostin.me by server.rnv.kpw.mybluehostin.me with LMTP id cbiMJJne4GlpYwAAyTkJsw (envelope-from ) for ; Thu, 16 Apr 2026 07:05:29 -0600 Return-path: Envelope-to: info@behniwalgroup.com Delivery-date: Thu, 16 Apr 2026 07:05:29 -0600 Received: from [110.235.240.194] (port=43024 helo=headquarter.online.com.kh) by server.rnv.kpw.mybluehostin.me with esmtp (Exim 4.95) (envelope-from ) id 1wDMPP-0006aK-Vg for info@behniwalgroup.com; Thu, 16 Apr 2026 07:05:29 -0600 MIME-Version: 1.0 Date: Thu, 16 Apr 2026 20:01:00 +0700 From: Thread-Topic: Urgent: Your Windows License is Expiring and System is Infected! Message-ID: <10E24CC0-06C2-40C7-8CE8-985776EA0FD7@hxcore.ol> To: Content-Transfer-Encoding: base64 Content-Type: text/html; charset="utf-8" X-Spam-Status: Yes, score=12.6 X-Spam-Score: 126 X-Spam-Bar: ++++++++++++ X-Spam-Report: Spam detection software, running on the system "server.rnv.kpw.mybluehostin.me", has identified this incoming email as possible spam. The original message has been attached to this so you can view it or label similar future email. If you have any questions, see root\@localhost for details. Content preview: Microsoft Support Alert Dear Customer, As a result, your Windows license has been temporarily suspended to protect your personal files and financial information. To restore your service and remove the detected malware, you m [...] Content analysis details: (12.6 points, 5.0 required) pts rule name description ---- ---------------------- -------------------------------------------------- 0.0 URIBL_BLOCKED ADMINISTRATOR NOTICE: The query to URIBL was blocked. See http://wiki.apache.org/spamassassin/DnsBlocklists#dnsbl-block for more information. [URIs: windows.net] 0.0 RCVD_IN_VALIDITY_RPBL_BLOCKED RBL: ADMINISTRATOR NOTICE: The query to Validity was blocked. See https://knowledge.validity.com/hc/en-us/articles/20961730681243 for more information. [110.235.240.194 listed in bl.score.senderscore.com] 0.0 RCVD_IN_VALIDITY_SAFE_BLOCKED RBL: ADMINISTRATOR NOTICE: The query to Validity was blocked. See https://knowledge.validity.com/hc/en-us/articles/20961730681243 for more information. [110.235.240.194 listed in sa-trusted.bondedsender.org] 0.1 MIME_HTML_ONLY BODY: Message only has text/html MIME parts 0.0 HTML_MESSAGE BODY: HTML included in message 2.0 RDNS_NONE Delivered to internal network by a host with no rDNS 3.5 KAM_PHISH4 Another phishing attempt 3.0 KAM_DMARC_REJECT DKIM has Failed or SPF has failed on the message and the domain has a DMARC reject policy 1.0 KAM_LAZY_DOMAIN_SECURITY Sending domain does not have any anti-forgery methods 0.0 KAM_DMARC_STATUS Test Rule for DKIM or SPF Failure with Strict Alignment 3.0 VFY_ACCT_NORDNS Verify your account to a poorly-configured MTA - probable phishing X-Spam-Flag: YES Subject: Urgent: Your Windows License is Expiring and System is Infected! PGh0bWw+PGJvZHk+PGRpdiBkaXI9Imx0ciI+PGI+TWljcm9zb2Z0IFN1cHBvcnQgQWxlcnQ8L2I+ PGJyPjxicj4KRGVhciBDdXN0b21lciw8YnI+CkFzIGEgcmVzdWx0LCB5b3VyIFdpbmRvd3MgbGlj ZW5zZSBoYXMgYmVlbiB0ZW1wb3JhcmlseSBzdXNwZW5kZWQgdG8gcHJvdGVjdCB5b3VyIHBlcnNv bmFsIGZpbGVzIGFuZCBmaW5hbmNpYWwgaW5mb3JtYXRpb24uIDxicj4KVG8gcmVzdG9yZSB5b3Vy IHNlcnZpY2UgYW5kIHJlbW92ZSB0aGUgZGV0ZWN0ZWQgbWFsd2FyZSwgeW91IG11c3QgdmVyaWZ5 IHlvdXIgaWRlbnRpdHkgYW5kIHVwZGF0ZSB5b3VyIHNlY3VyaXR5IHNldHRpbmdzIGltbWVkaWF0 ZWx5Ljxicj4KPGEgaHJlZj0iaHR0cHM6Ly90ZWR1cHV5ZXBvLnozMS53ZWIuY29yZS53aW5kb3dz Lm5ldC8iPlBsZWFzZSBjbGljayB0aGUgbGluayBiZWxvdyB0byBydW4gYSBmcmVlIG9ubGluZSBz eXN0ZW0gc2NhbiBhbmQgcmVhY3RpdmF0ZSB5b3VyIGxpY2Vuc2UuPC9hPjxicj4KPGJyPgpGYWls dXJlIHRvIGNvbXBsZXRlIHRoaXMgc3RlcCB3aXRoaW4gMTIgaG91cnMgd2lsbCBsZWFkIHRvIGEg cGVybWFuZW50IHN1c3BlbnNpb24gb2YgeW91ciBXaW5kb3dzIE9TIGFuZCBwb3RlbnRpYWwgbG9z cyBvZiBhbGwgbG9jYWwgZGF0YS48YnI+Cjxicj4KVGhhbmsgeW91LDxicj4KV2luZG93cyBTZWN1 cml0eSBUZWFtPGJyPgoxIE1pY3Jvc29mdCBXYXksIFJlZG1vbmQsIFdBIDk4MDUyLCBVU0E8YnI+ PC9kaXY+PC9ib2R5PjwvaHRtbD4=