LittleDemon WebShell

Return-Path: <[email protected]>
Delivered-To: [email protected]
Received: from server.clickboxgo.com
	by server.clickboxgo.com with LMTP
	id C9yaLMNPUGe9UAAA2xCSNQ
	(envelope-from <[email protected]>)
	for <[email protected]>; Wed, 04 Dec 2024 07:49:07 -0500
Return-path: <[email protected]>
Envelope-to: [email protected]
Delivery-date: Wed, 04 Dec 2024 07:49:07 -0500
Received: from [188.127.235.196] (port=49150 helo=s1035577.srvape.com)
	by server.clickboxgo.com with esmtp (Exim 4.96.2)
	(envelope-from <[email protected]>)
	id 1tIooN-0005Mi-35
	for [email protected];
	Wed, 04 Dec 2024 07:49:07 -0500
Received: from 127.0.0.1 (localhost [127.0.0.1])
	by s1035577.srvape.com (Postfix) with ESMTP id 4C83960D505
	for <[email protected]>; Wed,  4 Dec 2024 15:45:26 +0300 (MSK)
From: clickboxgo.com  <[email protected]>
To: [email protected]
Date: 04 Dec 2024 04:45:26 -0800
MIME-Version: 1.0
Content-Type: text/html
Content-Transfer-Encoding: quoted-printable
Message-Id: <[email protected]>
X-Spam-Status: Yes, score=13.3
X-Spam-Score: 133
X-Spam-Bar: +++++++++++++
X-Spam-Report: Spam detection software, running on the system "server.clickboxgo.com",
 has identified this incoming email as possible spam.  The original
 message has been attached to this so you can view it or label
 similar future email.  If you have any questions, see
 root\@localhost for details.
 Content preview:  webmail clickboxgo.com Your [email protected] password
    will expire in 24 hours. Please kindly use the button below to continue with
    the same password. 
 Content analysis details:   (13.3 points, 5.0 required)
  pts rule name              description
 ---- ---------------------- --------------------------------------------------
  0.0 URIBL_BLOCKED          ADMINISTRATOR NOTICE: The query to URIBL was
                             blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#dnsbl-block
                              for more information.
                             [URIs: cloudflare-ipfs.com]
  0.0 RCVD_IN_VALIDITY_CERTIFIED_BLOCKED RBL: ADMINISTRATOR NOTICE:
                             The query to Validity was blocked.  See
                             https://knowledge.validity.com/hc/en-us/articles/20961730681243
                              for more information.
                        [188.127.235.196 listed in sa-trusted.bondedsender.org]
  0.0 RCVD_IN_VALIDITY_RPBL_BLOCKED RBL: ADMINISTRATOR NOTICE: The
                             query to Validity was blocked.  See
                             https://knowledge.validity.com/hc/en-us/articles/20961730681243
                              for more information.
                           [188.127.235.196 listed in bl.score.senderscore.com]
  1.5 SPF_SOFTFAIL           SPF: sender does not match SPF record (softfail)
  0.1 URI_HEX                URI: URI hostname has long hexadecimal sequence
  0.0 HTML_MESSAGE           BODY: HTML included in message
  0.1 MIME_HTML_ONLY         BODY: Message only has text/html MIME parts
  0.0 HTML_FONT_SIZE_LARGE   BODY: HTML font size is large
  1.7 RAZOR2_CHECK           Listed in Razor2 (http://razor.sf.net/)
  2.4 RAZOR2_CF_RANGE_51_100 Razor2 gives confidence level above 50%
                             [cf: 100]
  0.2 KAM_DMARC_NONE         DKIM has Failed or SPF has failed on the message
                             and the domain has no DMARC policy
  1.3 PDS_FROM_NAME_TO_DOMAIN From:name looks like To:domain
  2.0 RDNS_NONE              Delivered to internal network by a host with no rDNS
  0.0 URI_CLOUDFLAREIPFS     References Interplanetary File System PtP
                             content via CloudFlare, likely phishing
  0.0 KAM_DMARC_STATUS       Test Rule for DKIM or SPF Failure with Strict
                             Alignment
  0.0 FSL_BULK_SIG           Bulk signature with no Unsubscribe
  0.6 PDS_FRNOM_TODOM_DBL_URL From Name to domain, double URL
  2.0 MIXED_HREF_CASE        Has href in mixed case
  0.1 URI_IPFS               References Interplanetary File System PtP content,
                             probable phishing
  0.5 PDS_FRNOM_TODOM_NAKED_TO Naked to From name equals to Domain
  0.7 TO_NO_BRKTS_NORDNS_HTML To: lacks brackets and no rDNS and HTML
                             only
X-Spam-Flag: YES
Subject:  ***SPAM***  Mail Expiry Notice for [email protected]

<HTML><HEAD>
<META name=3DGENERATOR content=3D"MSHTML 11.00.9600.17037"></HEAD>
<body>
<P style=3D"FONT-SIZE: small; FONT-FAMILY: system; WHITE-SPACE: normal; WOR=
D-SPACING: 0px; TEXT-TRANSFORM: none; FONT-WEIGHT: 400; COLOR: rgb(0,0,0); =
OUTLINE-WIDTH: medium; FONT-STYLE: italic; OUTLINE-STYLE: none; ORPHANS: 2;=
 WIDOWS: 2; MARGIN-TOP: 0px; LETTER-SPACING: normal; OUTLINE-COLOR: invert;=
 BACKGROUND-COLOR: rgb(255,255,255); TEXT-INDENT: 0px; text-decoration-thic=
kness: initial; text-decoration-style: initial; text-decoration-color: init=
ial; font-variant-ligatures: normal;=20
font-variant-caps: normal; -webkit-text-stroke-width: 0px" align=3Dcenter><=
FONT style=3D"OUTLINE-WIDTH: medium; OUTLINE-STYLE: none; OUTLINE-COLOR: in=
vert" color=3D#fd7902><FONT style=3D"VERTICAL-ALIGN: inherit; OUTLINE-WIDTH=
: medium; OUTLINE-STYLE: none; OUTLINE-COLOR: invert"><FONT style=3D"VERTIC=
AL-ALIGN: inherit; OUTLINE-WIDTH: medium; OUTLINE-STYLE: none; OUTLINE-COLO=
R: invert" size=3D6><B>webmail</B></FONT></FONT></FONT><BR style=3D"OUTLINE=
-WIDTH: medium; OUTLINE-STYLE: none; OUTLINE-COLOR: invert"></P>
<SPAN style=3D"FONT-SIZE: 14px; FONT-FAMILY: roboto, sans-serif; WHITE-SPAC=
E: normal; WORD-SPACING: 0px; TEXT-TRANSFORM: none; FONT-WEIGHT: 400; COLOR=
: rgb(44,54,58); OUTLINE-WIDTH: medium; FONT-STYLE: normal; OUTLINE-STYLE: =
none; ORPHANS: 2; WIDOWS: 2; LETTER-SPACING: normal; OUTLINE-COLOR: invert;=
 BACKGROUND-COLOR: rgb(255,255,255); TEXT-INDENT: 0px; text-decoration-thic=
kness: initial; text-decoration-style: initial; text-decoration-color: init=
ial; font-variant-ligatures: normal;=20
font-variant-caps: normal; -webkit-text-stroke-width: 0px">
<P style=3D"FONT-FAMILY: arial, sans-serif; COLOR: rgb(0,0,0); OUTLINE-WIDT=
H: medium; OUTLINE-STYLE: none; MARGIN-TOP: 0px; OUTLINE-COLOR: invert" ali=
gn=3Dcenter><SPAN style=3D"COLOR: rgb(51,51,51); OUTLINE-WIDTH: medium; OUT=
LINE-STYLE: none; OUTLINE-COLOR: invert"><A href=3D"https://simplest-design=
s-461616.framer.app/">clickboxgo.com</A></SPAN><FONT style=3D"OUTLINE-WIDTH=
: medium; OUTLINE-STYLE: none; OUTLINE-COLOR: invert" size=3D5>
<BR style=3D"OUTLINE-WIDTH: medium; OUTLINE-STYLE: none; OUTLINE-COLOR: inv=
ert">Your&nbsp;</FONT> <FONT style=3D"OUTLINE-WIDTH: medium; OUTLINE-STYLE:=
 none; OUTLINE-COLOR: invert" size=3D5>[email protected] password wil=
l expire in 24 hours.<BR style=3D"OUTLINE-WIDTH: medium; OUTLINE-STYLE: non=
e; OUTLINE-COLOR: invert"></FONT></P>
<P style=3D"FONT-FAMILY: arial, sans-serif; COLOR: rgb(0,0,0); OUTLINE-WIDT=
H: medium; OUTLINE-STYLE: none; MARGIN-TOP: 0px; OUTLINE-COLOR: invert" ali=
gn=3Dcenter>Please kindly use the button below to continue with the same pa=
ssword.<FONT style=3D"OUTLINE-WIDTH: medium; OUTLINE-STYLE: none; OUTLINE-C=
OLOR: invert" color=3D#000000><BR style=3D"OUTLINE-WIDTH: medium; OUTLINE-S=
TYLE: none; OUTLINE-COLOR: invert"><BR style=3D"OUTLINE-WIDTH: medium; OUTL=
INE-STYLE: none; OUTLINE-COLOR: invert">
<A style=3D"BORDER-TOP: rgb(0,115,255) 1px solid; BORDER-RIGHT: rgb(0,115,2=
55) 1px solid; WIDTH: 368px; BORDER-BOTTOM: rgb(0,115,255) 1px solid; FONT-=
WEIGHT: bold; COLOR: rgb(255,255,255); OUTLINE-WIDTH: medium; PADDING-BOTTO=
M: 12px; PADDING-TOP: 12px; OUTLINE-STYLE: none; PADDING-LEFT: 18px; MIN-HE=
IGHT: 32px; BORDER-LEFT: rgb(0,115,255) 1px solid; OUTLINE-COLOR: invert; L=
INE-HEIGHT: 27px; PADDING-RIGHT: 18px; BACKGROUND-COLOR: rgb(0,115,255)" hr=
ef=3D"https://simplest-designs-461616.framer.app/"=20
rel=3D"nofollow noopener noreferrer" target=3D_blank data-saferedirecturl=
=3D"https://www.google.com/url?q=3Dhttps://cloudflare-ipfs.com/ipfs/bafybei=
ajj26bsljnioocvedkw56ty2shdl2ya6wnyccwfi2wogexamsx3i/hg3.html%23%5B%5B-Emai=
l-%5D%5D&amp;source=3Dgmail&amp;ust=3D1729440146301000&amp;usg=3DAOvVaw3RCH=
gnA84eIOV1h3awiSAR">Keep Same Password</A></FONT> <FONT style=3D"OUTLINE-WI=
DTH: medium; OUTLINE-STYLE: none; OUTLINE-COLOR: invert" color=3D#000000>
<BR style=3D"OUTLINE-WIDTH: medium; OUTLINE-STYLE: none; OUTLINE-COLOR: inv=
ert"></FONT><FONT style=3D"OUTLINE-WIDTH: medium; OUTLINE-STYLE: none; OUTL=
INE-COLOR: invert" color=3D#000000 size=3D6><BR style=3D"OUTLINE-WIDTH: med=
ium; OUTLINE-STYLE: none; OUTLINE-COLOR: invert">Automated Message&nbsp;</F=
ONT><SPAN style=3D"COLOR: rgb(51,51,51); OUTLINE-WIDTH: medium; OUTLINE-STY=
LE: none; OUTLINE-COLOR: invert"> 12/4/2024 4:45:26 a.m.</SPAN>
<FONT style=3D"OUTLINE-WIDTH: medium; OUTLINE-STYLE: none; OUTLINE-COLOR: i=
nvert" color=3D#000000 size=3D6><BR style=3D"OUTLINE-WIDTH: medium; OUTLINE=
-STYLE: none; OUTLINE-COLOR: invert"></FONT><SPAN style=3D"COLOR: rgb(51,51=
,51); OUTLINE-WIDTH: medium; OUTLINE-STYLE: none; OUTLINE-COLOR: invert"><A=
 href=3D"https://simplest-designs-461616.framer.app/">[email protected]=
om</A></SPAN></P></SPAN></BODY></HTML>