Return-Path: <intuit.service@secure.net>
Delivered-To: behniwal+spam@server.rnv.kpw.mybluehostin.me
Received: from server.rnv.kpw.mybluehostin.me
	by server.rnv.kpw.mybluehostin.me with LMTP
	id NCb2C8adGWqzJwAAyTkJsw
	(envelope-from <intuit.service@secure.net>)
	for <behniwal+spam@server.rnv.kpw.mybluehostin.me>; Fri, 29 May 2026 08:08:06 -0600
Return-path: <intuit.service@secure.net>
Envelope-to: info@behniwalgroup.com
Delivery-date: Fri, 29 May 2026 08:08:06 -0600
Received: from [74.82.33.77] (port=50084 helo=secure.net)
	by server.rnv.kpw.mybluehostin.me with esmtp (Exim 4.99.1)
	(envelope-from <intuit.service@secure.net>)
	id 1wSxsc-000000002cY-0UNn
	for info@behniwalgroup.com;
	Fri, 29 May 2026 08:08:06 -0600
From: "QuickBooks Payments" <intuit.service@secure.net>
To: info@behniwalgroup.com
Date: 29 May 2026 07:07:24 -0700
Message-ID: <20260529070724.7359BFA924D63864@secure.net>
MIME-Version: 1.0
Content-Type: text/html;
	charset="iso-8859-1"
Content-Transfer-Encoding: quoted-printable
X-Spam-Status: Yes, score=18.8
X-Spam-Score: 188
X-Spam-Bar: ++++++++++++++++++
X-Spam-Report: Spam detection software, running on the system "server.rnv.kpw.mybluehostin.me",
 has identified this incoming email as possible spam.  The original
 message has been attached to this so you can view it or label
 similar future email.  If you have any questions, see
 root\@localhost for details.
 Content preview:  info@behniwalgroup.com, This message is an automatic response
    message as a result of a failed payment from a customer. A customer payment
    was rejected due to incomplete billing. Help us prevent issues like this
   by reviewing your account. 
 Content analysis details:   (18.8 points, 5.0 required)
  pts rule name              description
 ---- ---------------------- --------------------------------------------------
  0.0 URIBL_BLOCKED          ADMINISTRATOR NOTICE: The query to URIBL was
                             blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#dnsbl-block
                              for more information.
                             [URIs: ivolucion.com]
  0.0 HTML_MESSAGE           BODY: HTML included in message
  0.1 MIME_HTML_ONLY         BODY: Message only has text/html MIME parts
  0.0 HTML_EXTRA_CLOSE       BODY: HTML contains far too many close tags
  2.4 RAZOR2_CF_RANGE_51_100 Razor2 gives confidence level above 50%
                             [cf: 100]
  1.7 RAZOR2_CHECK           Listed in Razor2 (http://razor.sf.net/)
  2.0 PYZOR_CHECK            Listed in Pyzor
                             (https://pyzor.readthedocs.io/en/latest/)
  1.0 KAM_LAZY_DOMAIN_SECURITY Sending domain does not have any
                             anti-forgery methods
  2.0 RDNS_NONE              Delivered to internal network by a host with no rDNS
  0.0 KAM_DMARC_STATUS       Test Rule for DKIM or SPF Failure with Strict
                             Alignment
  2.5 KAM_LINKBAIT           Short messages containing little more than a link,
                             from a domain with no security in place
  0.0 FSL_BULK_SIG           Bulk signature with no Unsubscribe
  1.5 KAM_LINKBAIT2          Linkbait that points to wordpress - usually means
                             a compromised site
  2.0 TO_NO_BRKTS_NORDNS_HTML To: lacks brackets and no rDNS and HTML
                             only
  3.5 URI_WP_HACKED          URI for compromised WordPress site, possible
                             malware
X-Spam-Flag: YES
Subject:    Payments Deposit

info@behniwalgroup.com,<BR><BR>This message is an automatic response messag=
e as a result of a failed payment from a customer. A customer payment was r=
ejected due to incomplete billing.<BR><BR>Help us prevent issues like this =
by reviewing your account.<BR><BR>
<A href=3D"https://chproteccionunicef.ivolucion.com/wp-content/red/wx.htm">=
REVIEW PAYMENT</A><BR>
<P><BR>Thank You,<BR>QuickBooks Payment Team</P></BODY></HTML>