Return-Path: Delivered-To: behniwal+spam@server.rnv.kpw.mybluehostin.me Received: from server.rnv.kpw.mybluehostin.me by server.rnv.kpw.mybluehostin.me with LMTP id qG7jACLrLWqZPQAAyTkJsw (envelope-from ) for ; Sat, 13 Jun 2026 17:43:30 -0600 Return-path: Envelope-to: info@behniwalgroup.com Delivery-date: Sat, 13 Jun 2026 17:43:30 -0600 Received: from [177.47.136.82] (port=63762 helo=email.cz) by server.rnv.kpw.mybluehostin.me with esmtp (Exim 4.99.1) (envelope-from ) id 1wYY0e-0000000047A-0rcm for info@behniwalgroup.com; Sat, 13 Jun 2026 17:43:29 -0600 From: "American Express" To: info@behniwalgroup.com Date: 13 Jun 2026 20:42:46 -0300 Message-ID: <20260613204246.409DC6294401C63E@email.cz> MIME-Version: 1.0 Content-Type: text/html; charset="iso-8859-1" Content-Transfer-Encoding: quoted-printable X-Spam-Status: Yes, score=15.5 X-Spam-Score: 155 X-Spam-Bar: +++++++++++++++ X-Spam-Report: Spam detection software, running on the system "server.rnv.kpw.mybluehostin.me", has identified this incoming email as possible spam. The original message has been attached to this so you can view it or label similar future email. If you have any questions, see root\@localhost for details. Content preview: Please verify a recent purchase CARD PROTECTION Account starting: 3XXXX Content analysis details: (15.5 points, 5.0 required) pts rule name description ---- ---------------------- -------------------------------------------------- 0.0 URIBL_BLOCKED ADMINISTRATOR NOTICE: The query to URIBL was blocked. See http://wiki.apache.org/spamassassin/DnsBlocklists#dnsbl-block for more information. [URIs: americanexpress.com] 0.5 JMQ_SPF_NEUTRAL ASKDNS: SPF set to ?all [email.cz TXT:v=spf1 mx ip4:77.75.78.0/23] [ip4:77.75.76.0/23 ip6:2a02:598::/32] [?all] 2.7 RCVD_IN_PSBL RBL: Received via a relay in PSBL [177.47.136.82 listed in psbl.surriel.com] 0.0 FREEMAIL_FROM Sender email is commonly abused enduser mail provider [onlinealerts-info[at]email.cz] 0.0 HTML_MESSAGE BODY: HTML included in message 0.1 MIME_HTML_ONLY BODY: Message only has text/html MIME parts 0.0 HTML_FONT_LOW_CONTRAST BODY: HTML font color similar or identical to background 0.2 KAM_DMARC_NONE DKIM has Failed or SPF has failed on the message and the domain has no DMARC policy 0.0 TVD_PH_SUBJ_META1 Email has a Phishy looking subject line 0.0 KAM_DMARC_STATUS Test Rule for DKIM or SPF Failure with Strict Alignment 2.0 RDNS_NONE Delivered to internal network by a host with no rDNS 0.0 KAM_SHORT Use of a URL Shortener for very short URL 2.0 MIXED_HREF_CASE Has href in mixed case 2.0 HTML_FONT_TINY_NORDNS Font too small to read, no rDNS 0.7 SPOOFED_FREEMAIL_NO_RDNS From SPOOFED_FREEMAIL and no rDNS 2.0 TO_NO_BRKTS_NORDNS_HTML To: lacks brackets and no rDNS and HTML only 2.5 NORDNS_LOW_CONTRAST No rDNS + hidden text 0.7 SPOOFED_FREEMAIL No description available. 0.0 T_REMOTE_IMAGE Message contains an external image X-Spam-Flag: YES Subject: Review and Verify a Recent Purchase on Your Account

Please verify a recent purchase

=
=3D"American

CARD PROTECTION

Account starting: 3XXXX

 3D"Card
<= /TABLE>
3D"Alternate

We declined a recent purchase on your Card to prot= ect against fraud.

$8,900.00 purchase = on 06/13/2026 at ORIOS DINNER THEATRE on your Card ending in 0XXXX

=
=
=
<= /TBODY>

Do you recognize this attempt?

 

 

Yes

 

 

No

=

Please let us know If you or an authorized party i= nitiated this charges by using the Yes/No button above.

 

Thank you for helping us to protect the security o= f your account,

 

 

American Express

=

Helpful Links

<= /TD>
3D"Alternate
3D"Alternate

Your account information is included above to help= you recognize this as a customer care email from American Express. To lear= n more about email security or report a suspicious email, please visit us a= t americanexpress.com/phishing. We kindly ask = you not to reply to this email but instead contact us via Customer Care.

*iOS and Android™ only. See app store listin= gs for operating system info.

© 2026 American Express. All rights reserved<= /P>

SSF0CTA034