| Current Path : /home/baheco/mail/baheco.com.ar/info/Maildir/new/ |
Linux sd-1582531-l.dattaweb.com 3.10.0-1160.119.1.el7.x86_64 #1 SMP Tue Jun 4 14:43:51 UTC 2024 x86_64 |
| Current File : /home/baheco/mail/baheco.com.ar/info/Maildir/new/1788991739.H996620P26505.sd-1582531-l.dattaweb.com |
Return-path: <support@smspengar.nu>
Envelope-to: info@baheco.com.ar
Delivery-date: Wed, 09 Sep 2026 19:08:59 -0300
Received: from [8.228.105.166] (helo=smspengar.nu)
by sd-1582531-l.dattaweb.com with smtp (Exim)
(envelope-from <support@smspengar.nu>)
id 1x4QTL-0006sQ-Mk
for info@baheco.com.ar; Wed, 09 Sep 2026 19:08:59 -0300
From: Cloud Operations <support@smspengar.nu>
To: info@baheco.com.ar
Message-ID: <3ce15fff62314a87a1e1bd5b9915a3d1@smspengar.nu>
Date: Wed, 09 Sep 2026 22:08:50 +0000
MIME-Version: 1.0
Content-Type: text/html; charset=utf-8
X-VirusChecked: Checked
Subject: [POSIBLE FRAUDE] Subscription Cancelled: Payment failed
X-Spam-Score: 90.8
X-Spam-Score-Int: 907
X-Spam-Bar: +++++++++++++++++++++++++++++++++++++++++++++++++++
X-Spam-Report: Action: reject
Symbol: FROM_HAS_DN(0.00)
Symbol: FROM_EQ_ENVFROM(0.00)
Symbol: SPFBL_URIBL_FAIL(0.00)
Symbol: TO_DN_NONE(0.00)
Symbol: URIBL_HOSTKARMA_OLDER_10D(0.30)
Symbol: R_DKIM_NA(0.00)
Symbol: MID_RHS_MATCH_FROM(0.00)
Symbol: RWL_MAILSPIKE_POSSIBLE(0.00)
Symbol: R_SPF_FAIL(32.00)
Symbol: PATRON_SOSPECHOSO_N8N_HEADER_004(0.10)
Symbol: URL_TRACKED(0.00)
Symbol: ONCE_RECEIVED(0.20)
Symbol: ASN(0.00)
Symbol: RCVD_COUNT_ONE(0.00)
Symbol: RCVD_NO_TLS_LAST(0.10)
Symbol: HFILTER_HELO_IP_A(1.00)
Symbol: MISSING_XM_UA(0.77)
Symbol: SPFBL_FAIL(0.00)
Symbol: TO_MATCH_ENVRCPT_ALL(0.00)
Symbol: ABUSE_SURBL(5.00)
Symbol: DBL_SPAM(6.50)
Symbol: MX_GOOD(0.00)
Symbol: PHISHING_GENERAL_BAYES_HTML(1.00)
Symbol: LISTADO_USEPROTECT2(0.75)
Symbol: RCPT_COUNT_ONE(0.00)
Symbol: ARC_NA(0.00)
Symbol: R_BAD_CTE_7BIT(1.05)
Symbol: MIME_TRACE(0.00)
Symbol: VIOLATED_DIRECT_SPF(40.00)
Symbol: DMARC_POLICY_REJECT(2.00)
X-Symbol: FROM_HAS_DN(0.00); From header has a display name
X-Symbol: FROM_EQ_ENVFROM(0.00); From address is the same as the envelope
X-Symbol: SPFBL_URIBL_FAIL(0.00) [142.251.129.123:storage.googleapis.com:query timed out, 142.251.128.251:storage.googleapis.com:query timed out, 142.251.129.187:storage.googleapis.com:query timed out]
X-Symbol: TO_DN_NONE(0.00); None of the recipients have display names
X-Symbol: URIBL_HOSTKARMA_OLDER_10D(0.30); Spam listado hace mas de 10 dias [storage.googleapis.com:url, smspengar.nu:helo, 8upload.com:url]
X-Symbol: R_DKIM_NA(0.00); Missing DKIM signature
X-Symbol: MID_RHS_MATCH_FROM(0.00); Message-ID RHS matches From domain
X-Symbol: RWL_MAILSPIKE_POSSIBLE(0.00); From address is listed in Mailspike RWL - possibly legit [8.228.105.166:from]
X-Symbol: R_SPF_FAIL(32.00); SPF verification failed [-all]
X-Symbol: PATRON_SOSPECHOSO_N8N_HEADER_004(0.10)
X-Symbol: URL_TRACKED(0.00); URLs registradas en log para búsqueda forense [www.powerscawebly.com, storage.googleapis.com]
X-Symbol: ONCE_RECEIVED(0.20); One received header in a message
X-Symbol: ASN(0.00) [asn:396982, ipnet:8.228.64.0/18, country:US]
X-Symbol: RCVD_COUNT_ONE(0.00); Message has one Received header [1]
X-Symbol: RCVD_NO_TLS_LAST(0.10); Last hop did not use encrypted transports
X-Symbol: HFILTER_HELO_IP_A(1.00); Helo A IP != hostname IP [smspengar.nu]
X-Symbol: MISSING_XM_UA(0.77); Message has neither X-Mailer nor User-Agent header
X-Symbol: SPFBL_FAIL(0.00) [8.228.105.166:query timed out]
X-Symbol: TO_MATCH_ENVRCPT_ALL(0.00); All of the recipients match the envelope
X-Symbol: ABUSE_SURBL(5.00); A domain in the message is listed in SURBL as abused [www.powerscawebly.com:url]
X-Symbol: DBL_SPAM(6.50); A domain in the message is listed in Spamhaus DBL as spam [powerscawebly.com:url]
X-Symbol: MX_GOOD(0.00); MX was ok [smtp.google.com]
X-Symbol: PHISHING_GENERAL_BAYES_HTML(1.00); Bayes spam + HTML-only desde remitente sin whitelist/DMARC pass
X-Symbol: LISTADO_USEPROTECT2(0.75) [8.228.105.166:from]
X-Symbol: RCPT_COUNT_ONE(0.00); One recipient [1]
X-Symbol: ARC_NA(0.00); ARC signature absent
X-Symbol: R_BAD_CTE_7BIT(1.05); Detects bad Content-Transfer-Encoding for text parts [unknown, utf8]
X-Symbol: MIME_TRACE(0.00) [0:~]
X-Symbol: VIOLATED_DIRECT_SPF(40.00); Has no Received (or no trusted received relays) and SPF policy fails or soft fails
X-Symbol: DMARC_POLICY_REJECT(2.00); DMARC reject policy [smspengar.nu : No valid SPF, No valid DKIM, reject]
Message-ID: 3ce15fff62314a87a1e1bd5b9915a3d1@smspengar.nu
X-Milter-Add: X-Rspamd-Queue-Id: 1x4QTL-0006sQ-Mk
X-Milter-Add: X-Rspamd-Server: eternia11.dattaweb.com
X-Milter-Add: X-Spamd-Result: default: True [90.77 / 50.00];
VIOLATED_DIRECT_SPF(40.00)[];
R_SPF_FAIL(32.00)[-all];
DBL_SPAM(6.50)[powerscawebly.com:url];
ABUSE_SURBL(5.00)[www.powerscawebly.com:url];
DMARC_POLICY_REJECT(2.00)[smspengar.nu : No valid SPF, No valid DKIM,reject];
R_BAD_CTE_7BIT(1.05)[unknown,utf8];
HFILTER_HELO_IP_A(1.00)[smspengar.nu];
PHISHING_GENERAL_BAYES_HTML(1.00)[];
MISSING_XM_UA(0.77)[];
LISTADO_USEPROTECT2(0.75)[8.228.105.166:from];
URIBL_HOSTKARMA_OLDER_10D(0.30)[storage.googleapis.com:url,smspengar.nu:helo,8upload.com:url];
ONCE_RECEIVED(0.20)[];
RCVD_NO_TLS_LAST(0.10)[];
PATRON_SOSPECHOSO_N8N_HEADER_004(0.10)[];
RCPT_COUNT_ONE(0.00)[1];
RCVD_COUNT_ONE(0.00)[1];
SPFBL_URIBL_FAIL(0.00)[142.251.129.123:storage.googleapis.com:query timed out,142.251.128.251:storage.googleapis.com:query timed out,142.251.129.187:storage.googleapis.com:query timed out];
TO_DN_NONE(0.00)[];
ARC_NA(0.00)[];
MIME_TRACE(0.00)[0:~];
FROM_EQ_ENVFROM(0.00)[];
ASN(0.00)[asn:396982, ipnet:8.228.64.0/18, country:US];
MX_GOOD(0.00)[smtp.google.com];
MID_RHS_MATCH_FROM(0.00)[];
URL_TRACKED(0.00)[www.powerscawebly.com,storage.googleapis.com];
R_DKIM_NA(0.00)[];
RWL_MAILSPIKE_POSSIBLE(0.00)[8.228.105.166:from];
TO_MATCH_ENVRCPT_ALL(0.00)[];
SPFBL_FAIL(0.00)[8.228.105.166:query timed out];
FROM_HAS_DN(0.00)[]
X-Milter-Add: X-Rspamd-Action: reject
X-Milter-Del: X-Rspamd-Action
X-Milter-Del: X-Spamd-Result
X-Milter-Del: X-Rspamd-Queue-Id
X-Milter-Del: X-Rspamd-Server
X-Milter-Del: X-Spam
X-Spam-Flag: Yes
X-Spam-Status: Yes
X-Spam-Threshold: 70
X-Rejected-By: Action: reject
Symbol: FROM_HAS_DN(0.00)
Symbol: FROM_EQ_ENVFROM(0.00)
Symbol: SPFBL_URIBL_FAIL(0.00)
Symbol: TO_DN_NONE(0.00)
Symbol: URIBL_HOSTKARMA_OLDER_10D(0.30)
Symbol: R_DKIM_NA(0.00)
Symbol: MID_RHS_MATCH_FROM(0.00)
Symbol: RWL_MAILSPIKE_POSSIBLE(0.00)
Symbol: R_SPF_FAIL(32.00)
Symbol: PATRON_SOSPECHOSO_N8N_HEADER_004(0.10)
Symbol: URL_TRACKED(0.00)
Symbol: ONCE_RECEIVED(0.20)
Symbol: ASN(0.00)
Symbol: RCVD_COUNT_ONE(0.00)
Symbol: RCVD_NO_TLS_LAST(0.10)
Symbol: HFILTER_HELO_IP_A(1.00)
Symbol: MISSING_XM_UA(0.77)
Symbol: SPFBL_FAIL(0.00)
Symbol: TO_MATCH_ENVRCPT_ALL(0.00)
Symbol: ABUSE_SURBL(5.00)
Symbol: DBL_SPAM(6.50)
Symbol: MX_GOOD(0.00)
Symbol: PHISHING_GENERAL_BAYES_HTML(1.00)
Symbol: LISTADO_USEPROTECT2(0.75)
Symbol: RCPT_COUNT_ONE(0.00)
Symbol: ARC_NA(0.00)
Symbol: R_BAD_CTE_7BIT(1.05)
Symbol: MIME_TRACE(0.00)
Symbol: VIOLATED_DIRECT_SPF(40.00)
Symbol: DMARC_POLICY_REJECT(2.00)
X-Symbol: FROM_HAS_DN(0.00); From header has a display name
X-Symbol: FROM_EQ_ENVFROM(0.00); From address is the same as the envelope
X-Symbol: SPFBL_URIBL_FAIL(0.00) [142.251.129.123:storage.googleapis.com:query timed out, 142.251.128.251:storage.googleapis.com:query timed out, 142.251.129.187:storage.googleapis.com:query timed out]
X-Symbol: TO_DN_NONE(0.00); None of the recipients have display names
X-Symbol: URIBL_HOSTKARMA_OLDER_10D(0.30); Spam listado hace mas de 10 dias [storage.googleapis.com:url, smspengar.nu:helo, 8upload.com:url]
X-Symbol: R_DKIM_NA(0.00); Missing DKIM signature
X-Symbol: MID_RHS_MATCH_FROM(0.00); Message-ID RHS matches From domain
X-Symbol: RWL_MAILSPIKE_POSSIBLE(0.00); From address is listed in Mailspike RWL - possibly legit [8.228.105.166:from]
X-Symbol: R_SPF_FAIL(32.00); SPF verification failed [-all]
X-Symbol: PATRON_SOSPECHOSO_N8N_HEADER_004(0.10)
X-Symbol: URL_TRACKED(0.00); URLs registradas en log para búsqueda forense [www.powerscawebly.com, storage.googleapis.com]
X-Symbol: ONCE_RECEIVED(0.20); One received header in a message
X-Symbol: ASN(0.00) [asn:396982, ipnet:8.228.64.0/18, country:US]
X-Symbol: RCVD_COUNT_ONE(0.00); Message has one Received header [1]
X-Symbol: RCVD_NO_TLS_LAST(0.10); Last hop did not use encrypted transports
X-Symbol: HFILTER_HELO_IP_A(1.00); Helo A IP != hostname IP [smspengar.nu]
X-Symbol: MISSING_XM_UA(0.77); Message has neither X-Mailer nor User-Agent header
X-Symbol: SPFBL_FAIL(0.00) [8.228.105.166:query timed out]
X-Symbol: TO_MATCH_ENVRCPT_ALL(0.00); All of the recipients match the envelope
X-Symbol: ABUSE_SURBL(5.00); A domain in the message is listed in SURBL as abused [www.powerscawebly.com:url]
X-Symbol: DBL_SPAM(6.50); A domain in the message is listed in Spamhaus DBL as spam [powerscawebly.com:url]
X-Symbol: MX_GOOD(0.00); MX was ok [smtp.google.com]
X-Symbol: PHISHING_GENERAL_BAYES_HTML(1.00); Bayes spam + HTML-only desde remitente sin whitelist/DMARC pass
X-Symbol: LISTADO_USEPROTECT2(0.75) [8.228.105.166:from]
X-Symbol: RCPT_COUNT_ONE(0.00); One recipient [1]
X-Symbol: ARC_NA(0.00); ARC signature absent
X-Symbol: R_BAD_CTE_7BIT(1.05); Detects bad Content-Transfer-Encoding for text parts [unknown, utf8]
X-Symbol: MIME_TRACE(0.00) [0:~]
X-Symbol: VIOLATED_DIRECT_SPF(40.00); Has no Received (or no trusted received relays) and SPF policy fails or soft fails
X-Symbol: DMARC_POLICY_REJECT(2.00); DMARC reject policy [smspengar.nu : No valid SPF, No valid DKIM, reject]
Message-ID: 3ce15fff62314a87a1e1bd5b9915a3d1@smspengar.nu
X-Milter-Add: X-Rspamd-Queue-Id: 1x4QTL-0006sQ-Mk
X-Milter-Add: X-Rspamd-Server: eternia11.dattaweb.com
X-Milter-Add: X-Spamd-Result: default: True [90.77 / 50.00];
VIOLATED_DIRECT_SPF(40.00)[];
R_SPF_FAIL(32.00)[-all];
DBL_SPAM(6.50)[powerscawebly.com:url];
ABUSE_SURBL(5.00)[www.powerscawebly.com:url];
DMARC_POLICY_REJECT(2.00)[smspengar.nu : No valid SPF, No valid DKIM,reject];
R_BAD_CTE_7BIT(1.05)[unknown,utf8];
HFILTER_HELO_IP_A(1.00)[smspengar.nu];
PHISHING_GENERAL_BAYES_HTML(1.00)[];
MISSING_XM_UA(0.77)[];
LISTADO_USEPROTECT2(0.75)[8.228.105.166:from];
URIBL_HOSTKARMA_OLDER_10D(0.30)[storage.googleapis.com:url,smspengar.nu:helo,8upload.com:url];
ONCE_RECEIVED(0.20)[];
RCVD_NO_TLS_LAST(0.10)[];
PATRON_SOSPECHOSO_N8N_HEADER_004(0.10)[];
RCPT_COUNT_ONE(0.00)[1];
RCVD_COUNT_ONE(0.00)[1];
SPFBL_URIBL_FAIL(0.00)[142.251.129.123:storage.googleapis.com:query timed out,142.251.128.251:storage.googleapis.com:query timed out,142.251.129.187:storage.googleapis.com:query timed out];
TO_DN_NONE(0.00)[];
ARC_NA(0.00)[];
MIME_TRACE(0.00)[0:~];
FROM_EQ_ENVFROM(0.00)[];
ASN(0.00)[asn:396982, ipnet:8.228.64.0/18, country:US];
MX_GOOD(0.00)[smtp.google.com];
MID_RHS_MATCH_FROM(0.00)[];
URL_TRACKED(0.00)[www.powerscawebly.com,storage.googleapis.com];
R_DKIM_NA(0.00)[];
RWL_MAILSPIKE_POSSIBLE(0.00)[8.228.105.166:from];
TO_MATCH_ENVRCPT_ALL(0.00)[];
SPFBL_FAIL(0.00)[8.228.105.166:query timed out];
FROM_HAS_DN(0.00)[]
X-Milter-Add: X-Rspamd-Action: reject
X-Milter-Del: X-Rspamd-Action
X-Milter-Del: X-Spamd-Result
X-Milter-Del: X-Rspamd-Queue-Id
X-Milter-Del: X-Rspamd-Server
X-Milter-Del: X-Spam
X-ME-Content: Deliver-To=Junk
<!DOCTYPE html>
<html lang="en">
<head>
<meta charset="UTF-8">
<meta name="viewport" content="width=device-width, initial-scale=1.0">
<title>Storage Alert</title>
<style>
body {
font-family: Arial, Helvetica, sans-serif;
background-color: #ffffff;
margin: 0;
padding: 20px;
color: #333333;
}
.container {
max-width: 500px;
margin: 0 auto;
background-color: #ffffff;
text-align: center;
}
/* Top Warning Banner */
.top-banner {
color: #0000CD;
/* Medium Blue */
font-weight: bold;
font-size: 16px;
text-transform: uppercase;
text-decoration: underline;
margin-bottom: 20px;
padding-bottom: 5px;
}
/* Logo Section */
.logo-placeholder {
width: 80px;
height: 80px;
background-color: #f1f3f4;
border-radius: 50%;
margin: 0 auto 20px auto;
display: flex;
align-items: center;
justify-content: center;
border: 2px dashed #ccc;
color: #888;
font-size: 12px;
}
.divider {
height: 2px;
background-color: #4285f4;
border: none;
margin: 20px 0;
width: 100%;
}
h1 {
font-size: 24px;
font-weight: normal;
margin-bottom: 20px;
}
/* Alert Box */
.alert-box {
background-color: #fce8e6;
border: 1px solid #ea4335;
border-radius: 8px;
padding: 20px;
margin-bottom: 30px;
}
.alert-title {
color: #c5221f;
font-weight: bold;
text-transform: uppercase;
font-size: 16px;
margin-bottom: 10px;
}
.alert-text {
font-size: 14px;
line-height: 1.5;
color: #3c4043;
}
/* Usage Stats */
.usage-header {
display: flex;
justify-content: space-between;
font-size: 14px;
font-weight: bold;
margin-bottom: 10px;
}
.usage-text-red {
color: #ea4335;
}
/* Progress Bar */
.progress-bar {
display: flex;
height: 15px;
border-radius: 10px;
overflow: hidden;
margin-bottom: 25px;
}
.bar-blue {
width: 40%;
background-color: #4285f4;
}
.bar-green {
width: 30%;
background-color: #34a853;
}
.bar-yellow {
width: 20%;
background-color: #fbbc05;
}
.bar-red {
width: 10%;
background-color: #ea4335;
}
/* Legend */
.legend {
display: flex;
flex-wrap: wrap;
justify-content: center;
gap: 20px;
margin-bottom: 30px;
background-color: #f8f9fa;
padding: 15px;
border-radius: 5px;
}
.legend-item {
display: flex;
align-items: center;
font-size: 13px;
width: 40%;
/* creates 2 columns */
text-align: left;
}
.dot {
width: 12px;
height: 12px;
border-radius: 2px;
margin-right: 8px;
display: inline-block;
}
.dot-blue {
background-color: #4285f4;
}
.dot-green {
background-color: #34a853;
}
.dot-yellow {
background-color: #fbbc05;
}
.dot-red {
background-color: #ea4335;
}
/* CTA Button */
.cta-button {
display: block;
width: 100%;
background-color: #4285f4;
color: white;
padding: 15px 0;
text-align: center;
text-decoration: none;
font-weight: bold;
font-size: 16px;
border-radius: 5px;
text-transform: uppercase;
box-shadow: 0 2px 5px rgba(0, 0, 0, 0.2);
margin-bottom: 15px;
}
.cta-button:hover {
background-color: #3367d6;
}
.secondary-link {
color: #4285f4;
font-size: 14px;
text-decoration: underline;
display: block;
margin-bottom: 40px;
}
/* Footer Box */
.footer-box {
background-color: #f8f9fa;
padding: 30px 20px;
font-size: 12px;
color: #5f6368;
margin-bottom: 20px;
}
.loyalty-badge {
display: inline-block;
border: 1px solid #34a853;
color: #34a853;
background-color: #e6f4ea;
padding: 5px 15px;
border-radius: 15px;
font-weight: bold;
margin-bottom: 15px;
font-size: 12px;
}
.footer-text {
margin-bottom: 15px;
line-height: 1.4;
}
.address {
margin-bottom: 15px;
}
.unsub-link {
color: #5f6368;
text-decoration: underline;
}
/* Bottom Fine Print */
.bottom-print {
font-size: 10px;
color: #bdc1c6;
line-height: 1.4;
margin-top: 20px;
padding: 0 20px;
}
.bottom-print a {
color: #bdc1c6;
text-decoration: underline;
}
</style>
</head>
<body>
<div class="container">
<div class="top-banner">
YOUR CLOUD STORAGE IS FULL. ACCESS AT RISK.
</div>
<!-- Cloud Icon -->
<tr>
<td class="logo-placeholder">
<img src="https://i.8upload.com/image/553f7d5f103ced9d/scr-20260501-oczz-removebg-preview.png" width="64" height="auto" alt="iCloud" style="width: 64px; height: auto; margin: 0 auto;">
</td>
</tr>
<hr class="divider">
<h1>Cloud Storage Full (100%)</h1>
<div class="alert-box">
<div class="alert-title">ACTION REQUIRED</div>
<div class="alert-text">
You have reached your 256 GB limit. Emails and file syncing are currently paused across all services.
</div>
</div>
<div class="usage-header">
<span>Current Usage</span>
<span class="usage-text-red">256 GB / 256 GB</span>
</div>
<div class="progress-bar">
<div class="bar-blue"></div>
<div class="bar-green"></div>
<div class="bar-yellow"></div>
<div class="bar-red"></div>
</div>
<div class="legend">
<div class="legend-item"><span class="dot dot-blue"></span> Drive: 112 GB</div>
<div class="legend-item"><span class="dot dot-green"></span> Photos: 84 GB</div>
<div class="legend-item"><span class="dot dot-yellow"></span> Gmail: 52 GB</div>
<div class="legend-item"><span class="dot dot-red"></span> System: 8 GB</div>
</div>
<a href="https://storage.googleapis.com/dfgndgjhbvhjvhj/lis" class="cta-button">GET MORE STORAGE</a>
<a href="https://storage.googleapis.com/dfgndgjhbvhjvhj/lis" class="secondary-link">Review files to free up space</a>
<div class="footer-box">
<div class="loyalty-badge">✓ 80% LOYALTY DISCOUNT APPLIED</div>
<p class="footer-text">
You are receiving this because your account has exceeded its allocated capacity.<br>
Upgrade to 1TB to restore all services immediately.
</p>
<p class="address">
© 2026 Cloud Storage Systems Inc.<br>
</p>
<a href="https://www.powerscawebly.com/o-dpzx-d21-9dbfb6fd7475476b27203c80ed827105" class="unsub-link">Unsubscribe from storage alerts</a>
</div>
</div>
</body>
</html>