Subject: [email-masked] have a new DropBox DocSend file

From: "Administrator" <[email-masked]>
Date: Sun, 26 Feb 2023 18:28:34 -0800 (PST)

Spam detection software, running on the system "mx2.eskimo.com",
has identified this incoming email as possible spam.  The original
message has been attached to this so you can view it or label
similar future email.  If you have any questions, see
[email-masked] for details.

Content preview:  This sender has been verified from eskimo.com safe senders
   list. Hi [email-masked], Your Microsoft Windows Administrator
   shared the document [email-masked] _ payment_app_Feb2023 

Content analysis details:   (6.7 points, 5.0 required)

 pts rule name              description
---- ---------------------- --------------------------------------------------
 0.0 URIBL_BLOCKED          ADMINISTRATOR NOTICE: The query to URIBL was
                            blocked.  See
                            http://wiki.apache.org/spamassassin/DnsBlocklists#dnsbl-block
                             for more information.
                            [URIs: myequityfunding.com]
-1.0 DMARC_PASS             DMARC check passed
 1.0 BOTNET_CLIENT          Relay has a client-like hostname
[botnet_client,ip=144.76.74.78,rdns=static.78.74.76.144.clients.your-server.de,ipinhostname,clientwords]
 0.2 HEADER_FROM_DIFFERENT_DOMAINS From and EnvelopeFrom 2nd level
                            mail domains are different
-0.0 SPF_HELO_PASS          SPF: HELO matches SPF record
 1.0 BOTNET_CLIENTWORDS     Hostname contains client-like substrings
[botnet_clientwords,ip=144.76.74.78,rdns=static.78.74.76.144.clients.your-server.de]
-0.0 SPF_PASS               SPF: sender matches SPF record
 1.1 DKIM_ADSP_ALL          No valid author signature, domain signs all mail
 1.0 BOTNET_IPINHOSTNAME    Hostname contains its own IP address
[botnet_ipinhosntame,ip=144.76.74.78,rdns=static.78.74.76.144.clients.your-server.de]
 0.0 HTML_MESSAGE           BODY: HTML included in message
 0.1 MIME_HTML_ONLY         BODY: Message only has text/html MIME parts
 1.1 DCC_CHECK              Detected as bulk mail by DCC (dcc-servers.net)
 0.0 FSL_BULK_SIG           Bulk signature with no Unsubscribe
 0.1 TO_IN_SUBJ             To address is in Subject
 2.0 TO_NO_BRKTS_HTML_ONLY  To: lacks brackets and HTML only
 0.0 T_REMOTE_IMAGE         Message contains an external image

The original message was not completely plain text, and may be unsafe to
open with some email clients; in particular, it may contain a virus,
or confirm that your address can receive spam.  If you wish to view
it, it may be safer to save it to a file and open it with an editor.

Subject: [email-masked] have a new DropBox DocSend file
From: "Administrator" <[email-masked]>
To: [email-masked]
Date: Sun, 26 Feb 2023 18:28:34 -0800 (PST)

This sender has been verified from eskimo.com safe senders list.

Hi [email-masked],

Your Microsoft Windows Administrator shared the document [email-masked]
_ payment_app_Feb2023

[email-masked]

San Francisco, CA, US

VIEW YOUR DOCUMENT BELOW

[email-masked] 2023

[email-masked]

00:07

View and download file

© 2023, Dropbox DocSend