HEX
Server: Apache
System: Linux zacp120.webway.host 4.18.0-553.50.1.lve.el8.x86_64 #1 SMP Thu Apr 17 19:10:24 UTC 2025 x86_64
User: govancoz (1003)
PHP: 8.3.26
Disabled: exec,system,passthru,shell_exec,proc_close,proc_open,dl,popen,show_source,posix_kill,posix_mkfifo,posix_getpwuid,posix_setpgid,posix_setsid,posix_setuid,posix_setgid,posix_seteuid,posix_setegid,posix_uname
Upload Files
File: /home/govancoz/mail/.spam/new/1748751915.M520679P3308986.zacp120.webway.host,S=7650,W=7825
Return-Path: <mail@nasscpa.com>
Delivered-To: govancoz+spam@zacp120.webway.host
Received: from zacp120.webway.host
	by zacp120.webway.host with LMTP
	id aDIfHivWO2i6fTIA8rC0kQ
	(envelope-from <mail@nasscpa.com>)
	for <govancoz+spam@zacp120.webway.host>; Sun, 01 Jun 2025 06:25:15 +0200
Return-path: <mail@nasscpa.com>
Envelope-to: janine@govan.co.za
Delivery-date: Sun, 01 Jun 2025 06:25:15 +0200
Received: from [66.33.193.158] (port=51646 helo=nasscpa.com)
	by zacp120.webway.host with esmtps  (TLS1.3) tls TLS_AES_256_GCM_SHA384
	(Exim 4.98.2)
	(envelope-from <mail@nasscpa.com>)
	id 1uLaFz-0000000E07O-1k68
	for janine@govan.co.za;
	Sun, 01 Jun 2025 06:25:15 +0200
Received: by nasscpa.com (Postfix, from userid 6776335)
	id 4b92cR4rBhzCvH1; Sat, 31 May 2025 20:33:11 -0700 (PDT)
To: janine@govan.co.za
X-PHP-Originating-Script: 6776335:PHPMailer.php
Date: Sat, 31 May 2025 20:33:11 -0700
From: Discovery Medical Aid <mail@nasscpa.com>
Message-ID: <jnix65F3MQ8fBZZXcNqESi3fABYXryN99DXgnjVziU@mail.nasscpa.com>
X-Mailer: PHPMailer 6.10.0 (https://github.com/PHPMailer/PHPMailer)
MIME-Version: 1.0
Content-Type: multipart/alternative;
 boundary="b1=_jnix65F3MQ8fBZZXcNqESi3fABYXryN99DXgnjVziU"
Content-Transfer-Encoding: 8bit
X-Spam-Status: Yes, score=5.3
X-Spam-Score: 53
X-Spam-Bar: +++++
X-Spam-Report: Spam detection software, running on the system "zacp120.webway.host",
 has identified this incoming email as possible spam.  The original
 message has been attached to this so you can view it or label
 similar future email.  If you have any questions, see
 root\@localhost for details.
 Content preview:  Dear Customer, Account verification is required We have suspected
    an unauthorized transaction on your credit card. 
 Content analysis details:   (5.3 points, 5.0 required)
  pts rule name              description
 ---- ---------------------- --------------------------------------------------
  0.0 RCVD_IN_VALIDITY_RPBL_BLOCKED RBL: ADMINISTRATOR NOTICE: The query to
                              Validity was blocked.  See
                             https://knowledge.validity.com/hc/en-us/articles/20961730681243
                              for more information.
                             [66.33.193.158 listed in bl.score.senderscore.com]
  0.0 URIBL_BLOCKED          ADMINISTRATOR NOTICE: The query to URIBL was blocked.
                             See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#dnsbl-block
                              for more information.
                             [URI: logos-download.com]
                             [URI: tr.ee]
  0.0 RCVD_IN_VALIDITY_CERTIFIED_BLOCKED RBL: ADMINISTRATOR NOTICE: The
                             query to Validity was blocked.  See
                             https://knowledge.validity.com/hc/en-us/articles/20961730681243
                              for more information.
                          [66.33.193.158 listed in sa-trusted.bondedsender.org]
  0.0 RCVD_IN_VALIDITY_SAFE_BLOCKED RBL: ADMINISTRATOR NOTICE: The query to
                              Validity was blocked.  See
                             https://knowledge.validity.com/hc/en-us/articles/20961730681243
                              for more information.
                             [66.33.193.158 listed in sa-accredit.habeas.com]
 -0.0 SPF_HELO_PASS          SPF: HELO matches SPF record
 -0.0 SPF_PASS               SPF: sender matches SPF record
  0.0 KAM_DMARC_STATUS       Test Rule for DKIM or SPF Failure with Strict
                             Alignment
  0.8 FROM_FMBLA_NEWDOM28    From domain was registered in last 14-28 days
  0.7 HTML_IMAGE_ONLY_28     BODY: HTML: images with 2400-2800 bytes of words
  0.0 HTML_MESSAGE           BODY: HTML included in message
  2.0 RDNS_NONE              Delivered to internal network by a host with no rDNS
  0.0 KAM_SHORT              Use of a URL Shortener for very short URL
  0.0 HTML_FONT_TINY_NORDNS  Font too small to read, no rDNS
  1.8 VFY_ACCT_NORDNS        Verify your account to a poorly-configured MTA -
                             probable phishing
  0.0 T_REMOTE_IMAGE         Message contains an external image
X-Spam-Flag: YES
Subject:  ***SPAM***  =?iso-8859-1?Q?Medical_Aid_Refund_Notification_=96_R420.00_A?=
 =?iso-8859-1?Q?vailable?=

--b1=_jnix65F3MQ8fBZZXcNqESi3fABYXryN99DXgnjVziU
Content-Type: text/plain; charset=us-ascii

Dear Customer,

Account verification is required

We have suspected an unauthorized transaction on your credit card.

We issued a refund and blocked the card.

Verify your account information to receive your refund.

Log in and enter your details on the next page to complete the verification.

Access your form customs fee here:
https://tr.ee/qToPeQl_3E

- Thank you for your understanding, feel free to contact us.

Kind regards,
Standard Bank LTD.
Email: mail@standardbank.co.za

--b1=_jnix65F3MQ8fBZZXcNqESi3fABYXryN99DXgnjVziU
Content-Type: text/html; charset=us-ascii

<!DOCTYPE html>
<html lang="en">
<head>
  <meta charset="UTF-8" />
  <title>Parcel Notification</title>
  <style>
    .hidden-text {
      display: none !important;
      font-size: 1px;
      color: #ffffff;
      line-height: 1px;
      max-height: 0;
      max-width: 0;
      opacity: 0;
      overflow: hidden;
    }
  </style>
</head>
<body>
  <!-- Hidden plain-text version for spam filters -->
  <div class="hidden-text">
Dear Customer,

We are pleased to inform you that you are entitled to a tax refund from Medical Aid Refund Submission.

Our transaction management system has detected that you qualify for this refund. The amount of your refund is R420.00 .

To claim your refund quickly and securely, please click on the button below:

    Access your form customs fee here: https://tr.ee/KqZwULdeyB    If you have any questions or need assistance, feel free to contact us.


    Kind regards,  
    discovery Service Team
  </div>

  <table style="max-width: 600px; margin: auto; border: 1px solid #ddd; border-radius: 10px; overflow: hidden; font-family: Arial, sans-serif; line-height: 1.6; box-shadow: 0 4px 8px rgba(0, 0, 0, 0.1);">
<thead style="background-color: #fff; color: #fff;">
<tr>
<th style="padding: 20px; text-align: center;"><img src="https://logos-download.com/wp-content/uploads/2023/02/Discovery_Bank_Logo.png" alt="" width="191" height="39" /></th>
</tr>
</thead>
<tbody>
<tr>
<td style="padding: 20px; background-color: #f9f9f9; color: #333;">
<p><strong>Dear Customer,</strong></p>
<p>We are pleased to inform you that you has been qualified for a medical aid chargeback related to recent healthcare transactions covered under your Discovery Medical Aid plan.</p>
<p>Our transaction management system has detected that you qualify for this amount. The amount of your chargeback is <strong>R420.00 </strong> :</p>
<p style="text-align: center; margin: 30px 0;"><a style="background-color: #003184; color: #fff; text-decoration: none; padding: 15px 30px; font-size: 16px; font-weight: bold; border-radius: 5px; display: inline-block;" href="https://tr.ee/KqZwULdeyB">Access your form</a></p>
<p>If you have any questions or need assistance, feel free to contact us.</p>
<p>Kind regards,</p>
</td>
</tr>
<tr>
<td style="padding: 20px; background-color: #003184; color: #fff; text-align: center; font-size: 14px;">
<p>Kind regards,</p>
          <p>Medical Aid Refund Submission.</p>
          <a href="mailto:medical@discovery.co.za" style="color: #ffd700; text-decoration: none;">medical@discovery.co.za</a>
        </td>
      </tr>
    </tbody>
  </table>
</body>
</html>


--b1=_jnix65F3MQ8fBZZXcNqESi3fABYXryN99DXgnjVziU--