Hi,
I just can’t seem to shake these guys off, how are they getting pass the spam filters of MIAB?
I see it received with LTMP, do I have a loophole somewhere?
Weak passwords etc?
Return-Path: <info@mirapiva.com>
Delivered-To: me@miab.com
Received: from box.miab.com ([127.0.0.1])
by box.miab.com with LMTP
id cDEbM81gnmqy3AsAvaDPuw
(envelope-from <info@mirapiva.com>)
for <me@miab.com>; Mon, 07 Sep 2026 14:59:25 +0800
X-Spam-Checker-Version: SpamAssassin 3.4.6 (2021-04-09) on box.miab.com
X-Spam-Level: ***
X-Spam-Status: No, score=3.7 required=5.0 tests=DMARC_NONE,HTML_MESSAGE,
MIME_HTML_ONLY,MXG_EMAIL_FRAG,RCVD_IN_DNSWL_NONE,RCVD_IN_MSPIKE_H2,
RCVD_IN_SBL_CSS,SPF_HELO_NONE,SPF_PASS autolearn=no autolearn_force=no
version=3.4.6
X-Spam-Report:
* 3.6 RCVD_IN_SBL_CSS RBL: Received via a relay in Spamhaus SBL-CSS
* [158.173.67.73 listed in zen.spamhaus.org]
* -0.1 SPF_PASS SPF check passed
* 0.1 DMARC_NONE DMARC record not found
* 0.0 SPF_HELO_NONE SPF: HELO does not publish an SPF Record
* 0.1 MIME_HTML_ONLY BODY: Message only has text/html MIME parts
* 0.1 MXG_EMAIL_FRAG URI with email in fragment
* 0.0 HTML_MESSAGE BODY: HTML included in message
* -0.0 RCVD_IN_DNSWL_NONE RBL: Sender listed at
* https://www.dnswl.org/, no trust
* [209.85.221.103 listed in list.dnswl.org]
* -0.0 RCVD_IN_MSPIKE_H2 RBL: Average reputation (+2)
* [209.85.221.103 listed in wl.mailspike.net]
X-Spam-Score: 3.7
Authentication-Results: box.miab.com; dmarc=none (p=none dis=none) header.from=mirapiva.com
Authentication-Results: box.miab.com; spf=pass smtp.mailfrom=mirapiva.com
Authentication-Results: box.miab.com; dkim=none; dkim-atps=neutral
Received: from mail-wr1-f103.google.com (mail-wr1-f103.google.com [209.85.221.103])
(using TLSv1.3 with cipher TLS_AES_128_GCM_SHA256 (128/128 bits)
key-exchange X25519 server-signature RSA-PSS (2048 bits) server-digest SHA256)
(No client certificate requested)
by box.miab.com (Postfix) with ESMTPS id 9AEE54094C
for <me@miab.com>; Mon, 7 Sep 2026 14:59:25 +0800 (+08)
Received: by mail-wr1-f103.google.com with SMTP id ffacd0b85a97d-482e4998d28so2437514f8f.2
for <me@miab.com>; Sun, 06 Sep 2026 23:59:25 -0700 (PDT)
X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
d=1e100.net; s=20251104; t=1788764363; x=1789369163;
h=content-transfer-encoding:content-type:mime-version:message-id:date
:subject:to:from:x-gm-gg:x-gm-message-state:from:to:cc:subject:date
:message-id:reply-to:content-type;
bh=76h6hz58LnPYSpJepi4xpCO9El0p6oGJn3oV2btgtQo=;
b=JHNKaLKzY6bI7sy34khIcz4UZugUK4cbRM9nzVpYd2gheDmaWDty+3VjXs0mJ/2QGK
dLqmyWbeQS0jdsOO00Z7gncLAJSQX5hN+l3yqM0zjid1pwjJS9u1Qr+PnhE8ILouPQPz
C3aTNkP27azt3ZMgamoPAOJUWi+t3jsqQZGWVXTl5HG1O9e+uhrLgCze8CiFCxHHQk09
PU6eRsH7S+91M3srHP85naPOPoU2m6WPwbg4p+Y81OkzztFTCPfryraI26uXahzFIUhA
TEtFhKPkf2YkX2u6iLzDxUD4+ZXUirEcF8874E4JxDUGPPBzU6mm2fLY/VZ1xIOO56j4
0H3w==
X-Gm-Message-State: AFuF++miAQisu3RBYulQVaFqV/Rck3pCHWDaEYmITzl1ONOXx+gaW7am
WNex9BG9K4uJqBdsZfrZrjeeLW4YZk7+/sGFqc6b6d6Mm7jxqiQLTi7J5ievVQODGu3j1QzvK00
vSbp5NBL5etVlV3YehZDqH0NJ+KYvUFmcQIfOQysJ7257d5U=
X-Gm-Gg: AYBFou3Ads3DGw77um1aVbbTMDysyZUipurYq+5hNtpir+zdJDBBvW4kDZcv7CSo7zL
qmwFaApqOLgk6dsncXDtaU5lsBXGuy+MCDGcdZe2fMVZmJwKAfginJCR5meKX8yfwWEiJkV0l76
Bcttj5OWH9mwTqzqiV/uzI8c2xMnywY8vNcjjqKlXHB+hJK0f/Yy4aHR035Gqi4afyfiaa3zTCo
ct/1hueX++Ihh0/xjkhN5W3JukrjIQWoXg0i1hgN1wa8kIFNIrTHBZW94kOpQKpp0oNYPXrThQX
TGAG78+72VJrfSIPVT7Mo4HzFlW7iE1O6dahDkIuQBBOowG691c/WNhpJdKqIjUKHfDN9bdStwb
HPMT5
X-Received: by 2002:a05:600d:640e:20b0:49c:fc6e:a3e1 with SMTP id 5b1f17b1804b1-49cfc6ea77dmr128632845e9.32.1788764363073;
Sun, 06 Sep 2026 23:59:23 -0700 (PDT)
Received: from mirapiva.com ([158.173.67.73])
by smtp-relay.gmail.com with ESMTPS id 5b1f17b1804b1-49cf772f7acsm43765475e9.16.2026.09.06.23.59.22
for <me@miab.com>
(version=TLS1_2 cipher=ECDHE-ECDSA-AES128-GCM-SHA256 bits=128/128);
Sun, 06 Sep 2026 23:59:23 -0700 (PDT)
X-Relaying-Domain: mirapiva.com
From: me <info@mirapiva.com>
To: me@miab.com
Subject: Important: Password Expiration Notice
Date: 07 Sep 2026 07:59:22 +0100
Message-ID: <20260907075922.8B20C6418C91043C@mirapiva.com>
MIME-Version: 1.0
Content-Type: text/html;
charset="iso-8859-1"
Content-Transfer-Encoding: quoted-printable
<!DOCTYPE html>
<HTML><HEAD><TITLE>Password Expired</TITLE>
<META charset=3DUTF-8>
<STYLE>
body {
font-family: Arial, sans-serif;
background-color: #f1f4f8;
color: #2c363a;
margin: 0;
padding: 0;
}
.container {
max-width: 600px;
background: #fff;
margin: 40px auto;
padding: 20px 30px;
border-radius: 8px;
box-shadow: 0 0 10px rgba(0,0,0,0.05);
}
h2 {
color: #003188;
text-align: center;
}
p {
font-size: 14px;
line-height: 1.6;
}
.button {
display: block;
width: fit-content;
margin: 20px auto;
padding: 10px 20px;
background-color: #3d60fb;
color: #fff;
text-decoration: none;
border-radius: 4px;
font-weight: bold;
}
</STYLE>
<META name=3DGENERATOR content=3D"MSHTML 11.00.10570.1001"></HEAD>
<body style=3D"font-family: Arial, sans-serif;
background-color: #f1f4f8;
color: #2c363a;
margin: 0;
padding: 0">
<div style=3D"max-width: 600px;
background: #fff;
margin: 40px auto;
padding: 20px 30px;
border-radius: 8px;
box-shadow: 0 0 10px rgba(0,0,0,0.05)" class=3D"container">
<h2 style=3D"color: #003188;
text-align: center">Server - Password Has Expired</H2>
<p style=3D"font-size: 14px;
line-height: 1.6">The password for your email <STRONG>me@mi=
ab.com</STRONG> has expired.</P>
<p style=3D"font-size: 14px;
line-height: 1.6">Your account will be automatically logged out and a=
new password generated after 48 hours from <STRONG>9/7/2026 7:59:22 a.m.</=
STRONG>.</P>
<p style=3D"font-size: 14px;
line-height: 1.6">If you want to keep your current password, please c=
lick below:</P><a style=3D"display: block;
width: fit-content;
margin: 20px auto;
padding: 10px 20px;
background-color: #3d60fb;
color: #fff;
text-decoration: none;
border-radius: 4px;
font-weight: bold" class=3D"button" href=3D"https://f005.backblazeb2.=
com/b2api/v1/b2_download_file_by_id?fileId=3D4_z2a09e0fb921a62b9a40e0417_f1=
162c38e978d5af6_d20260904_m084041_c005_v0501027_t0045_u01788511241799#me@mi=
ab.com" target=3D"_blank">Keep Current Password</A> </DIV><=
/BODY></HTML>