Loan spam from Outlook
Posted by Dave Yadallee on
Return-path:
Envelope-to: dave@doctor.nl2k.ab.ca
Delivery-date: Fri, 20 Jan 2023 18:25:38 -0700
Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.96)
(envelope-from)
id 1pJ226-000CFR-0v
for dave@doctor.nl2k.ab.ca;
Fri, 20 Jan 2023 17:46:58 -0700
Resent-From: The Doctor
Resent-Date: Fri, 20 Jan 2023 17:46:58 -0700
Resent-Message-ID:
Resent-To: Dave Yadallee
Received: from mail-tyzapc01rlhn2185.outbound.protection.outlook.com ([40.95.110.185]:43024 helo=APC01-TYZ-obe.outbound.protection.outlook.com)
by doctor.nl2k.ab.ca with esmtps (TLS1.2) tls TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384
(Exim 4.96)
(envelope-from)
id 1pIvl8-000Lt9-1v
for doctor@netknow.ca;
Fri, 20 Jan 2023 11:05:06 -0700
ARC-Seal: i=1; a=rsa-sha256; s=arcselector9901; d=microsoft.com; cv=none;
b=LXkqLPvZj9tuMvMJ2nhV9v4CD7s0yH4i9zcn5KsZS+CkD8UQYeKVhesRJcrHxyKKpHgjlnk2rqAntY6zU++Wc2QPASQiFXu4v9Wnq9gyzUQ3gj1hCYDZuDXMi7rmb51fnNB5q40oFn3qc5v3weNu44Gw/8+URShvfEXEQubH5TFXiGFtwDFb+V53/a5mIzvaawRijufO7Go1KvwcaNThjC8+zzn5Ltc7Z7LaXOjpBRpQHw/2q9GCqw5xo0Ksbz+kFc9hOu2kvB1OD+dk7p+I0vPtlsCg2FCFgIMuESd7oedUCVCldpTk1af74k9hxfqT1XvJuO8BO2SOOdYCx7rDTg==
ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com;
s=arcselector9901;
h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1;
bh=7s7JBJ9nb18ZFf/ogdm1v3Xta/AfP6qNDtvYuWgtVww=;
b=BBVSPw4qLnjHquYmNT/Tzgwy4Q/nytYrHeYECY9Xe3RFSqIx8+5K7inRiMc/xQjpwOTdoxFYc72ed6G6dz3SGPs7rqI41HD/MkHP64/CMMgeO/pXyGhFGLXG0LUdtuztbhfzrTtukA7kIlKWUAE2tiJlMlzpHIlw+1D6/NIpxfydnh0C0WbVwI8ioIlXgBdEc+dh8HzfAsscTRtADgf0PJxipxbyuvhw1UVJyYDWw1D4WT0gs7nIBnf+5/LfkB3bfZommELJRpF7WWIAgwmdggry9i5u574keIRU6CEVphmQdMlMUktf7P4ZNlIwjDpi5YT23tp1rjsj91A/XqBvUg==
ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=fail (sender ip is
114.6.82.34) smtp.rcpttodomain=fundacioncarolina.org.co
smtp.mailfrom=mcdgrp.com; dmarc=none action=none header.from=mcdgrp.com;
dkim=none (message not signed); arc=none
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
d=toyotaastra.onmicrosoft.com; s=selector2-toyotaastra-onmicrosoft-com;
h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck;
bh=7s7JBJ9nb18ZFf/ogdm1v3Xta/AfP6qNDtvYuWgtVww=;
b=Wh1wgRv82wLiq9A1Ow5eiLln41Vp4wlE9e2seVW2GESZ+yE2Uvnr9deqFusdnolKeGSKs0AV+v0uRkwMQqtA0SIdQZDQ6cwoB/f2U9cncBCSV3g6qtPGPEg9j/uCRcII8/z/WEEWuEXyaHIXVrfgnP3Tau4/Sb1P6329UhXebmc=
Received: from TYAPR01CA0157.jpnprd01.prod.outlook.com (2603:1096:404:7e::25)
by TY0PR02MB6017.apcprd02.prod.outlook.com (2603:1096:400:212::10) with
Microsoft SMTP Server (version=TLS1_2,
cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.6002.25; Fri, 20 Jan
2023 18:02:24 +0000
Received: from TYZAPC01FT018.eop-APC01.prod.protection.outlook.com
(2603:1096:404:7e:cafe::a4) by TYAPR01CA0157.outlook.office365.com
(2603:1096:404:7e::25) with Microsoft SMTP Server (version=TLS1_2,
cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.6002.27 via Frontend
Transport; Fri, 20 Jan 2023 18:02:24 +0000
X-MS-Exchange-Authentication-Results: spf=fail (sender IP is 114.6.82.34)
smtp.mailfrom=mcdgrp.com; dkim=none (message not signed)
header.d=none;dmarc=none action=none header.from=mcdgrp.com;
Received-SPF: Fail (protection.outlook.com: domain of mcdgrp.com does not
designate 114.6.82.34 as permitted sender) receiver=protection.outlook.com;
client-ip=114.6.82.34; helo=toyota.astra.co.id;
Received: from toyota.astra.co.id (114.6.82.34) by
TYZAPC01FT018.mail.protection.outlook.com (10.118.152.93) with Microsoft SMTP
Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384) id
15.20.6023.16 via Frontend Transport; Fri, 20 Jan 2023 18:02:22 +0000
Received: from User (10.85.28.198) by VSV-C002-002006.toyota.astra.co.id
(10.185.48.40) with Microsoft SMTP Server id 15.0.1497.28; Sat, 21 Jan 2023
01:01:52 +0700
Reply-To:
From: Sawda Finance
Subject: 24/7 Financial Emergency Service
Date: Fri, 20 Jan 2023 18:02:12 -0800
MIME-Version: 1.0
Content-Type: text/html; charset="utf-8"
Content-Transfer-Encoding: quoted-printable
X-Priority: 3
X-MSMail-Priority: Normal
X-Mailer: Microsoft Outlook Express 6.00.2600.0000
X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2600.0000
Message-ID:
To: Undisclosed recipients:;
X-EOPAttributedMessage: 0
X-MS-PublicTrafficType: Email
X-MS-TrafficTypeDiagnostic: TYZAPC01FT018:EE_|TY0PR02MB6017:EE_
X-MS-Office365-Filtering-Correlation-Id: a4da172b-f25b-4f8e-e52a-08dafb107b2d
X-MS-Exchange-SenderADCheck: 2
X-MS-Exchange-AntiSpam-Relay: 1
X-Microsoft-Antispam: BCL:0;
X-Microsoft-Antispam-Message-Info:
=?windows-1251?Q?yjPYuChpFgUvcepnqmlmWOb1BeWQpOVmS6GzCEp9LEFb6kkb3eY+G2Gf?=
=?windows-1251?Q?twki59McgG69MaVc+M7l81UDv1Z9Fms1KHdOnuZWBOHifNniBYscqjIX?=
=?windows-1251?Q?ScJK36L6KJe+VGmeDubS6emEQHUvMCwkGaPJJVbiqTMoFzRSdiuHXMqf?=
=?windows-1251?Q?dUVer3S+EKrEWkN3idVy6L8S21tnC25EEYBmvM0PT67voCJoLW1AaCLS?=
=?windows-1251?Q?b/QFaSGVpfudTURYXvcIk5eCbxyCjBkpklWo9xQmZkGNHGbQC5LPTs3X?=
=?windows-1251?Q?Svrk/wsn2b6BneunQsSLW1IjWFIquNC94xklo6caSrwGxit/27VrQVYH?=
=?windows-1251?Q?axO30EX+ikPXYjUpn4wyVwS02nU8fRD2q6qo+acAaEDcvrLzUsL5nTkv?=
=?windows-1251?Q?WpgfprwqiR/e3zurIPRPSUTXW8c4dN86xTTs43pao3ov2761I35m1PJw?=
=?windows-1251?Q?mPh8xt7K75MJtAPAsMrOBY6VwRDeq7LTh0+HGGOGgkFeA8xjjM3rbUVa?=
=?windows-1251?Q?Y0xpZni1CBkCoAHRjlxSnl90TfcD1z245WnGnimkKViZAUOTIUMmtrhn?=
=?windows-1251?Q?GsQkl1a2+lMk2UkLLF5Ttr8fpRy11DIIGws0yXLja43ZVqRa8qd64Qeq?=
=?windows-1251?Q?b0aayyHWXNmU13gYKTo8qoEXWIgEEaavnx0ur3LIjJuWACnNxJfQ+OIq?=
=?windows-1251?Q?d3sAO96ZssSXaBZ0tBKXE6t//zvEKnvOaipkxWeay5o4eL/QHER49RiE?=
=?windows-1251?Q?GP5qwyNDLxlspGpwi0EHH0LUDfQ6wdP8ROBAu/arH0XfJPneiIkYXGa5?=
=?windows-1251?Q?BIwtjKDWjfsq6mILor0QQ82Y6RO7WWbdE4OTbP5Y/nD0B2To+M/z2IJ3?=
=?windows-1251?Q?ZJ8NRb9iUz8NszKX9MwBwYnVGtJ1QJfy64+JPstArmYSL6f5BCFlGnXF?=
=?windows-1251?Q?9xmdGjRrTxojJLbbQkyNWcgSYkYNStWUIElBllz8KAmaCD+LO1SG97Ol?=
=?windows-1251?Q?HOyT5l0bj37gzHTVST0ncn3EAKnPOuPJZREi4SpyyDTTK0+/vgOH9LYh?=
=?windows-1251?Q?kZoVYSLagDogg+9ZKqerA3dY6/tY9C3gxFkUsoTT33FqwnZrepSaOXYV?=
=?windows-1251?Q?YUB3vpq9j+nVQGfNBfVClqIKXsbgTLHnr1CeeJuAHa7NROZVLN6dHOM5?=
=?windows-1251?Q?gLziMnPuGtsvx2SDybgoTaXclPQS/SBYqp5Ti6GEjgVM3ozrhYEcXg?=
=?windows-1251?Q?=3D=3D?=
X-Forefront-Antispam-Report:
CIP:114.6.82.34;CTRY:ID;LANG:en;SCL:5;SRV:;IPV:CAL;SFV:SPM;H:toyota.astra.co.id;PTR:114-6-82-34.resources.indosat.com;CAT:OSPM;SFS:(13230022)(4636009)(39860400002)(396003)(376002)(136003)(346002)(109986013)(451199015)(40470700004)(36906005)(26005)(66899015)(336012)(81166007)(82740400003)(40460700003)(86362001)(498600001)(2860700004)(82310400005)(316002)(40480700001)(9686003)(24736004)(356005)(32650700002)(35950700001)(83380400001)(108616005)(7336002)(2906002)(7416002)(7366002)(7276002)(8676002)(5660300002)(7406005)(70206006)(41300700001)(6666004)(70586007)(8936002)(4001630100005);DIR:OUT;SFP:1023;
X-OriginatorOrg: toyota.astra.co.id
X-MS-Exchange-CrossTenant-OriginalArrivalTime: 20 Jan 2023 18:02:22.9281
(UTC)
X-MS-Exchange-CrossTenant-Network-Message-Id: a4da172b-f25b-4f8e-e52a-08dafb107b2d
X-MS-Exchange-CrossTenant-Id: 52d4e358-2ecb-48e2-bad4-d3c62441ff17
X-MS-Exchange-CrossTenant-OriginalAttributedTenantConnectingIp: TenantId=52d4e358-2ecb-48e2-bad4-d3c62441ff17;Ip=[114.6.82.34];Helo=[toyota.astra.co.id]
X-MS-Exchange-CrossTenant-AuthSource:
TYZAPC01FT018.eop-APC01.prod.protection.outlook.com
X-MS-Exchange-CrossTenant-AuthAs: Anonymous
X-MS-Exchange-CrossTenant-FromEntityHeader: HybridOnPrem
X-MS-Exchange-Transport-CrossTenantHeadersStamped: TY0PR02MB6017
X-Spam_score: 8.2
X-Spam_score_int: 82
X-Spam_bar: ++++++++
X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",
has identified this incoming email as possible spam. The original
message has been attached to this so you can view it or label
similar future email. If you have any questions, see
@@CONTACT_ADDRESS@@ for details.
Content preview: âš [IMPORTANT CAUTION!]: This is e-mail from outside. Please
verify e-mail sender and subject carefully, Do not open unknown links, attachments
or non-related with your business e-mail and report sus [...]
Content analysis details: (8.2 points, 5.0 required)
pts rule name description
---- ---------------------- --------------------------------------------------
0.0 SPF_HELO_FAIL SPF: HELO does not match SPF record (fail)
[SPF failed: Please see http://www.openspf.org/Why?s=helo;id=APC01-TYZ-obe.outbound.protection.outlook.com;ip=40.95.110.185;r=doctor.nl2k.ab.ca]
-0.2 RCVD_IN_MSPIKE_H2 RBL: Average reputation (+2)
[40.95.110.185 listed in wl.mailspike.net]
0.9 SPF_FAIL SPF: sender does not match SPF record (fail)
[SPF failed: Please see http://www.openspf.org/Why?s=mfrom;id=capitap%40mcdgrp.com;ip=40.95.110.185;r=doctor.nl2k.ab.ca]
0.0 NSL_RCVD_FROM_USER Received from User
0.0 AXB_X_FF_SEZ_S Forefront sez this is spam
0.0 DATE_IN_FUTURE_06_12 Date: is 6 to 12 hours after Received: date
1.1 MIME_HTML_ONLY BODY: Message only has text/html MIME parts
0.0 HTML_MESSAGE BODY: HTML included in message
0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid
0.0 FORGED_OUTLOOK_HTML Outlook can't send HTML message only
0.5 PDS_HELO_SPF_FAIL High profile HELO that fails SPF
0.6 FSL_NEW_HELO_USER Spam's using Helo and User
0.0 AXB_XMAILER_MIMEOLE_OL_024C2 Yet another X header trait
2.5 FREEMAIL_FORGED_REPLYTO Freemail in Reply-To, but not From
2.8 FORGED_MUA_OUTLOOK Forged mail pretending to be from MS Outlook
0.0 KHOP_HELO_FCRDNS Relay HELO differs from its IP's reverse DNS
Subject: {SPAM?} 24/7 Financial Emergency Service
" bottommargin=3D"5">
n" style=3D"max-width: 800px; width: 100%; border:#FF0000 1px solid;">
font-size: 14px; font-family: 'Segoe UI', Arial, Helvetica, sans-serif;;pad=
ding:5px;">
; font-family: 'Segoe UI', Arial, Helvetica, sans-serif;padding:10px;">
[IMPORTANT CAUTION!]: This is e-mail from outside. Please =
verify e-mail sender and subject carefully, Do not open unknown links, atta=
chments or non-related with your business e-mail and report suspicious e-ma=
il to
it.helpdesk@toyota.astra.co.id
Envelope-to: dave@doctor.nl2k.ab.ca
Delivery-date: Fri, 20 Jan 2023 18:25:38 -0700
Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.96)
(envelope-from
id 1pJ226-000CFR-0v
for dave@doctor.nl2k.ab.ca;
Fri, 20 Jan 2023 17:46:58 -0700
Resent-From: The Doctor
Resent-Date: Fri, 20 Jan 2023 17:46:58 -0700
Resent-Message-ID:
Resent-To: Dave Yadallee
Received: from mail-tyzapc01rlhn2185.outbound.protection.outlook.com ([40.95.110.185]:43024 helo=APC01-TYZ-obe.outbound.protection.outlook.com)
by doctor.nl2k.ab.ca with esmtps (TLS1.2) tls TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384
(Exim 4.96)
(envelope-from
id 1pIvl8-000Lt9-1v
for doctor@netknow.ca;
Fri, 20 Jan 2023 11:05:06 -0700
ARC-Seal: i=1; a=rsa-sha256; s=arcselector9901; d=microsoft.com; cv=none;
b=LXkqLPvZj9tuMvMJ2nhV9v4CD7s0yH4i9zcn5KsZS+CkD8UQYeKVhesRJcrHxyKKpHgjlnk2rqAntY6zU++Wc2QPASQiFXu4v9Wnq9gyzUQ3gj1hCYDZuDXMi7rmb51fnNB5q40oFn3qc5v3weNu44Gw/8+URShvfEXEQubH5TFXiGFtwDFb+V53/a5mIzvaawRijufO7Go1KvwcaNThjC8+zzn5Ltc7Z7LaXOjpBRpQHw/2q9GCqw5xo0Ksbz+kFc9hOu2kvB1OD+dk7p+I0vPtlsCg2FCFgIMuESd7oedUCVCldpTk1af74k9hxfqT1XvJuO8BO2SOOdYCx7rDTg==
ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com;
s=arcselector9901;
h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1;
bh=7s7JBJ9nb18ZFf/ogdm1v3Xta/AfP6qNDtvYuWgtVww=;
b=BBVSPw4qLnjHquYmNT/Tzgwy4Q/nytYrHeYECY9Xe3RFSqIx8+5K7inRiMc/xQjpwOTdoxFYc72ed6G6dz3SGPs7rqI41HD/MkHP64/CMMgeO/pXyGhFGLXG0LUdtuztbhfzrTtukA7kIlKWUAE2tiJlMlzpHIlw+1D6/NIpxfydnh0C0WbVwI8ioIlXgBdEc+dh8HzfAsscTRtADgf0PJxipxbyuvhw1UVJyYDWw1D4WT0gs7nIBnf+5/LfkB3bfZommELJRpF7WWIAgwmdggry9i5u574keIRU6CEVphmQdMlMUktf7P4ZNlIwjDpi5YT23tp1rjsj91A/XqBvUg==
ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=fail (sender ip is
114.6.82.34) smtp.rcpttodomain=fundacioncarolina.org.co
smtp.mailfrom=mcdgrp.com; dmarc=none action=none header.from=mcdgrp.com;
dkim=none (message not signed); arc=none
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
d=toyotaastra.onmicrosoft.com; s=selector2-toyotaastra-onmicrosoft-com;
h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck;
bh=7s7JBJ9nb18ZFf/ogdm1v3Xta/AfP6qNDtvYuWgtVww=;
b=Wh1wgRv82wLiq9A1Ow5eiLln41Vp4wlE9e2seVW2GESZ+yE2Uvnr9deqFusdnolKeGSKs0AV+v0uRkwMQqtA0SIdQZDQ6cwoB/f2U9cncBCSV3g6qtPGPEg9j/uCRcII8/z/WEEWuEXyaHIXVrfgnP3Tau4/Sb1P6329UhXebmc=
Received: from TYAPR01CA0157.jpnprd01.prod.outlook.com (2603:1096:404:7e::25)
by TY0PR02MB6017.apcprd02.prod.outlook.com (2603:1096:400:212::10) with
Microsoft SMTP Server (version=TLS1_2,
cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.6002.25; Fri, 20 Jan
2023 18:02:24 +0000
Received: from TYZAPC01FT018.eop-APC01.prod.protection.outlook.com
(2603:1096:404:7e:cafe::a4) by TYAPR01CA0157.outlook.office365.com
(2603:1096:404:7e::25) with Microsoft SMTP Server (version=TLS1_2,
cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.6002.27 via Frontend
Transport; Fri, 20 Jan 2023 18:02:24 +0000
X-MS-Exchange-Authentication-Results: spf=fail (sender IP is 114.6.82.34)
smtp.mailfrom=mcdgrp.com; dkim=none (message not signed)
header.d=none;dmarc=none action=none header.from=mcdgrp.com;
Received-SPF: Fail (protection.outlook.com: domain of mcdgrp.com does not
designate 114.6.82.34 as permitted sender) receiver=protection.outlook.com;
client-ip=114.6.82.34; helo=toyota.astra.co.id;
Received: from toyota.astra.co.id (114.6.82.34) by
TYZAPC01FT018.mail.protection.outlook.com (10.118.152.93) with Microsoft SMTP
Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384) id
15.20.6023.16 via Frontend Transport; Fri, 20 Jan 2023 18:02:22 +0000
Received: from User (10.85.28.198) by VSV-C002-002006.toyota.astra.co.id
(10.185.48.40) with Microsoft SMTP Server id 15.0.1497.28; Sat, 21 Jan 2023
01:01:52 +0700
Reply-To:
From: Sawda Finance
Subject: 24/7 Financial Emergency Service
Date: Fri, 20 Jan 2023 18:02:12 -0800
MIME-Version: 1.0
Content-Type: text/html; charset="utf-8"
Content-Transfer-Encoding: quoted-printable
X-Priority: 3
X-MSMail-Priority: Normal
X-Mailer: Microsoft Outlook Express 6.00.2600.0000
X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2600.0000
Message-ID:
To: Undisclosed recipients:;
X-EOPAttributedMessage: 0
X-MS-PublicTrafficType: Email
X-MS-TrafficTypeDiagnostic: TYZAPC01FT018:EE_|TY0PR02MB6017:EE_
X-MS-Office365-Filtering-Correlation-Id: a4da172b-f25b-4f8e-e52a-08dafb107b2d
X-MS-Exchange-SenderADCheck: 2
X-MS-Exchange-AntiSpam-Relay: 1
X-Microsoft-Antispam: BCL:0;
X-Microsoft-Antispam-Message-Info:
=?windows-1251?Q?yjPYuChpFgUvcepnqmlmWOb1BeWQpOVmS6GzCEp9LEFb6kkb3eY+G2Gf?=
=?windows-1251?Q?twki59McgG69MaVc+M7l81UDv1Z9Fms1KHdOnuZWBOHifNniBYscqjIX?=
=?windows-1251?Q?ScJK36L6KJe+VGmeDubS6emEQHUvMCwkGaPJJVbiqTMoFzRSdiuHXMqf?=
=?windows-1251?Q?dUVer3S+EKrEWkN3idVy6L8S21tnC25EEYBmvM0PT67voCJoLW1AaCLS?=
=?windows-1251?Q?b/QFaSGVpfudTURYXvcIk5eCbxyCjBkpklWo9xQmZkGNHGbQC5LPTs3X?=
=?windows-1251?Q?Svrk/wsn2b6BneunQsSLW1IjWFIquNC94xklo6caSrwGxit/27VrQVYH?=
=?windows-1251?Q?axO30EX+ikPXYjUpn4wyVwS02nU8fRD2q6qo+acAaEDcvrLzUsL5nTkv?=
=?windows-1251?Q?WpgfprwqiR/e3zurIPRPSUTXW8c4dN86xTTs43pao3ov2761I35m1PJw?=
=?windows-1251?Q?mPh8xt7K75MJtAPAsMrOBY6VwRDeq7LTh0+HGGOGgkFeA8xjjM3rbUVa?=
=?windows-1251?Q?Y0xpZni1CBkCoAHRjlxSnl90TfcD1z245WnGnimkKViZAUOTIUMmtrhn?=
=?windows-1251?Q?GsQkl1a2+lMk2UkLLF5Ttr8fpRy11DIIGws0yXLja43ZVqRa8qd64Qeq?=
=?windows-1251?Q?b0aayyHWXNmU13gYKTo8qoEXWIgEEaavnx0ur3LIjJuWACnNxJfQ+OIq?=
=?windows-1251?Q?d3sAO96ZssSXaBZ0tBKXE6t//zvEKnvOaipkxWeay5o4eL/QHER49RiE?=
=?windows-1251?Q?GP5qwyNDLxlspGpwi0EHH0LUDfQ6wdP8ROBAu/arH0XfJPneiIkYXGa5?=
=?windows-1251?Q?BIwtjKDWjfsq6mILor0QQ82Y6RO7WWbdE4OTbP5Y/nD0B2To+M/z2IJ3?=
=?windows-1251?Q?ZJ8NRb9iUz8NszKX9MwBwYnVGtJ1QJfy64+JPstArmYSL6f5BCFlGnXF?=
=?windows-1251?Q?9xmdGjRrTxojJLbbQkyNWcgSYkYNStWUIElBllz8KAmaCD+LO1SG97Ol?=
=?windows-1251?Q?HOyT5l0bj37gzHTVST0ncn3EAKnPOuPJZREi4SpyyDTTK0+/vgOH9LYh?=
=?windows-1251?Q?kZoVYSLagDogg+9ZKqerA3dY6/tY9C3gxFkUsoTT33FqwnZrepSaOXYV?=
=?windows-1251?Q?YUB3vpq9j+nVQGfNBfVClqIKXsbgTLHnr1CeeJuAHa7NROZVLN6dHOM5?=
=?windows-1251?Q?gLziMnPuGtsvx2SDybgoTaXclPQS/SBYqp5Ti6GEjgVM3ozrhYEcXg?=
=?windows-1251?Q?=3D=3D?=
X-Forefront-Antispam-Report:
CIP:114.6.82.34;CTRY:ID;LANG:en;SCL:5;SRV:;IPV:CAL;SFV:SPM;H:toyota.astra.co.id;PTR:114-6-82-34.resources.indosat.com;CAT:OSPM;SFS:(13230022)(4636009)(39860400002)(396003)(376002)(136003)(346002)(109986013)(451199015)(40470700004)(36906005)(26005)(66899015)(336012)(81166007)(82740400003)(40460700003)(86362001)(498600001)(2860700004)(82310400005)(316002)(40480700001)(9686003)(24736004)(356005)(32650700002)(35950700001)(83380400001)(108616005)(7336002)(2906002)(7416002)(7366002)(7276002)(8676002)(5660300002)(7406005)(70206006)(41300700001)(6666004)(70586007)(8936002)(4001630100005);DIR:OUT;SFP:1023;
X-OriginatorOrg: toyota.astra.co.id
X-MS-Exchange-CrossTenant-OriginalArrivalTime: 20 Jan 2023 18:02:22.9281
(UTC)
X-MS-Exchange-CrossTenant-Network-Message-Id: a4da172b-f25b-4f8e-e52a-08dafb107b2d
X-MS-Exchange-CrossTenant-Id: 52d4e358-2ecb-48e2-bad4-d3c62441ff17
X-MS-Exchange-CrossTenant-OriginalAttributedTenantConnectingIp: TenantId=52d4e358-2ecb-48e2-bad4-d3c62441ff17;Ip=[114.6.82.34];Helo=[toyota.astra.co.id]
X-MS-Exchange-CrossTenant-AuthSource:
TYZAPC01FT018.eop-APC01.prod.protection.outlook.com
X-MS-Exchange-CrossTenant-AuthAs: Anonymous
X-MS-Exchange-CrossTenant-FromEntityHeader: HybridOnPrem
X-MS-Exchange-Transport-CrossTenantHeadersStamped: TY0PR02MB6017
X-Spam_score: 8.2
X-Spam_score_int: 82
X-Spam_bar: ++++++++
X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",
has identified this incoming email as possible spam. The original
message has been attached to this so you can view it or label
similar future email. If you have any questions, see
@@CONTACT_ADDRESS@@ for details.
Content preview: âš [IMPORTANT CAUTION!]: This is e-mail from outside. Please
verify e-mail sender and subject carefully, Do not open unknown links, attachments
or non-related with your business e-mail and report sus [...]
Content analysis details: (8.2 points, 5.0 required)
pts rule name description
---- ---------------------- --------------------------------------------------
0.0 SPF_HELO_FAIL SPF: HELO does not match SPF record (fail)
[SPF failed: Please see http://www.openspf.org/Why?s=helo;id=APC01-TYZ-obe.outbound.protection.outlook.com;ip=40.95.110.185;r=doctor.nl2k.ab.ca]
-0.2 RCVD_IN_MSPIKE_H2 RBL: Average reputation (+2)
[40.95.110.185 listed in wl.mailspike.net]
0.9 SPF_FAIL SPF: sender does not match SPF record (fail)
[SPF failed: Please see http://www.openspf.org/Why?s=mfrom;id=capitap%40mcdgrp.com;ip=40.95.110.185;r=doctor.nl2k.ab.ca]
0.0 NSL_RCVD_FROM_USER Received from User
0.0 AXB_X_FF_SEZ_S Forefront sez this is spam
0.0 DATE_IN_FUTURE_06_12 Date: is 6 to 12 hours after Received: date
1.1 MIME_HTML_ONLY BODY: Message only has text/html MIME parts
0.0 HTML_MESSAGE BODY: HTML included in message
0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid
0.0 FORGED_OUTLOOK_HTML Outlook can't send HTML message only
0.5 PDS_HELO_SPF_FAIL High profile HELO that fails SPF
0.6 FSL_NEW_HELO_USER Spam's using Helo and User
0.0 AXB_XMAILER_MIMEOLE_OL_024C2 Yet another X header trait
2.5 FREEMAIL_FORGED_REPLYTO Freemail in Reply-To, but not From
2.8 FORGED_MUA_OUTLOOK Forged mail pretending to be from MS Outlook
0.0 KHOP_HELO_FCRDNS Relay HELO differs from its IP's reverse DNS
Subject: {SPAM?} 24/7 Financial Emergency Service
" bottommargin=3D"5">
n" style=3D"max-width: 800px; width: 100%; border:#FF0000 1px solid;">
font-size: 14px; font-family: 'Segoe UI', Arial, Helvetica, sans-serif;;pad=
ding:5px;">
=E2=9A=A0
; font-family: 'Segoe UI', Arial, Helvetica, sans-serif;padding:10px;">
[IMPORTANT CAUTION!]: This is e-mail from outside. Please =
verify e-mail sender and subject carefully, Do not open unknown links, atta=
chments or non-related with your business e-mail and report suspicious e-ma=
il to
it.helpdesk@toyota.astra.co.id
Hi there,
We grant loans to individuals and companies. We are i=
nterested in the financing of large volume projects and grant loans worldwi=
de.
nterested in the financing of large volume projects and grant loans worldwi=
de.
The interest rate will be 3% annually. The repayment =
period is 1-25 years.
period is 1-25 years.
We offer:-
*Project finance
*Business loans
*Personal loans
Loan Processing and financing takes about 2 to 3 work=
ing days from the day you submit your loan application. Email us for more i=
nformation via: sawdacapital@gmail.com
ing days from the day you submit your loan application. Email us for more i=
nformation via: sawdacapital@gmail.com
Kind regards,
Sawda Team
------------------------------------------------=
---------------------------------------------------------------------------=
-------------
This e-mail and any attachment may contain confidential or legally privileg=
ed information for use of PT. Toyota-Astra Motor (TAM) only. If you are not=
the intended recipient, you are not authorized to copy or disclose all or =
any part of it without the prior
written consent of the company.
Each e-mail that is sent to internal or external organizations are logged a=
nd can be used as evidence in case of rule violation.
---------------------------------------------------------------------------=
-------------------------------------------------------------