Pharmaceuticals spam from outlook servers
Posted by Dave Yadallee on
Return-path:
Envelope-to: dave@doctor.nl2k.ab.ca
Delivery-date: Sun, 29 Jan 2023 15:04:04 -0700
Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.96)
(envelope-from)
id 1pMFmE-000KPc-03
for dave@doctor.nl2k.ab.ca;
Sun, 29 Jan 2023 15:03:54 -0700
Resent-From: The Doctor
Resent-Date: Sun, 29 Jan 2023 15:03:54 -0700
Resent-Message-ID:
Resent-To: Dave Yadallee
Received: from mail-tyzapc01rlhn2188.outbound.protection.outlook.com ([40.95.110.188]:26275 helo=APC01-TYZ-obe.outbound.protection.outlook.com)
by doctor.nl2k.ab.ca with esmtps (TLS1.2) tls TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384
(Exim 4.96)
(envelope-from)
id 1pMDyR-000GCL-0i
for root@nk.ca;
Sun, 29 Jan 2023 13:08:27 -0700
ARC-Seal: i=1; a=rsa-sha256; s=arcselector9901; d=microsoft.com; cv=none;
b=Fp2vSQP3h+HcUr9qeOu2n3cF5D/vQ1CdtYuFd9I3M2jITSW16d84H1GTeCD29xfwIzb0Bg+fCPTgaYacw61k+wTHXvQq0D0yP09yXNBXN+6JDfoOXrVoZGEvWvoz7dp5pk7/7JJMKHfKozM2yilHV9i4BXwMOTe0UwBX38oLiDwtJZ0n0/+/l/1XBtSZzgGOQyv51Z88TiqEly9EHz4/lumhB/Z8hw2M1nLK4NkwjoL9xxA09wisML8NcR4+mvL8Nv84l2FZDj1SzVo8zvmdrtONQJHfmORg2U+Pq7BYNUcmWTtGC6d8LTxzd3UNisZ9tWx6UxchPmziaQX7CXusFw==
ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com;
s=arcselector9901;
h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1;
bh=UaKCopdyfT0nR1VdkyL87b3VrA03SC0TyBPyP792ipk=;
b=TkFxjAYabv34i4BhR4JtYsDAeGKjp1Qtzj4/aA9o0VxCt+sOOLHVNV89A+x1AFA4uPJp18M9cDvaCk+KWitJsF/w371RYuHsw81qAbTNRxoF8HTT368eUQJJXHGum3rlj6hV3kSC0ilDW+ekKMEruUjjJ/757HgEnO1ghBOeB+LTS4PTG3xgORbNSHUiHtVzFTlsKc0DIzJalTHFVj76GEPy4SNQUBI1bQWtlx+z3ayq0PVDo+s9kaa79g9cfwrQCWIr1PkCU2VpEwvKFsFqjRgSgmXO5qVeI4MXEbG3d0iENWLAiQa7GQmQAo6W3sKcV89lMWhOmllUs6JHOhgoHg==
ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=none (sender ip is
114.6.82.34) smtp.rcpttodomain=comcast.net
smtp.mailfrom=healthcarehharmaceuticals.com; dmarc=none action=none
header.from=healthcarehharmaceuticals.com; dkim=none (message not signed);
arc=none
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
d=toyotaastra.onmicrosoft.com; s=selector2-toyotaastra-onmicrosoft-com;
h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck;
bh=UaKCopdyfT0nR1VdkyL87b3VrA03SC0TyBPyP792ipk=;
b=a2ewn7eu4J76kkJwzFfLvz0f8fWGJHnrEu27Rc9GD4OpZ6nNB4tu5KZsaHpqfoFV6aljM065yVASsIFRzWL75zQb8QMu90l2tBrHcBeg16r4/xSyvp97dxOYVv4V9e7CdTEXpz6JE2RzLPwuXkrJuthXjKkgWY/k6xAwQ4IMmeU=
Received: from SG2PR06CA0233.apcprd06.prod.outlook.com (2603:1096:4:ac::17) by
SI2PR02MB4716.apcprd02.prod.outlook.com (2603:1096:4:12d::8) with Microsoft
SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id
15.20.6043.36; Sun, 29 Jan 2023 20:06:06 +0000
Received: from SG2APC01FT0031.eop-APC01.prod.protection.outlook.com
(2603:1096:4:ac:cafe::96) by SG2PR06CA0233.outlook.office365.com
(2603:1096:4:ac::17) with Microsoft SMTP Server (version=TLS1_2,
cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.6043.36 via Frontend
Transport; Sun, 29 Jan 2023 20:06:06 +0000
X-MS-Exchange-Authentication-Results: spf=none (sender IP is 114.6.82.34)
smtp.mailfrom=healthcarehharmaceuticals.com; dkim=none (message not signed)
header.d=none;dmarc=none action=none
header.from=healthcarehharmaceuticals.com;
Received-SPF: None (protection.outlook.com: healthcarehharmaceuticals.com does
not designate permitted sender hosts)
Received: from toyota.astra.co.id (114.6.82.34) by
SG2APC01FT0031.mail.protection.outlook.com (10.13.36.89) with Microsoft SMTP
Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384) id
15.20.6043.21 via Frontend Transport; Sun, 29 Jan 2023 20:06:06 +0000
Received: from User (10.85.28.198) by VSV-C002-002006.toyota.astra.co.id
(10.185.48.40) with Microsoft SMTP Server id 15.0.1497.28; Mon, 30 Jan 2023
03:05:57 +0700
Reply-To:
From: Kim Tan
Subject: HealthCare Pharmaceuticals
Date: Sun, 29 Jan 2023 12:06:03 -0800
MIME-Version: 1.0
Content-Type: text/html; charset="utf-8"
Content-Transfer-Encoding: quoted-printable
X-Priority: 3
X-MSMail-Priority: Normal
X-Mailer: Microsoft Outlook Express 6.00.2600.0000
X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2600.0000
Message-ID: <3dc2ecea86a34a008eaae3393d1e2c1c@VSV-C002-002006.toyota.astra.co.id>
To: Undisclosed recipients:;
X-EOPAttributedMessage: 0
X-MS-PublicTrafficType: Email
X-MS-TrafficTypeDiagnostic: SG2APC01FT0031:EE_|SI2PR02MB4716:EE_
X-MS-Office365-Filtering-Correlation-Id: efb9b320-619a-4b4e-d1e1-08db0234418a
X-MS-Exchange-SenderADCheck: 2
X-MS-Exchange-AntiSpam-Relay: 1
X-Microsoft-Antispam: BCL:0;
X-Microsoft-Antispam-Message-Info:
=?windows-1251?Q?rx+4CHUdU8LAWYzrxerYJ8MpsR9nQgYpFRoCE6YYZ2THf43LfC+0jf0P?=
=?windows-1251?Q?asuhZ8xRYYQdQEBOsQPLkJXjEEXKFmhfA6se7jCvJ2sUbrvN8eG8u7xF?=
=?windows-1251?Q?ZbCiRT5RBLeTGAtt+nxzi1NFIGZxc8g3puAY67ulSn3k7NAPpkiBt/ML?=
=?windows-1251?Q?4Wp5t5K3sSKn2es8njiTXwUV9OA3Orkjqe2/j4C9ohcDEanpb1oBO5iU?=
=?windows-1251?Q?sdLbPJDH9CFOO1zLMRnSFurYpzbyt2EwVsGzVlClOrYGhqTAttuW5M/U?=
=?windows-1251?Q?lUFAp6fWLV8sArc9JG+7G6WIrsipQ0HJDDL4yTUBji1qcplXCyXsC33O?=
=?windows-1251?Q?8XigrgcLQTkx4+VSk87KKa2tbYfZEtz+za9DAvsTl9fBzCcTjcsLTXi4?=
=?windows-1251?Q?Oj4tMTaK2nxGX4GYRY2MP7b5O3hrhxkoG6hRGPrbc+hhAx+nuGhzW2+t?=
=?windows-1251?Q?mftPN8aQXor93XQ1kfQjilrwjL/AST8eNy6pCelczn3b469h64XLcmF0?=
=?windows-1251?Q?KZg3mmP32oFkx12+UDLkogYPNsWChq35iyyAeWcZmyU+XCyrYV65g3Gj?=
=?windows-1251?Q?j9sOJOF3YGO5qXkhZmk51Uus1dHUbZG6162FXJ1t5aOuuaS5gI9YCerY?=
=?windows-1251?Q?GI2ukXa52gM3dDFyIGPsCtmOsthr+y4n3Wcy5KRnyvxuJmSFQOFuyctJ?=
=?windows-1251?Q?Wt/KiCc1b7NRhjwF/jtqoAqJWLcQffJbyQbITKpS0uc676mMOoPLOQ2C?=
=?windows-1251?Q?mggvyG61Ht31B4068Wit4iQyp94qp6hABWp2ud741qTzlhEfZjDWzFRD?=
=?windows-1251?Q?duT/XBbCdS4v/U3RuXo7RqrosYNZyCJMtFqQrP12CYTdeDVBSkyEDqLU?=
=?windows-1251?Q?elVj3ZCEzKLbkIsT6cHf18MPWZLl9vgxT+ShpmC9ShS89y3eWobas1Ey?=
=?windows-1251?Q?mvanucCdiCYQ/TnXa2cIYIgOG0L2hVyzwgTnEnxAdcGhNAXS6BYfXgQ4?=
=?windows-1251?Q?kjbbR2m8Q7RLdN2K1On/BzXy9OWvoqwZcTsCNGz35H9urH7xBRxkzAN1?=
=?windows-1251?Q?K5vwWsHZOtoqhB7cSAMd1GecelALpAgAQQUVZED7eWYC8xp4HAVHmnHi?=
=?windows-1251?Q?IGXa/bgXlQab80pHI/i0RnbSfSyKC9MGVEu0GE5cAj5/qZY/wX+pUp+3?=
=?windows-1251?Q?npp+aI6FEHU1WGZA1+ofVIv+IqHFW9feeLQlVYC+9cLU30umFZDNxcyt?=
=?windows-1251?Q?YH79wZXZhSMYGyDL9Yw=3D?=
X-Forefront-Antispam-Report:
CIP:114.6.82.34;CTRY:ID;LANG:en;SCL:5;SRV:;IPV:CAL;SFV:SPM;H:toyota.astra.co.id;PTR:114-6-82-34.resources.indosat.com;CAT:OSPM;SFS:(13230025)(4636009)(39860400002)(346002)(396003)(136003)(376002)(451199018)(109986016)(40470700004)(41300700001)(336012)(41110700001)(81166007)(82310400005)(40460700003)(82740400003)(86362001)(8936002)(7116003)(2860700004)(7366002)(7406005)(7416002)(316002)(5660300002)(356005)(40480700001)(3480700007)(32650700002)(2906002)(35950700001)(83380400001)(24736004)(108616005)(9686003)(498600001)(26005)(6666004)(70586007)(70206006)(8676002)(23876008);DIR:OUT;SFP:1023;
X-OriginatorOrg: toyota.astra.co.id
X-MS-Exchange-CrossTenant-OriginalArrivalTime: 29 Jan 2023 20:06:06.3447
(UTC)
X-MS-Exchange-CrossTenant-Network-Message-Id: efb9b320-619a-4b4e-d1e1-08db0234418a
X-MS-Exchange-CrossTenant-Id: 52d4e358-2ecb-48e2-bad4-d3c62441ff17
X-MS-Exchange-CrossTenant-OriginalAttributedTenantConnectingIp: TenantId=52d4e358-2ecb-48e2-bad4-d3c62441ff17;Ip=[114.6.82.34];Helo=[toyota.astra.co.id]
X-MS-Exchange-CrossTenant-AuthSource:
SG2APC01FT0031.eop-APC01.prod.protection.outlook.com
X-MS-Exchange-CrossTenant-AuthAs: Anonymous
X-MS-Exchange-CrossTenant-FromEntityHeader: HybridOnPrem
X-MS-Exchange-Transport-CrossTenantHeadersStamped: SI2PR02MB4716
X-Spam_score: 13.6
X-Spam_score_int: 136
X-Spam_bar: +++++++++++++
X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",
has identified this incoming email as possible spam. The original
message has been attached to this so you can view it or label
similar future email. If you have any questions, see
@@CONTACT_ADDRESS@@ for details.
Content preview: âš [IMPORTANT CAUTION!]: This is e-mail from outside. Please
verify e-mail sender and subject carefully, Do not open unknown links, attachments
or non-related with your business e-mail and report sus [...]
Content analysis details: (13.6 points, 5.0 required)
pts rule name description
---- ---------------------- --------------------------------------------------
1.3 RCVD_IN_RP_RNBL RBL: Relay in RNBL,
https://senderscore.org/blacklistlookup/
[40.95.110.188 listed in bl.score.senderscore.com]
1.3 RCVD_IN_VALIDITY_RPBL RBL: Relay in Validity RPBL,
https://senderscore.org/blocklistlookup/
[40.95.110.188 listed in bl.score.senderscore.com]
0.0 SPF_HELO_FAIL SPF: HELO does not match SPF record (fail)
[SPF failed: Please see http://www.openspf.org/Why?s=helo;id=APC01-TYZ-obe.outbound.protection.outlook.com;ip=40.95.110.188;r=doctor.nl2k.ab.ca]
0.0 NSL_RCVD_FROM_USER Received from User
0.0 AXB_X_FF_SEZ_S Forefront sez this is spam
0.2 FREEMAIL_REPLYTO_END_DIGIT Reply-To freemail username ends in digit
[ktan93138(at)gmail.com]
1.7 DEAR_SOMETHING BODY: Contains 'Dear (something)'
1.1 MIME_HTML_ONLY BODY: Message only has text/html MIME parts
0.0 HTML_MESSAGE BODY: HTML included in message
2.0 PDS_HELO_SPF_FAIL High profile HELO that fails SPF
0.0 FORGED_OUTLOOK_HTML Outlook can't send HTML message only
0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid
0.0 AXB_XMAILER_MIMEOLE_OL_024C2 Yet another X header trait
0.6 FSL_NEW_HELO_USER Spam's using Helo and User
2.5 FREEMAIL_FORGED_REPLYTO Freemail in Reply-To, but not From
0.0 KHOP_HELO_FCRDNS Relay HELO differs from its IP's reverse DNS
2.8 FORGED_MUA_OUTLOOK Forged mail pretending to be from MS Outlook
Subject: {SPAM?} HealthCare Pharmaceuticals
" bottommargin=3D"5">
n" style=3D"max-width: 800px; width: 100%; border:#FF0000 1px solid;">
font-size: 14px; font-family: 'Segoe UI', Arial, Helvetica, sans-serif;;pad=
ding:5px;">
; font-family: 'Segoe UI', Arial, Helvetica, sans-serif;padding:10px;">
[IMPORTANT CAUTION!]: This is e-mail from outside. Please =
verify e-mail sender and subject carefully, Do not open unknown links, atta=
chments or non-related with your business e-mail and report suspicious e-ma=
il to
it.helpdesk@toyota.astra.co.id
Envelope-to: dave@doctor.nl2k.ab.ca
Delivery-date: Sun, 29 Jan 2023 15:04:04 -0700
Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.96)
(envelope-from
id 1pMFmE-000KPc-03
for dave@doctor.nl2k.ab.ca;
Sun, 29 Jan 2023 15:03:54 -0700
Resent-From: The Doctor
Resent-Date: Sun, 29 Jan 2023 15:03:54 -0700
Resent-Message-ID:
Resent-To: Dave Yadallee
Received: from mail-tyzapc01rlhn2188.outbound.protection.outlook.com ([40.95.110.188]:26275 helo=APC01-TYZ-obe.outbound.protection.outlook.com)
by doctor.nl2k.ab.ca with esmtps (TLS1.2) tls TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384
(Exim 4.96)
(envelope-from
id 1pMDyR-000GCL-0i
for root@nk.ca;
Sun, 29 Jan 2023 13:08:27 -0700
ARC-Seal: i=1; a=rsa-sha256; s=arcselector9901; d=microsoft.com; cv=none;
b=Fp2vSQP3h+HcUr9qeOu2n3cF5D/vQ1CdtYuFd9I3M2jITSW16d84H1GTeCD29xfwIzb0Bg+fCPTgaYacw61k+wTHXvQq0D0yP09yXNBXN+6JDfoOXrVoZGEvWvoz7dp5pk7/7JJMKHfKozM2yilHV9i4BXwMOTe0UwBX38oLiDwtJZ0n0/+/l/1XBtSZzgGOQyv51Z88TiqEly9EHz4/lumhB/Z8hw2M1nLK4NkwjoL9xxA09wisML8NcR4+mvL8Nv84l2FZDj1SzVo8zvmdrtONQJHfmORg2U+Pq7BYNUcmWTtGC6d8LTxzd3UNisZ9tWx6UxchPmziaQX7CXusFw==
ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com;
s=arcselector9901;
h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1;
bh=UaKCopdyfT0nR1VdkyL87b3VrA03SC0TyBPyP792ipk=;
b=TkFxjAYabv34i4BhR4JtYsDAeGKjp1Qtzj4/aA9o0VxCt+sOOLHVNV89A+x1AFA4uPJp18M9cDvaCk+KWitJsF/w371RYuHsw81qAbTNRxoF8HTT368eUQJJXHGum3rlj6hV3kSC0ilDW+ekKMEruUjjJ/757HgEnO1ghBOeB+LTS4PTG3xgORbNSHUiHtVzFTlsKc0DIzJalTHFVj76GEPy4SNQUBI1bQWtlx+z3ayq0PVDo+s9kaa79g9cfwrQCWIr1PkCU2VpEwvKFsFqjRgSgmXO5qVeI4MXEbG3d0iENWLAiQa7GQmQAo6W3sKcV89lMWhOmllUs6JHOhgoHg==
ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=none (sender ip is
114.6.82.34) smtp.rcpttodomain=comcast.net
smtp.mailfrom=healthcarehharmaceuticals.com; dmarc=none action=none
header.from=healthcarehharmaceuticals.com; dkim=none (message not signed);
arc=none
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
d=toyotaastra.onmicrosoft.com; s=selector2-toyotaastra-onmicrosoft-com;
h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck;
bh=UaKCopdyfT0nR1VdkyL87b3VrA03SC0TyBPyP792ipk=;
b=a2ewn7eu4J76kkJwzFfLvz0f8fWGJHnrEu27Rc9GD4OpZ6nNB4tu5KZsaHpqfoFV6aljM065yVASsIFRzWL75zQb8QMu90l2tBrHcBeg16r4/xSyvp97dxOYVv4V9e7CdTEXpz6JE2RzLPwuXkrJuthXjKkgWY/k6xAwQ4IMmeU=
Received: from SG2PR06CA0233.apcprd06.prod.outlook.com (2603:1096:4:ac::17) by
SI2PR02MB4716.apcprd02.prod.outlook.com (2603:1096:4:12d::8) with Microsoft
SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id
15.20.6043.36; Sun, 29 Jan 2023 20:06:06 +0000
Received: from SG2APC01FT0031.eop-APC01.prod.protection.outlook.com
(2603:1096:4:ac:cafe::96) by SG2PR06CA0233.outlook.office365.com
(2603:1096:4:ac::17) with Microsoft SMTP Server (version=TLS1_2,
cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.6043.36 via Frontend
Transport; Sun, 29 Jan 2023 20:06:06 +0000
X-MS-Exchange-Authentication-Results: spf=none (sender IP is 114.6.82.34)
smtp.mailfrom=healthcarehharmaceuticals.com; dkim=none (message not signed)
header.d=none;dmarc=none action=none
header.from=healthcarehharmaceuticals.com;
Received-SPF: None (protection.outlook.com: healthcarehharmaceuticals.com does
not designate permitted sender hosts)
Received: from toyota.astra.co.id (114.6.82.34) by
SG2APC01FT0031.mail.protection.outlook.com (10.13.36.89) with Microsoft SMTP
Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384) id
15.20.6043.21 via Frontend Transport; Sun, 29 Jan 2023 20:06:06 +0000
Received: from User (10.85.28.198) by VSV-C002-002006.toyota.astra.co.id
(10.185.48.40) with Microsoft SMTP Server id 15.0.1497.28; Mon, 30 Jan 2023
03:05:57 +0700
Reply-To:
From: Kim Tan
Subject: HealthCare Pharmaceuticals
Date: Sun, 29 Jan 2023 12:06:03 -0800
MIME-Version: 1.0
Content-Type: text/html; charset="utf-8"
Content-Transfer-Encoding: quoted-printable
X-Priority: 3
X-MSMail-Priority: Normal
X-Mailer: Microsoft Outlook Express 6.00.2600.0000
X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2600.0000
Message-ID: <3dc2ecea86a34a008eaae3393d1e2c1c@VSV-C002-002006.toyota.astra.co.id>
To: Undisclosed recipients:;
X-EOPAttributedMessage: 0
X-MS-PublicTrafficType: Email
X-MS-TrafficTypeDiagnostic: SG2APC01FT0031:EE_|SI2PR02MB4716:EE_
X-MS-Office365-Filtering-Correlation-Id: efb9b320-619a-4b4e-d1e1-08db0234418a
X-MS-Exchange-SenderADCheck: 2
X-MS-Exchange-AntiSpam-Relay: 1
X-Microsoft-Antispam: BCL:0;
X-Microsoft-Antispam-Message-Info:
=?windows-1251?Q?rx+4CHUdU8LAWYzrxerYJ8MpsR9nQgYpFRoCE6YYZ2THf43LfC+0jf0P?=
=?windows-1251?Q?asuhZ8xRYYQdQEBOsQPLkJXjEEXKFmhfA6se7jCvJ2sUbrvN8eG8u7xF?=
=?windows-1251?Q?ZbCiRT5RBLeTGAtt+nxzi1NFIGZxc8g3puAY67ulSn3k7NAPpkiBt/ML?=
=?windows-1251?Q?4Wp5t5K3sSKn2es8njiTXwUV9OA3Orkjqe2/j4C9ohcDEanpb1oBO5iU?=
=?windows-1251?Q?sdLbPJDH9CFOO1zLMRnSFurYpzbyt2EwVsGzVlClOrYGhqTAttuW5M/U?=
=?windows-1251?Q?lUFAp6fWLV8sArc9JG+7G6WIrsipQ0HJDDL4yTUBji1qcplXCyXsC33O?=
=?windows-1251?Q?8XigrgcLQTkx4+VSk87KKa2tbYfZEtz+za9DAvsTl9fBzCcTjcsLTXi4?=
=?windows-1251?Q?Oj4tMTaK2nxGX4GYRY2MP7b5O3hrhxkoG6hRGPrbc+hhAx+nuGhzW2+t?=
=?windows-1251?Q?mftPN8aQXor93XQ1kfQjilrwjL/AST8eNy6pCelczn3b469h64XLcmF0?=
=?windows-1251?Q?KZg3mmP32oFkx12+UDLkogYPNsWChq35iyyAeWcZmyU+XCyrYV65g3Gj?=
=?windows-1251?Q?j9sOJOF3YGO5qXkhZmk51Uus1dHUbZG6162FXJ1t5aOuuaS5gI9YCerY?=
=?windows-1251?Q?GI2ukXa52gM3dDFyIGPsCtmOsthr+y4n3Wcy5KRnyvxuJmSFQOFuyctJ?=
=?windows-1251?Q?Wt/KiCc1b7NRhjwF/jtqoAqJWLcQffJbyQbITKpS0uc676mMOoPLOQ2C?=
=?windows-1251?Q?mggvyG61Ht31B4068Wit4iQyp94qp6hABWp2ud741qTzlhEfZjDWzFRD?=
=?windows-1251?Q?duT/XBbCdS4v/U3RuXo7RqrosYNZyCJMtFqQrP12CYTdeDVBSkyEDqLU?=
=?windows-1251?Q?elVj3ZCEzKLbkIsT6cHf18MPWZLl9vgxT+ShpmC9ShS89y3eWobas1Ey?=
=?windows-1251?Q?mvanucCdiCYQ/TnXa2cIYIgOG0L2hVyzwgTnEnxAdcGhNAXS6BYfXgQ4?=
=?windows-1251?Q?kjbbR2m8Q7RLdN2K1On/BzXy9OWvoqwZcTsCNGz35H9urH7xBRxkzAN1?=
=?windows-1251?Q?K5vwWsHZOtoqhB7cSAMd1GecelALpAgAQQUVZED7eWYC8xp4HAVHmnHi?=
=?windows-1251?Q?IGXa/bgXlQab80pHI/i0RnbSfSyKC9MGVEu0GE5cAj5/qZY/wX+pUp+3?=
=?windows-1251?Q?npp+aI6FEHU1WGZA1+ofVIv+IqHFW9feeLQlVYC+9cLU30umFZDNxcyt?=
=?windows-1251?Q?YH79wZXZhSMYGyDL9Yw=3D?=
X-Forefront-Antispam-Report:
CIP:114.6.82.34;CTRY:ID;LANG:en;SCL:5;SRV:;IPV:CAL;SFV:SPM;H:toyota.astra.co.id;PTR:114-6-82-34.resources.indosat.com;CAT:OSPM;SFS:(13230025)(4636009)(39860400002)(346002)(396003)(136003)(376002)(451199018)(109986016)(40470700004)(41300700001)(336012)(41110700001)(81166007)(82310400005)(40460700003)(82740400003)(86362001)(8936002)(7116003)(2860700004)(7366002)(7406005)(7416002)(316002)(5660300002)(356005)(40480700001)(3480700007)(32650700002)(2906002)(35950700001)(83380400001)(24736004)(108616005)(9686003)(498600001)(26005)(6666004)(70586007)(70206006)(8676002)(23876008);DIR:OUT;SFP:1023;
X-OriginatorOrg: toyota.astra.co.id
X-MS-Exchange-CrossTenant-OriginalArrivalTime: 29 Jan 2023 20:06:06.3447
(UTC)
X-MS-Exchange-CrossTenant-Network-Message-Id: efb9b320-619a-4b4e-d1e1-08db0234418a
X-MS-Exchange-CrossTenant-Id: 52d4e358-2ecb-48e2-bad4-d3c62441ff17
X-MS-Exchange-CrossTenant-OriginalAttributedTenantConnectingIp: TenantId=52d4e358-2ecb-48e2-bad4-d3c62441ff17;Ip=[114.6.82.34];Helo=[toyota.astra.co.id]
X-MS-Exchange-CrossTenant-AuthSource:
SG2APC01FT0031.eop-APC01.prod.protection.outlook.com
X-MS-Exchange-CrossTenant-AuthAs: Anonymous
X-MS-Exchange-CrossTenant-FromEntityHeader: HybridOnPrem
X-MS-Exchange-Transport-CrossTenantHeadersStamped: SI2PR02MB4716
X-Spam_score: 13.6
X-Spam_score_int: 136
X-Spam_bar: +++++++++++++
X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",
has identified this incoming email as possible spam. The original
message has been attached to this so you can view it or label
similar future email. If you have any questions, see
@@CONTACT_ADDRESS@@ for details.
Content preview: âš [IMPORTANT CAUTION!]: This is e-mail from outside. Please
verify e-mail sender and subject carefully, Do not open unknown links, attachments
or non-related with your business e-mail and report sus [...]
Content analysis details: (13.6 points, 5.0 required)
pts rule name description
---- ---------------------- --------------------------------------------------
1.3 RCVD_IN_RP_RNBL RBL: Relay in RNBL,
https://senderscore.org/blacklistlookup/
[40.95.110.188 listed in bl.score.senderscore.com]
1.3 RCVD_IN_VALIDITY_RPBL RBL: Relay in Validity RPBL,
https://senderscore.org/blocklistlookup/
[40.95.110.188 listed in bl.score.senderscore.com]
0.0 SPF_HELO_FAIL SPF: HELO does not match SPF record (fail)
[SPF failed: Please see http://www.openspf.org/Why?s=helo;id=APC01-TYZ-obe.outbound.protection.outlook.com;ip=40.95.110.188;r=doctor.nl2k.ab.ca]
0.0 NSL_RCVD_FROM_USER Received from User
0.0 AXB_X_FF_SEZ_S Forefront sez this is spam
0.2 FREEMAIL_REPLYTO_END_DIGIT Reply-To freemail username ends in digit
[ktan93138(at)gmail.com]
1.7 DEAR_SOMETHING BODY: Contains 'Dear (something)'
1.1 MIME_HTML_ONLY BODY: Message only has text/html MIME parts
0.0 HTML_MESSAGE BODY: HTML included in message
2.0 PDS_HELO_SPF_FAIL High profile HELO that fails SPF
0.0 FORGED_OUTLOOK_HTML Outlook can't send HTML message only
0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid
0.0 AXB_XMAILER_MIMEOLE_OL_024C2 Yet another X header trait
0.6 FSL_NEW_HELO_USER Spam's using Helo and User
2.5 FREEMAIL_FORGED_REPLYTO Freemail in Reply-To, but not From
0.0 KHOP_HELO_FCRDNS Relay HELO differs from its IP's reverse DNS
2.8 FORGED_MUA_OUTLOOK Forged mail pretending to be from MS Outlook
Subject: {SPAM?} HealthCare Pharmaceuticals
" bottommargin=3D"5">
n" style=3D"max-width: 800px; width: 100%; border:#FF0000 1px solid;">
font-size: 14px; font-family: 'Segoe UI', Arial, Helvetica, sans-serif;;pad=
ding:5px;">
=E2=9A=A0
; font-family: 'Segoe UI', Arial, Helvetica, sans-serif;padding:10px;">
[IMPORTANT CAUTION!]: This is e-mail from outside. Please =
verify e-mail sender and subject carefully, Do not open unknown links, atta=
chments or non-related with your business e-mail and report suspicious e-ma=
il to
it.helpdesk@toyota.astra.co.id
Dear Sir/Ma
A reputable pharmaceutical company is in need of a reliable individual=
or corporate entity in your state to act as their "Liaison" . If=
interested, reply for more information.
or corporate entity in your state to act as their "Liaison" . If=
interested, reply for more information.
Regards,
Kim Tan
Bayer HealthCare Pharmaceuticals Vietnam
------------------------------------------------=
---------------------------------------------------------------------------=
-------------
This e-mail and any attachment may contain confidential or legally privileg=
ed information for use of PT. Toyota-Astra Motor (TAM) only. If you are not=
the intended recipient, you are not authorized to copy or disclose all or =
any part of it without the prior
written consent of the company.
Each e-mail that is sent to internal or external organizations are logged a=
nd can be used as evidence in case of rule violation.
---------------------------------------------------------------------------=
-------------------------------------------------------------
![](3D"https://lh6.googleusercontent.com/EDQImf9_i-MEags71524yLhX=<br)