Nigerian spam from Microsoft Outlook servers
Posted by Dave Yadallee on
Return-path:
Envelope-to: dave@doctor.nl2k.ab.ca
Delivery-date: Fri, 27 Jan 2023 14:11:23 -0700
Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.96)
(envelope-from)
id 1pLW08-000JTV-2l
for dave@doctor.nl2k.ab.ca;
Fri, 27 Jan 2023 14:11:12 -0700
Resent-From: The Doctor
Resent-Date: Fri, 27 Jan 2023 14:11:12 -0700
Resent-Message-ID:
Resent-To: Dave Yadallee
Received: from mail-psaapc01rlhn2154.outbound.protection.outlook.com ([40.95.53.154]:6283 helo=APC01-PSA-obe.outbound.protection.outlook.com)
by doctor.nl2k.ab.ca with esmtps (TLS1.2) tls TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384
(Exim 4.96)
(envelope-from)
id 1pLSsd-0007dW-2s
for root@nk.ca;
Fri, 27 Jan 2023 10:51:20 -0700
ARC-Seal: i=1; a=rsa-sha256; s=arcselector9901; d=microsoft.com; cv=none;
b=ZsKg6fedF8d0KWbSnJNWdHxw4MsHOyOObynWgr3cyeySO5R//VJqOK4AfEoaJ8OsBBg6noBe262K5zxd6yvZD9uexeVm6JI+yA0jDRNS9qyI1J6q/Tjif+ptaVJoCfL7p7duulaojPYR09+szUQ3OsoxL5a987PxLq/eO+8gVWDtrLZ7iBpDGZ2hpGVd38SgAgKxZNZ0PVh8pSWsP4LEL89cttQoftttIvI9xLOmejVcLaeonJbDwatAe7cpsLCW0gYcSNtiIHg/9DZp7tJkUVq64WOCZWqqoIYSBhrWn54kb2A6FdI4Z4riFA5ZKA1l1TiONtTxbvcP9YIF7cQbVQ==
ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com;
s=arcselector9901;
h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1;
bh=wMqN4IgIVB5cA9bM1tfm59ZDPh4sDdbzgvC95pr0WVA=;
b=gV9OXb+pI2Nyw/Eaz7MAadu6F11SVxYcR1X5GX1RUcx2gJlcLEHexV4bmEuNrcZNWv+ZSOsWR0gKvoBPoQPD7sXty3/z7BW8FMP2mJ4yvLbwfbZpYLSAKWjRm8hVlvM+QkLy9ILSMvm4ZPy7taD5rRmkDZ/czCCTemdo2JvyMNin20D2tlAfUH5ra321nuXSf+5n/+Jk/mnzmgHX/Yi668lwsS8SNiUOA9uY1beiVUas8tSH1NKoS+9v9lqY+ZLLjUhYbEQNtmHkAeTgFnzaI+CibUxUksJQKZGA8Xoc1ULj8/h3y304JluOgUMWAdS0RSK6yMo3MCSE6BEQSVByHw==
ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=fail (sender ip is
114.6.82.34) smtp.rcpttodomain=hotmail.com smtp.mailfrom=godaddy.com;
dmarc=fail (p=reject sp=reject pct=100) action=oreject
header.from=godaddy.com; dkim=none (message not signed); arc=none
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
d=toyotaastra.onmicrosoft.com; s=selector2-toyotaastra-onmicrosoft-com;
h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck;
bh=wMqN4IgIVB5cA9bM1tfm59ZDPh4sDdbzgvC95pr0WVA=;
b=VpQA6HPwlxISEhXwPAZkRHbLhvOmx0mM9N7yBpaoY4qYjOVBf4Wbt1zZNmSbpL/zHytevFK79p2oFMKrHqU2u79pGXE0NzrXDqjxA9K/rJaAVMeExiqNEekJK8MiQLfw7IoY5o7dHDpDwNeTdCuDJBY8tgHEL4CIWPlop2e0WJ0=
Received: from PS2PR01CA0001.apcprd01.prod.exchangelabs.com
(2603:1096:300:2d::13) by TY2PR02MB4304.apcprd02.prod.outlook.com
(2603:1096:404:800d::15) with Microsoft SMTP Server (version=TLS1_2,
cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.6043.25; Fri, 27 Jan
2023 17:49:08 +0000
Received: from PSAAPC01FT008.eop-APC01.prod.protection.outlook.com
(2603:1096:300:2d:cafe::6c) by PS2PR01CA0001.outlook.office365.com
(2603:1096:300:2d::13) with Microsoft SMTP Server (version=TLS1_2,
cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.6043.25 via Frontend
Transport; Fri, 27 Jan 2023 17:49:07 +0000
X-MS-Exchange-Authentication-Results: spf=fail (sender IP is 114.6.82.34)
smtp.mailfrom=godaddy.com; dkim=none (message not signed)
header.d=none;dmarc=fail action=oreject header.from=godaddy.com;
Received-SPF: Fail (protection.outlook.com: domain of godaddy.com does not
designate 114.6.82.34 as permitted sender) receiver=protection.outlook.com;
client-ip=114.6.82.34; helo=toyota.astra.co.id;
Received: from toyota.astra.co.id (114.6.82.34) by
PSAAPC01FT008.mail.protection.outlook.com (10.13.38.114) with Microsoft SMTP
Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384) id
15.20.6043.22 via Frontend Transport; Fri, 27 Jan 2023 17:49:07 +0000
Received: from User (10.85.28.198) by VSV-C002-002006.toyota.astra.co.id
(10.185.48.40) with Microsoft SMTP Server id 15.0.1497.28; Sat, 28 Jan 2023
00:48:57 +0700
Reply-To:
From: Pah Sami
Subject: 27/1/2023
Date: Fri, 27 Jan 2023 09:49:02 -0800
MIME-Version: 1.0
Content-Type: text/html; charset="utf-8"
Content-Transfer-Encoding: quoted-printable
X-Priority: 3
X-MSMail-Priority: Normal
X-Mailer: Microsoft Outlook Express 6.00.2600.0000
X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2600.0000
Message-ID: <5baaab7e98404f0f81946a315bda2057@VSV-C002-002006.toyota.astra.co.id>
To: Undisclosed recipients:;
X-EOPAttributedMessage: 0
X-MS-PublicTrafficType: Email
X-MS-TrafficTypeDiagnostic: PSAAPC01FT008:EE_|TY2PR02MB4304:EE_
X-MS-Office365-Filtering-Correlation-Id: 00c5bf71-c563-4a94-3efd-08db008ec9d5
X-MS-Exchange-SenderADCheck: 2
X-MS-Exchange-AntiSpam-Relay: 1
X-Microsoft-Antispam: BCL:0;
X-Microsoft-Antispam-Message-Info:
=?windows-1251?Q?n23qtW0OEGM05awh/n1oC6nO6mAEjChnya5NMOZfGU88wa9babYtr6qn?=
=?windows-1251?Q?596/Mx/KbWxqdhyPnl+AXPMNcN15SUiyqdsYQZpAV0m2qgiqfrbDp0es?=
=?windows-1251?Q?Pdg/9kQxJk1CArnRb/+lc40yVn4RV/t9WknEIGohpkJhLv57t0d/TwOt?=
=?windows-1251?Q?eoinI2UDzGmR4BuLKV4Cm1c0pW+h4yvAnWC9XGV76v75vuQvEbqdWoKf?=
=?windows-1251?Q?GGQnWKiw6icoMS/dlGFCVx/2LWVv1E8UwQgO96mEJEe4OJpq/lYAGi1E?=
=?windows-1251?Q?Oe8+g3Hhy9JDvOeYWawsEfkij7IWcAd51fUn5zOve5a+Aq+PTO6nOH1h?=
=?windows-1251?Q?YPEYps+pZGk43s3uGUWtwYZVb8tI7agc7XdBr8YguiHNNtCeN0EbjZpE?=
=?windows-1251?Q?EI70ZX8xvpV2hiBa/02jeqAtzn6D89yvts6Q2KkqgZlyU2XQO/F3u0zd?=
=?windows-1251?Q?LbHR4HL9EagrLsjTuX7CXmgktK1mYtOMpn/A2qlWNb/bZ0Yck1fNLLS2?=
=?windows-1251?Q?0mw1qdJngYX3HCxh7bASnKfiYtfCnbKzdBPbyCGGC05qGQDW8fFVV5gY?=
=?windows-1251?Q?BBTyjRdPrsQFMb4ym0EoShToREDL0V+4mFrMq6IqpAXSOi8AcL4S3ggO?=
=?windows-1251?Q?Oz5a40XiD10ITQfb8WKnmUGtSRy53c19AnZ4oKyA+iDCRhNIq7u2E0yw?=
=?windows-1251?Q?JjiBcYCzriB6y8bH91gsQUvXRl5vNoo8D7Y7QRc08JmGHGYzMcGSaJC1?=
=?windows-1251?Q?snOWVp+I6dU9WaU8+yyvlcG62c9Qn6v0e0hazCeeaUJeVPaqg/MTrtMj?=
=?windows-1251?Q?BCKJkjUcrrcYm5i6vx0SybD36290wn6PZwU86dg0/7fluAVRaUcUjwRF?=
=?windows-1251?Q?ltGAdfXbgYwRHEz2U9sezZFKIz+OTxk6Q3UHhryp4KtXSHG5C177T1gh?=
=?windows-1251?Q?VWipxKjyNee5MXtEjAnFFZfVJ2KyV0wOXye92PQL5MpHYTePjj4ThfqF?=
=?windows-1251?Q?WrDoXzG80m1TEblfi7zSRmeBYRIYmWig9QOHhGWirz/CqF3ZYBImnKkw?=
=?windows-1251?Q?s2kQUnMm2gZUWzFmzqy3AolqA4sdZj74OyOySwHXPPcEALbBLcNTxZzo?=
=?windows-1251?Q?ZyFakw9ei87B9m+36trYrNhZ2w9qVaIpd0BMx1OVlgmKh2k2Pd2ajtsB?=
=?windows-1251?Q?5VP+OK9uH6Oj0IqcEEtUtAHcVDiaXTq5LiPMdyaPYsz9ofhQrerjGsF1?=
=?windows-1251?Q?3DDRRHO8cPH2FzASlsI=3D?=
X-Forefront-Antispam-Report:
CIP:114.6.82.34;CTRY:ID;LANG:en;SCL:5;SRV:;IPV:CAL;SFV:SPM;H:toyota.astra.co.id;PTR:114-6-82-34.resources.indosat.com;CAT:OSPM;SFS:(13230025)(4636009)(396003)(136003)(346002)(39860400002)(376002)(451199018)(109986016)(40470700004)(81166007)(24736004)(108616005)(2906002)(82740400003)(26005)(3480700007)(82310400005)(356005)(9686003)(498600001)(8936002)(41300700001)(70586007)(41110700001)(70206006)(2860700004)(336012)(32650700002)(316002)(8676002)(86362001)(40460700003)(83380400001)(6666004)(35950700001)(5660300002)(7406005)(40480700001)(7416002)(7366002)(4001630100005);DIR:OUT;SFP:1023;
X-OriginatorOrg: toyota.astra.co.id
X-MS-Exchange-CrossTenant-OriginalArrivalTime: 27 Jan 2023 17:49:07.3046
(UTC)
X-MS-Exchange-CrossTenant-Network-Message-Id: 00c5bf71-c563-4a94-3efd-08db008ec9d5
X-MS-Exchange-CrossTenant-Id: 52d4e358-2ecb-48e2-bad4-d3c62441ff17
X-MS-Exchange-CrossTenant-OriginalAttributedTenantConnectingIp: TenantId=52d4e358-2ecb-48e2-bad4-d3c62441ff17;Ip=[114.6.82.34];Helo=[toyota.astra.co.id]
X-MS-Exchange-CrossTenant-AuthSource:
PSAAPC01FT008.eop-APC01.prod.protection.outlook.com
X-MS-Exchange-CrossTenant-AuthAs: Anonymous
X-MS-Exchange-CrossTenant-FromEntityHeader: HybridOnPrem
X-MS-Exchange-Transport-CrossTenantHeadersStamped: TY2PR02MB4304
X-Spam_score: 14.9
X-Spam_score_int: 149
X-Spam_bar: ++++++++++++++
X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",
has identified this incoming email as possible spam. The original
message has been attached to this so you can view it or label
similar future email. If you have any questions, see
@@CONTACT_ADDRESS@@ for details.
Content preview: âš [IMPORTANT CAUTION!]: This is e-mail from outside. Please
verify e-mail sender and subject carefully, Do not open unknown links, attachments
or non-related with your business e-mail and report sus [...]
Content analysis details: (14.9 points, 5.0 required)
pts rule name description
---- ---------------------- --------------------------------------------------
0.9 SPF_FAIL SPF: sender does not match SPF record (fail)
[SPF failed: Please see http://www.openspf.org/Why?s=mfrom;id=pahsamil5969%40godaddy.com;ip=40.95.53.154;r=doctor.nl2k.ab.ca]
0.0 SPF_HELO_FAIL SPF: HELO does not match SPF record (fail)
[SPF failed: Please see http://www.openspf.org/Why?s=helo;id=APC01-PSA-obe.outbound.protection.outlook.com;ip=40.95.53.154;r=doctor.nl2k.ab.ca]
0.0 NSL_RCVD_FROM_USER Received from User
0.0 AXB_X_FF_SEZ_S Forefront sez this is spam
0.2 FREEMAIL_REPLYTO_END_DIGIT Reply-To freemail username ends in digit
[pahsami140(at)gmail.com]
1.5 NIX_SPAM RBL: Listed in NIX_SPAM DNSBL (thanks to heise.de)
[40.95.53.154 listed in ix.dnsbl.manitu.net]
1.1 MIME_HTML_ONLY BODY: Message only has text/html MIME parts
0.0 HTML_MESSAGE BODY: HTML included in message
2.0 PDS_HELO_SPF_FAIL High profile HELO that fails SPF
2.5 FREEMAIL_FORGED_REPLYTO Freemail in Reply-To, but not From
0.0 AXB_XMAILER_MIMEOLE_OL_024C2 Yet another X header trait
0.6 FSL_NEW_HELO_USER Spam's using Helo and User
0.0 FORGED_OUTLOOK_HTML Outlook can't send HTML message only
0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid
2.8 FORGED_MUA_OUTLOOK Forged mail pretending to be from MS Outlook
0.0 KHOP_HELO_FCRDNS Relay HELO differs from its IP's reverse DNS
3.2 UNDISC_MONEY Undisclosed recipients + money/fraud signs
Subject: {SPAM?} 27/1/2023
" bottommargin=3D"5">
n" style=3D"max-width: 800px; width: 100%; border:#FF0000 1px solid;">
font-size: 14px; font-family: 'Segoe UI', Arial, Helvetica, sans-serif;;pad=
ding:5px;">
; font-family: 'Segoe UI', Arial, Helvetica, sans-serif;padding:10px;">
[IMPORTANT CAUTION!]: This is e-mail from outside. Please =
verify e-mail sender and subject carefully, Do not open unknown links, atta=
chments or non-related with your business e-mail and report suspicious e-ma=
il to
it.helpdesk@toyota.astra.co.id
Envelope-to: dave@doctor.nl2k.ab.ca
Delivery-date: Fri, 27 Jan 2023 14:11:23 -0700
Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.96)
(envelope-from
id 1pLW08-000JTV-2l
for dave@doctor.nl2k.ab.ca;
Fri, 27 Jan 2023 14:11:12 -0700
Resent-From: The Doctor
Resent-Date: Fri, 27 Jan 2023 14:11:12 -0700
Resent-Message-ID:
Resent-To: Dave Yadallee
Received: from mail-psaapc01rlhn2154.outbound.protection.outlook.com ([40.95.53.154]:6283 helo=APC01-PSA-obe.outbound.protection.outlook.com)
by doctor.nl2k.ab.ca with esmtps (TLS1.2) tls TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384
(Exim 4.96)
(envelope-from
id 1pLSsd-0007dW-2s
for root@nk.ca;
Fri, 27 Jan 2023 10:51:20 -0700
ARC-Seal: i=1; a=rsa-sha256; s=arcselector9901; d=microsoft.com; cv=none;
b=ZsKg6fedF8d0KWbSnJNWdHxw4MsHOyOObynWgr3cyeySO5R//VJqOK4AfEoaJ8OsBBg6noBe262K5zxd6yvZD9uexeVm6JI+yA0jDRNS9qyI1J6q/Tjif+ptaVJoCfL7p7duulaojPYR09+szUQ3OsoxL5a987PxLq/eO+8gVWDtrLZ7iBpDGZ2hpGVd38SgAgKxZNZ0PVh8pSWsP4LEL89cttQoftttIvI9xLOmejVcLaeonJbDwatAe7cpsLCW0gYcSNtiIHg/9DZp7tJkUVq64WOCZWqqoIYSBhrWn54kb2A6FdI4Z4riFA5ZKA1l1TiONtTxbvcP9YIF7cQbVQ==
ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com;
s=arcselector9901;
h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1;
bh=wMqN4IgIVB5cA9bM1tfm59ZDPh4sDdbzgvC95pr0WVA=;
b=gV9OXb+pI2Nyw/Eaz7MAadu6F11SVxYcR1X5GX1RUcx2gJlcLEHexV4bmEuNrcZNWv+ZSOsWR0gKvoBPoQPD7sXty3/z7BW8FMP2mJ4yvLbwfbZpYLSAKWjRm8hVlvM+QkLy9ILSMvm4ZPy7taD5rRmkDZ/czCCTemdo2JvyMNin20D2tlAfUH5ra321nuXSf+5n/+Jk/mnzmgHX/Yi668lwsS8SNiUOA9uY1beiVUas8tSH1NKoS+9v9lqY+ZLLjUhYbEQNtmHkAeTgFnzaI+CibUxUksJQKZGA8Xoc1ULj8/h3y304JluOgUMWAdS0RSK6yMo3MCSE6BEQSVByHw==
ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=fail (sender ip is
114.6.82.34) smtp.rcpttodomain=hotmail.com smtp.mailfrom=godaddy.com;
dmarc=fail (p=reject sp=reject pct=100) action=oreject
header.from=godaddy.com; dkim=none (message not signed); arc=none
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
d=toyotaastra.onmicrosoft.com; s=selector2-toyotaastra-onmicrosoft-com;
h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck;
bh=wMqN4IgIVB5cA9bM1tfm59ZDPh4sDdbzgvC95pr0WVA=;
b=VpQA6HPwlxISEhXwPAZkRHbLhvOmx0mM9N7yBpaoY4qYjOVBf4Wbt1zZNmSbpL/zHytevFK79p2oFMKrHqU2u79pGXE0NzrXDqjxA9K/rJaAVMeExiqNEekJK8MiQLfw7IoY5o7dHDpDwNeTdCuDJBY8tgHEL4CIWPlop2e0WJ0=
Received: from PS2PR01CA0001.apcprd01.prod.exchangelabs.com
(2603:1096:300:2d::13) by TY2PR02MB4304.apcprd02.prod.outlook.com
(2603:1096:404:800d::15) with Microsoft SMTP Server (version=TLS1_2,
cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.6043.25; Fri, 27 Jan
2023 17:49:08 +0000
Received: from PSAAPC01FT008.eop-APC01.prod.protection.outlook.com
(2603:1096:300:2d:cafe::6c) by PS2PR01CA0001.outlook.office365.com
(2603:1096:300:2d::13) with Microsoft SMTP Server (version=TLS1_2,
cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.6043.25 via Frontend
Transport; Fri, 27 Jan 2023 17:49:07 +0000
X-MS-Exchange-Authentication-Results: spf=fail (sender IP is 114.6.82.34)
smtp.mailfrom=godaddy.com; dkim=none (message not signed)
header.d=none;dmarc=fail action=oreject header.from=godaddy.com;
Received-SPF: Fail (protection.outlook.com: domain of godaddy.com does not
designate 114.6.82.34 as permitted sender) receiver=protection.outlook.com;
client-ip=114.6.82.34; helo=toyota.astra.co.id;
Received: from toyota.astra.co.id (114.6.82.34) by
PSAAPC01FT008.mail.protection.outlook.com (10.13.38.114) with Microsoft SMTP
Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384) id
15.20.6043.22 via Frontend Transport; Fri, 27 Jan 2023 17:49:07 +0000
Received: from User (10.85.28.198) by VSV-C002-002006.toyota.astra.co.id
(10.185.48.40) with Microsoft SMTP Server id 15.0.1497.28; Sat, 28 Jan 2023
00:48:57 +0700
Reply-To:
From: Pah Sami
Subject: 27/1/2023
Date: Fri, 27 Jan 2023 09:49:02 -0800
MIME-Version: 1.0
Content-Type: text/html; charset="utf-8"
Content-Transfer-Encoding: quoted-printable
X-Priority: 3
X-MSMail-Priority: Normal
X-Mailer: Microsoft Outlook Express 6.00.2600.0000
X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2600.0000
Message-ID: <5baaab7e98404f0f81946a315bda2057@VSV-C002-002006.toyota.astra.co.id>
To: Undisclosed recipients:;
X-EOPAttributedMessage: 0
X-MS-PublicTrafficType: Email
X-MS-TrafficTypeDiagnostic: PSAAPC01FT008:EE_|TY2PR02MB4304:EE_
X-MS-Office365-Filtering-Correlation-Id: 00c5bf71-c563-4a94-3efd-08db008ec9d5
X-MS-Exchange-SenderADCheck: 2
X-MS-Exchange-AntiSpam-Relay: 1
X-Microsoft-Antispam: BCL:0;
X-Microsoft-Antispam-Message-Info:
=?windows-1251?Q?n23qtW0OEGM05awh/n1oC6nO6mAEjChnya5NMOZfGU88wa9babYtr6qn?=
=?windows-1251?Q?596/Mx/KbWxqdhyPnl+AXPMNcN15SUiyqdsYQZpAV0m2qgiqfrbDp0es?=
=?windows-1251?Q?Pdg/9kQxJk1CArnRb/+lc40yVn4RV/t9WknEIGohpkJhLv57t0d/TwOt?=
=?windows-1251?Q?eoinI2UDzGmR4BuLKV4Cm1c0pW+h4yvAnWC9XGV76v75vuQvEbqdWoKf?=
=?windows-1251?Q?GGQnWKiw6icoMS/dlGFCVx/2LWVv1E8UwQgO96mEJEe4OJpq/lYAGi1E?=
=?windows-1251?Q?Oe8+g3Hhy9JDvOeYWawsEfkij7IWcAd51fUn5zOve5a+Aq+PTO6nOH1h?=
=?windows-1251?Q?YPEYps+pZGk43s3uGUWtwYZVb8tI7agc7XdBr8YguiHNNtCeN0EbjZpE?=
=?windows-1251?Q?EI70ZX8xvpV2hiBa/02jeqAtzn6D89yvts6Q2KkqgZlyU2XQO/F3u0zd?=
=?windows-1251?Q?LbHR4HL9EagrLsjTuX7CXmgktK1mYtOMpn/A2qlWNb/bZ0Yck1fNLLS2?=
=?windows-1251?Q?0mw1qdJngYX3HCxh7bASnKfiYtfCnbKzdBPbyCGGC05qGQDW8fFVV5gY?=
=?windows-1251?Q?BBTyjRdPrsQFMb4ym0EoShToREDL0V+4mFrMq6IqpAXSOi8AcL4S3ggO?=
=?windows-1251?Q?Oz5a40XiD10ITQfb8WKnmUGtSRy53c19AnZ4oKyA+iDCRhNIq7u2E0yw?=
=?windows-1251?Q?JjiBcYCzriB6y8bH91gsQUvXRl5vNoo8D7Y7QRc08JmGHGYzMcGSaJC1?=
=?windows-1251?Q?snOWVp+I6dU9WaU8+yyvlcG62c9Qn6v0e0hazCeeaUJeVPaqg/MTrtMj?=
=?windows-1251?Q?BCKJkjUcrrcYm5i6vx0SybD36290wn6PZwU86dg0/7fluAVRaUcUjwRF?=
=?windows-1251?Q?ltGAdfXbgYwRHEz2U9sezZFKIz+OTxk6Q3UHhryp4KtXSHG5C177T1gh?=
=?windows-1251?Q?VWipxKjyNee5MXtEjAnFFZfVJ2KyV0wOXye92PQL5MpHYTePjj4ThfqF?=
=?windows-1251?Q?WrDoXzG80m1TEblfi7zSRmeBYRIYmWig9QOHhGWirz/CqF3ZYBImnKkw?=
=?windows-1251?Q?s2kQUnMm2gZUWzFmzqy3AolqA4sdZj74OyOySwHXPPcEALbBLcNTxZzo?=
=?windows-1251?Q?ZyFakw9ei87B9m+36trYrNhZ2w9qVaIpd0BMx1OVlgmKh2k2Pd2ajtsB?=
=?windows-1251?Q?5VP+OK9uH6Oj0IqcEEtUtAHcVDiaXTq5LiPMdyaPYsz9ofhQrerjGsF1?=
=?windows-1251?Q?3DDRRHO8cPH2FzASlsI=3D?=
X-Forefront-Antispam-Report:
CIP:114.6.82.34;CTRY:ID;LANG:en;SCL:5;SRV:;IPV:CAL;SFV:SPM;H:toyota.astra.co.id;PTR:114-6-82-34.resources.indosat.com;CAT:OSPM;SFS:(13230025)(4636009)(396003)(136003)(346002)(39860400002)(376002)(451199018)(109986016)(40470700004)(81166007)(24736004)(108616005)(2906002)(82740400003)(26005)(3480700007)(82310400005)(356005)(9686003)(498600001)(8936002)(41300700001)(70586007)(41110700001)(70206006)(2860700004)(336012)(32650700002)(316002)(8676002)(86362001)(40460700003)(83380400001)(6666004)(35950700001)(5660300002)(7406005)(40480700001)(7416002)(7366002)(4001630100005);DIR:OUT;SFP:1023;
X-OriginatorOrg: toyota.astra.co.id
X-MS-Exchange-CrossTenant-OriginalArrivalTime: 27 Jan 2023 17:49:07.3046
(UTC)
X-MS-Exchange-CrossTenant-Network-Message-Id: 00c5bf71-c563-4a94-3efd-08db008ec9d5
X-MS-Exchange-CrossTenant-Id: 52d4e358-2ecb-48e2-bad4-d3c62441ff17
X-MS-Exchange-CrossTenant-OriginalAttributedTenantConnectingIp: TenantId=52d4e358-2ecb-48e2-bad4-d3c62441ff17;Ip=[114.6.82.34];Helo=[toyota.astra.co.id]
X-MS-Exchange-CrossTenant-AuthSource:
PSAAPC01FT008.eop-APC01.prod.protection.outlook.com
X-MS-Exchange-CrossTenant-AuthAs: Anonymous
X-MS-Exchange-CrossTenant-FromEntityHeader: HybridOnPrem
X-MS-Exchange-Transport-CrossTenantHeadersStamped: TY2PR02MB4304
X-Spam_score: 14.9
X-Spam_score_int: 149
X-Spam_bar: ++++++++++++++
X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",
has identified this incoming email as possible spam. The original
message has been attached to this so you can view it or label
similar future email. If you have any questions, see
@@CONTACT_ADDRESS@@ for details.
Content preview: âš [IMPORTANT CAUTION!]: This is e-mail from outside. Please
verify e-mail sender and subject carefully, Do not open unknown links, attachments
or non-related with your business e-mail and report sus [...]
Content analysis details: (14.9 points, 5.0 required)
pts rule name description
---- ---------------------- --------------------------------------------------
0.9 SPF_FAIL SPF: sender does not match SPF record (fail)
[SPF failed: Please see http://www.openspf.org/Why?s=mfrom;id=pahsamil5969%40godaddy.com;ip=40.95.53.154;r=doctor.nl2k.ab.ca]
0.0 SPF_HELO_FAIL SPF: HELO does not match SPF record (fail)
[SPF failed: Please see http://www.openspf.org/Why?s=helo;id=APC01-PSA-obe.outbound.protection.outlook.com;ip=40.95.53.154;r=doctor.nl2k.ab.ca]
0.0 NSL_RCVD_FROM_USER Received from User
0.0 AXB_X_FF_SEZ_S Forefront sez this is spam
0.2 FREEMAIL_REPLYTO_END_DIGIT Reply-To freemail username ends in digit
[pahsami140(at)gmail.com]
1.5 NIX_SPAM RBL: Listed in NIX_SPAM DNSBL (thanks to heise.de)
[40.95.53.154 listed in ix.dnsbl.manitu.net]
1.1 MIME_HTML_ONLY BODY: Message only has text/html MIME parts
0.0 HTML_MESSAGE BODY: HTML included in message
2.0 PDS_HELO_SPF_FAIL High profile HELO that fails SPF
2.5 FREEMAIL_FORGED_REPLYTO Freemail in Reply-To, but not From
0.0 AXB_XMAILER_MIMEOLE_OL_024C2 Yet another X header trait
0.6 FSL_NEW_HELO_USER Spam's using Helo and User
0.0 FORGED_OUTLOOK_HTML Outlook can't send HTML message only
0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid
2.8 FORGED_MUA_OUTLOOK Forged mail pretending to be from MS Outlook
0.0 KHOP_HELO_FCRDNS Relay HELO differs from its IP's reverse DNS
3.2 UNDISC_MONEY Undisclosed recipients + money/fraud signs
Subject: {SPAM?} 27/1/2023
" bottommargin=3D"5">
n" style=3D"max-width: 800px; width: 100%; border:#FF0000 1px solid;">
font-size: 14px; font-family: 'Segoe UI', Arial, Helvetica, sans-serif;;pad=
ding:5px;">
=E2=9A=A0
; font-family: 'Segoe UI', Arial, Helvetica, sans-serif;padding:10px;">
[IMPORTANT CAUTION!]: This is e-mail from outside. Please =
verify e-mail sender and subject carefully, Do not open unknown links, atta=
chments or non-related with your business e-mail and report suspicious e-ma=
il to
it.helpdesk@toyota.astra.co.id
Good Katrina Lucas,
I am Pah Sami. I work with a financial company here in the United King=
dom. I have high-value clients looking to invest in your country. The areas=
to be considered for the venture are as follows: Real estate, oil and gas,=
agriculture, health, aviation,
tourism, retail, construction, IT & communications, technology, educat=
ion, energy, engineering, utilities, telecommunications, mining, maritime, =
sustainable energy, and a host of other profitable ventures. I asked you if=
you were willing to partner with the
investor. The investor is also given loans with low-interest rates to comp=
anies or individuals who need loans for the business. Contact me if you fit=
into any of these profiles so we can talk more.
dom. I have high-value clients looking to invest in your country. The areas=
to be considered for the venture are as follows: Real estate, oil and gas,=
agriculture, health, aviation,
tourism, retail, construction, IT & communications, technology, educat=
ion, energy, engineering, utilities, telecommunications, mining, maritime, =
sustainable energy, and a host of other profitable ventures. I asked you if=
you were willing to partner with the
investor. The investor is also given loans with low-interest rates to comp=
anies or individuals who need loans for the business. Contact me if you fit=
into any of these profiles so we can talk more.
Thank you,
Pah Sami
------------------------------------------------=
---------------------------------------------------------------------------=
-------------
This e-mail and any attachment may contain confidential or legally privileg=
ed information for use of PT. Toyota-Astra Motor (TAM) only. If you are not=
the intended recipient, you are not authorized to copy or disclose all or =
any part of it without the prior
written consent of the company.
Each e-mail that is sent to internal or external organizations are logged a=
nd can be used as evidence in case of rule violation.
---------------------------------------------------------------------------=
-------------------------------------------------------------
![](3D"https://lh4.googleusercontent.com/43g3pbP2m3icF46NlHE1iU9=<br)
![](3D"https://lh4.googleusercontent.com/UvcLTn0BmgNp49rW7pIhtr4C=<br)
