Loan spam from Outlook

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Fri, 20 Jan 2023 18:25:38 -0700

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.96)

(envelope-from )

id 1pJ226-000CFR-0v

for dave@doctor.nl2k.ab.ca;

Fri, 20 Jan 2023 17:46:58 -0700

Resent-From: The Doctor

Resent-Date: Fri, 20 Jan 2023 17:46:58 -0700

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from mail-tyzapc01rlhn2185.outbound.protection.outlook.com ([40.95.110.185]:43024 helo=APC01-TYZ-obe.outbound.protection.outlook.com)

by doctor.nl2k.ab.ca with esmtps (TLS1.2) tls TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384

(Exim 4.96)

(envelope-from )

id 1pIvl8-000Lt9-1v

for doctor@netknow.ca;

Fri, 20 Jan 2023 11:05:06 -0700

ARC-Seal: i=1; a=rsa-sha256; s=arcselector9901; d=microsoft.com; cv=none;

b=LXkqLPvZj9tuMvMJ2nhV9v4CD7s0yH4i9zcn5KsZS+CkD8UQYeKVhesRJcrHxyKKpHgjlnk2rqAntY6zU++Wc2QPASQiFXu4v9Wnq9gyzUQ3gj1hCYDZuDXMi7rmb51fnNB5q40oFn3qc5v3weNu44Gw/8+URShvfEXEQubH5TFXiGFtwDFb+V53/a5mIzvaawRijufO7Go1KvwcaNThjC8+zzn5Ltc7Z7LaXOjpBRpQHw/2q9GCqw5xo0Ksbz+kFc9hOu2kvB1OD+dk7p+I0vPtlsCg2FCFgIMuESd7oedUCVCldpTk1af74k9hxfqT1XvJuO8BO2SOOdYCx7rDTg==

ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com;

s=arcselector9901;

h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1;

bh=7s7JBJ9nb18ZFf/ogdm1v3Xta/AfP6qNDtvYuWgtVww=;

b=BBVSPw4qLnjHquYmNT/Tzgwy4Q/nytYrHeYECY9Xe3RFSqIx8+5K7inRiMc/xQjpwOTdoxFYc72ed6G6dz3SGPs7rqI41HD/MkHP64/CMMgeO/pXyGhFGLXG0LUdtuztbhfzrTtukA7kIlKWUAE2tiJlMlzpHIlw+1D6/NIpxfydnh0C0WbVwI8ioIlXgBdEc+dh8HzfAsscTRtADgf0PJxipxbyuvhw1UVJyYDWw1D4WT0gs7nIBnf+5/LfkB3bfZommELJRpF7WWIAgwmdggry9i5u574keIRU6CEVphmQdMlMUktf7P4ZNlIwjDpi5YT23tp1rjsj91A/XqBvUg==

ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=fail (sender ip is

114.6.82.34) smtp.rcpttodomain=fundacioncarolina.org.co

smtp.mailfrom=mcdgrp.com; dmarc=none action=none header.from=mcdgrp.com;

dkim=none (message not signed); arc=none

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=toyotaastra.onmicrosoft.com; s=selector2-toyotaastra-onmicrosoft-com;

h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck;

bh=7s7JBJ9nb18ZFf/ogdm1v3Xta/AfP6qNDtvYuWgtVww=;

b=Wh1wgRv82wLiq9A1Ow5eiLln41Vp4wlE9e2seVW2GESZ+yE2Uvnr9deqFusdnolKeGSKs0AV+v0uRkwMQqtA0SIdQZDQ6cwoB/f2U9cncBCSV3g6qtPGPEg9j/uCRcII8/z/WEEWuEXyaHIXVrfgnP3Tau4/Sb1P6329UhXebmc=

Received: from TYAPR01CA0157.jpnprd01.prod.outlook.com (2603:1096:404:7e::25)

by TY0PR02MB6017.apcprd02.prod.outlook.com (2603:1096:400:212::10) with

Microsoft SMTP Server (version=TLS1_2,

cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.6002.25; Fri, 20 Jan

2023 18:02:24 +0000

Received: from TYZAPC01FT018.eop-APC01.prod.protection.outlook.com

(2603:1096:404:7e:cafe::a4) by TYAPR01CA0157.outlook.office365.com

(2603:1096:404:7e::25) with Microsoft SMTP Server (version=TLS1_2,

cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.6002.27 via Frontend

Transport; Fri, 20 Jan 2023 18:02:24 +0000

X-MS-Exchange-Authentication-Results: spf=fail (sender IP is 114.6.82.34)

smtp.mailfrom=mcdgrp.com; dkim=none (message not signed)

header.d=none;dmarc=none action=none header.from=mcdgrp.com;

Received-SPF: Fail (protection.outlook.com: domain of mcdgrp.com does not

designate 114.6.82.34 as permitted sender) receiver=protection.outlook.com;

client-ip=114.6.82.34; helo=toyota.astra.co.id;

Received: from toyota.astra.co.id (114.6.82.34) by

TYZAPC01FT018.mail.protection.outlook.com (10.118.152.93) with Microsoft SMTP

Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384) id

15.20.6023.16 via Frontend Transport; Fri, 20 Jan 2023 18:02:22 +0000

Received: from User (10.85.28.198) by VSV-C002-002006.toyota.astra.co.id

(10.185.48.40) with Microsoft SMTP Server id 15.0.1497.28; Sat, 21 Jan 2023

01:01:52 +0700

Reply-To:

From: Sawda Finance

Subject: 24/7 Financial Emergency Service

Date: Fri, 20 Jan 2023 18:02:12 -0800

MIME-Version: 1.0

Content-Type: text/html; charset="utf-8"

Content-Transfer-Encoding: quoted-printable

X-Priority: 3

X-MSMail-Priority: Normal

X-Mailer: Microsoft Outlook Express 6.00.2600.0000

X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2600.0000

Message-ID:



To: Undisclosed recipients:;

X-EOPAttributedMessage: 0

X-MS-PublicTrafficType: Email

X-MS-TrafficTypeDiagnostic: TYZAPC01FT018:EE_|TY0PR02MB6017:EE_

X-MS-Office365-Filtering-Correlation-Id: a4da172b-f25b-4f8e-e52a-08dafb107b2d

X-MS-Exchange-SenderADCheck: 2

X-MS-Exchange-AntiSpam-Relay: 1

X-Microsoft-Antispam: BCL:0;

X-Microsoft-Antispam-Message-Info:

=?windows-1251?Q?yjPYuChpFgUvcepnqmlmWOb1BeWQpOVmS6GzCEp9LEFb6kkb3eY+G2Gf?=

=?windows-1251?Q?twki59McgG69MaVc+M7l81UDv1Z9Fms1KHdOnuZWBOHifNniBYscqjIX?=

=?windows-1251?Q?ScJK36L6KJe+VGmeDubS6emEQHUvMCwkGaPJJVbiqTMoFzRSdiuHXMqf?=

=?windows-1251?Q?dUVer3S+EKrEWkN3idVy6L8S21tnC25EEYBmvM0PT67voCJoLW1AaCLS?=

=?windows-1251?Q?b/QFaSGVpfudTURYXvcIk5eCbxyCjBkpklWo9xQmZkGNHGbQC5LPTs3X?=

=?windows-1251?Q?Svrk/wsn2b6BneunQsSLW1IjWFIquNC94xklo6caSrwGxit/27VrQVYH?=

=?windows-1251?Q?axO30EX+ikPXYjUpn4wyVwS02nU8fRD2q6qo+acAaEDcvrLzUsL5nTkv?=

=?windows-1251?Q?WpgfprwqiR/e3zurIPRPSUTXW8c4dN86xTTs43pao3ov2761I35m1PJw?=

=?windows-1251?Q?mPh8xt7K75MJtAPAsMrOBY6VwRDeq7LTh0+HGGOGgkFeA8xjjM3rbUVa?=

=?windows-1251?Q?Y0xpZni1CBkCoAHRjlxSnl90TfcD1z245WnGnimkKViZAUOTIUMmtrhn?=

=?windows-1251?Q?GsQkl1a2+lMk2UkLLF5Ttr8fpRy11DIIGws0yXLja43ZVqRa8qd64Qeq?=

=?windows-1251?Q?b0aayyHWXNmU13gYKTo8qoEXWIgEEaavnx0ur3LIjJuWACnNxJfQ+OIq?=

=?windows-1251?Q?d3sAO96ZssSXaBZ0tBKXE6t//zvEKnvOaipkxWeay5o4eL/QHER49RiE?=

=?windows-1251?Q?GP5qwyNDLxlspGpwi0EHH0LUDfQ6wdP8ROBAu/arH0XfJPneiIkYXGa5?=

=?windows-1251?Q?BIwtjKDWjfsq6mILor0QQ82Y6RO7WWbdE4OTbP5Y/nD0B2To+M/z2IJ3?=

=?windows-1251?Q?ZJ8NRb9iUz8NszKX9MwBwYnVGtJ1QJfy64+JPstArmYSL6f5BCFlGnXF?=

=?windows-1251?Q?9xmdGjRrTxojJLbbQkyNWcgSYkYNStWUIElBllz8KAmaCD+LO1SG97Ol?=

=?windows-1251?Q?HOyT5l0bj37gzHTVST0ncn3EAKnPOuPJZREi4SpyyDTTK0+/vgOH9LYh?=

=?windows-1251?Q?kZoVYSLagDogg+9ZKqerA3dY6/tY9C3gxFkUsoTT33FqwnZrepSaOXYV?=

=?windows-1251?Q?YUB3vpq9j+nVQGfNBfVClqIKXsbgTLHnr1CeeJuAHa7NROZVLN6dHOM5?=

=?windows-1251?Q?gLziMnPuGtsvx2SDybgoTaXclPQS/SBYqp5Ti6GEjgVM3ozrhYEcXg?=

=?windows-1251?Q?=3D=3D?=

X-Forefront-Antispam-Report:

CIP:114.6.82.34;CTRY:ID;LANG:en;SCL:5;SRV:;IPV:CAL;SFV:SPM;H:toyota.astra.co.id;PTR:114-6-82-34.resources.indosat.com;CAT:OSPM;SFS:(13230022)(4636009)(39860400002)(396003)(376002)(136003)(346002)(109986013)(451199015)(40470700004)(36906005)(26005)(66899015)(336012)(81166007)(82740400003)(40460700003)(86362001)(498600001)(2860700004)(82310400005)(316002)(40480700001)(9686003)(24736004)(356005)(32650700002)(35950700001)(83380400001)(108616005)(7336002)(2906002)(7416002)(7366002)(7276002)(8676002)(5660300002)(7406005)(70206006)(41300700001)(6666004)(70586007)(8936002)(4001630100005);DIR:OUT;SFP:1023;

X-OriginatorOrg: toyota.astra.co.id

X-MS-Exchange-CrossTenant-OriginalArrivalTime: 20 Jan 2023 18:02:22.9281

(UTC)

X-MS-Exchange-CrossTenant-Network-Message-Id: a4da172b-f25b-4f8e-e52a-08dafb107b2d

X-MS-Exchange-CrossTenant-Id: 52d4e358-2ecb-48e2-bad4-d3c62441ff17

X-MS-Exchange-CrossTenant-OriginalAttributedTenantConnectingIp: TenantId=52d4e358-2ecb-48e2-bad4-d3c62441ff17;Ip=[114.6.82.34];Helo=[toyota.astra.co.id]

X-MS-Exchange-CrossTenant-AuthSource:

TYZAPC01FT018.eop-APC01.prod.protection.outlook.com

X-MS-Exchange-CrossTenant-AuthAs: Anonymous

X-MS-Exchange-CrossTenant-FromEntityHeader: HybridOnPrem

X-MS-Exchange-Transport-CrossTenantHeadersStamped: TY0PR02MB6017

X-Spam_score: 8.2

X-Spam_score_int: 82

X-Spam_bar: ++++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview: âš [IMPORTANT CAUTION!]: This is e-mail from outside. Please

verify e-mail sender and subject carefully, Do not open unknown links, attachments

or non-related with your business e-mail and report sus [...]



Content analysis details: (8.2 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

0.0 SPF_HELO_FAIL SPF: HELO does not match SPF record (fail)

[SPF failed: Please see http://www.openspf.org/Why?s=helo;id=APC01-TYZ-obe.outbound.protection.outlook.com;ip=40.95.110.185;r=doctor.nl2k.ab.ca]

-0.2 RCVD_IN_MSPIKE_H2 RBL: Average reputation (+2)

[40.95.110.185 listed in wl.mailspike.net]

0.9 SPF_FAIL SPF: sender does not match SPF record (fail)

[SPF failed: Please see http://www.openspf.org/Why?s=mfrom;id=capitap%40mcdgrp.com;ip=40.95.110.185;r=doctor.nl2k.ab.ca]

0.0 NSL_RCVD_FROM_USER Received from User

0.0 AXB_X_FF_SEZ_S Forefront sez this is spam

0.0 DATE_IN_FUTURE_06_12 Date: is 6 to 12 hours after Received: date

1.1 MIME_HTML_ONLY BODY: Message only has text/html MIME parts

0.0 HTML_MESSAGE BODY: HTML included in message

0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid

0.0 FORGED_OUTLOOK_HTML Outlook can't send HTML message only

0.5 PDS_HELO_SPF_FAIL High profile HELO that fails SPF

0.6 FSL_NEW_HELO_USER Spam's using Helo and User

0.0 AXB_XMAILER_MIMEOLE_OL_024C2 Yet another X header trait

2.5 FREEMAIL_FORGED_REPLYTO Freemail in Reply-To, but not From

2.8 FORGED_MUA_OUTLOOK Forged mail pretending to be from MS Outlook

0.0 KHOP_HELO_FCRDNS Relay HELO differs from its IP's reverse DNS

Subject: {SPAM?} 24/7 Financial Emergency Service














" bottommargin=3D"5">


n" style=3D"max-width: 800px; width: 100%; border:#FF0000 1px solid;">














font-size: 14px; font-family: 'Segoe UI', Arial, Helvetica, sans-serif;;pad=

ding:5px;">

=E2=9A=A0



; font-family: 'Segoe UI', Arial, Helvetica, sans-serif;padding:10px;">

[IMPORTANT CAUTION!]: This is e-mail from outside. Please =

verify e-mail sender and subject carefully, Do not open unknown links, atta=

chments or non-related with your business e-mail and report suspicious e-ma=

il to

it.helpdesk@toyota.astra.co.id




Hi there,


We grant loans to individuals and companies. We are i=

nterested in the financing of large volume projects and grant loans worldwi=

de.


 


The interest rate will be 3% annually. The repayment =

period is 1-25 years.


 


We offer:-


*Project finance


*Business loans


*Personal loans


 


Loan Processing and financing takes about 2 to 3 work=

ing days from the day you submit your loan application. Email us for more i=

nformation via: sawdacapital@gmail.com


 


Kind regards,


Sawda Team




------------------------------------------------=

---------------------------------------------------------------------------=

-------------




This e-mail and any attachment may contain confidential or legally privileg=

ed information for use of PT. Toyota-Astra Motor (TAM) only. If you are not=

the intended recipient, you are not authorized to copy or disclose all or =

any part of it without the prior

written consent of the company.





Each e-mail that is sent to internal or external organizations are logged a=

nd can be used as evidence in case of rule violation.


---------------------------------------------------------------------------=

-------------------------------------------------------------









Trackbacks

Trackback specific URI for this entry

This link is not meant to be clicked. It contains the trackback URI for this entry. You can use this URI to send ping- & trackbacks from your own blog to this entry. To copy the link, right click and select "Copy Shortcut" in Internet Explorer or "Copy Link Location" in Mozilla.

No Trackbacks

Comments

Display comments as Linear | Threaded

No comments

Add Comment

Enclosing asterisks marks text as bold (*word*), underscore are made via _word_.
Standard emoticons like :-) and ;-) are converted to images.

To prevent automated Bots from commentspamming, please enter the string you see in the image below in the appropriate input box. Your comment will only be submitted if the strings match. Please ensure that your browser supports and accepts cookies, or your comment cannot be verified correctly.
CAPTCHA

Enclosing asterisks marks text as bold (*word*), underscore are made via _word_.
Standard emoticons like :-) and ;-) are converted to images.

To prevent automated Bots from commentspamming, please enter the string you see in the image below in the appropriate input box. Your comment will only be submitted if the strings match. Please ensure that your browser supports and accepts cookies, or your comment cannot be verified correctly.
CAPTCHA