funds spam from Outlook
Posted by Dave Yadallee on
Return-path:
Envelope-to: dave@doctor.nl2k.ab.ca
Delivery-date: Thu, 26 Jan 2023 21:50:40 -0700
Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.96)
(envelope-from)
id 1pLGh1-000N0S-1l
for dave@doctor.nl2k.ab.ca;
Thu, 26 Jan 2023 21:50:27 -0700
Resent-From: The Doctor
Resent-Date: Thu, 26 Jan 2023 21:50:27 -0700
Resent-Message-ID:
Resent-To: Dave Yadallee
Received: from mail-tyzapc01rlhn2188.outbound.protection.outlook.com ([40.95.110.188]:41537 helo=APC01-TYZ-obe.outbound.protection.outlook.com)
by doctor.nl2k.ab.ca with esmtps (TLS1.2) tls TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384
(Exim 4.96)
(envelope-from)
id 1pLGUq-000Mhj-0g
for doctor@doctor.nl2k.ab.ca;
Thu, 26 Jan 2023 21:37:15 -0700
ARC-Seal: i=1; a=rsa-sha256; s=arcselector9901; d=microsoft.com; cv=none;
b=N8lzrXZ5/1kwoznq7nKsvxAC0rJBJ+gicztgZ+bvMQLLZQtq4ERkDBGNCX8QiFl4oxwoJos7vpNQh1S9sjXcAbYdg6GN36vOTGhep1uh+N0eILA9O2dp0a3BtyKmGU8E0MZspmE8jwvpCMtLDQhLT5DV7qJQrRuZNwpJ0oBfxcpLr9xg2tgEGDMFiEHPYZQbwqIRYo6n2bFMQDy/2o7W9ZkGtKGnvMgs1hn5G0e82Lxom2ypEKnGAEk0BMJBVbiLgFSb9RnxFUxdOnyqkZHLvuRuYEJGlebXG5xsSe3v1PiayfuywJh4Vr7MoAgHqGQ2F62aCul2rlCZow7P56WuTQ==
ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com;
s=arcselector9901;
h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1;
bh=In7TGh4VyXtj9MpkJogzscW5OMwO3WPZa78VABUvg90=;
b=ebfbv2yoLeNAuu1SAuU/Hmy0W5uMBctvijgWL7rdkjS8D4ZaNpj4bci1sh0jehP5YWhoYxnCB5wON7BwoxJ8BiP5zTWr0lwslF8eqhyEG9eOrASqQAmRJ7MHwfMpA6+eE7R7ZE3U9jdIfTQ1o5/L3CUGZiGH/syoBqs8CIOuSqumieKEnLTp7gp7YtHRVb5AFTEK9Y0KqQTYAGTUDv1uBW2XYnQWA7YnzZWLwHCBFdktnvzeIjHaQtku2EgBWo6u5ZmU6ohXvHGHYWrvjPuJi/WZgLD8A514eklvE7+bKcs8u06i6uXeCDdnslagm4C74FzB+QUW3cdjdYaehD2yew==
ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=permerror (sender ip
is 114.6.82.34) smtp.rcpttodomain=adelphia.net smtp.mailfrom=epix.net;
dmarc=none action=none header.from=epix.net; dkim=none (message not signed);
arc=none
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
d=toyotaastra.onmicrosoft.com; s=selector2-toyotaastra-onmicrosoft-com;
h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck;
bh=In7TGh4VyXtj9MpkJogzscW5OMwO3WPZa78VABUvg90=;
b=eU4b4KbYzKTBRBhL59r7Vuh+sNqcshwNYUpjDf6e95ExSiFOXd4R6u6Wcrte7i0LFUne+xQGD+8kUtCcz0hSrevCVa36at4JkYyPGS3WUeMIuey6qsmTWmuo3GrQTfazzfZFahJ9daDx+tRfOLAPra6BuO8OhYFx9aWUWT+qhzc=
Received: from TYCPR01CA0063.jpnprd01.prod.outlook.com (2603:1096:405:2::27)
by SG2PR02MB5796.apcprd02.prod.outlook.com (2603:1096:4:1b7::5) with
Microsoft SMTP Server (version=TLS1_2,
cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.6043.21; Fri, 27 Jan
2023 04:35:03 +0000
Received: from TYZAPC01FT053.eop-APC01.prod.protection.outlook.com
(2603:1096:405:2:cafe::14) by TYCPR01CA0063.outlook.office365.com
(2603:1096:405:2::27) with Microsoft SMTP Server (version=TLS1_2,
cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.6043.23 via Frontend
Transport; Fri, 27 Jan 2023 04:35:02 +0000
X-MS-Exchange-Authentication-Results: spf=permerror (sender IP is 114.6.82.34)
smtp.mailfrom=epix.net; dkim=none (message not signed)
header.d=none;dmarc=none action=none header.from=epix.net;
Received-SPF: PermError (protection.outlook.com: domain of epix.net used an
invalid SPF mechanism)
Received: from toyota.astra.co.id (114.6.82.34) by
TYZAPC01FT053.mail.protection.outlook.com (10.118.152.149) with Microsoft
SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384) id
15.20.6043.21 via Frontend Transport; Fri, 27 Jan 2023 04:35:00 +0000
Received: from User (10.85.28.198) by VSV-C003-002100.toyota.astra.co.id
(10.85.11.214) with Microsoft SMTP Server id 15.0.1497.28; Fri, 27 Jan 2023
11:34:29 +0700
Reply-To:
From: David Eddie Baggett
Subject: You have an outstanding refund:Your Unclaime Funds!!!
Date: Thu, 26 Jan 2023 20:34:52 -0800
MIME-Version: 1.0
Content-Type: text/html; charset="utf-8"
Content-Transfer-Encoding: quoted-printable
X-Priority: 3
X-MSMail-Priority: Normal
X-Mailer: Microsoft Outlook Express 6.00.2600.0000
X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2600.0000
Message-ID: <73031aeca2b644beb8934f72a4353755@VSV-C003-002100.toyota.astra.co.id>
To: Undisclosed recipients:;
X-EOPAttributedMessage: 0
X-MS-PublicTrafficType: Email
X-MS-TrafficTypeDiagnostic: TYZAPC01FT053:EE_|SG2PR02MB5796:EE_
X-MS-Office365-Filtering-Correlation-Id: 464d4f31-47b0-4803-99e8-08db001fda68
X-MS-Exchange-SenderADCheck: 2
X-MS-Exchange-AntiSpam-Relay: 1
X-Microsoft-Antispam: BCL:0;
X-Microsoft-Antispam-Message-Info:
=?windows-1251?Q?9gSBQhC3QenlA+eq3e8ge5wTbsn/XqT7mfz0E8ay+ofBucxzeIH08ZhJ?=
=?windows-1251?Q?6dewRyET3p9MMUjEJs4fQQAWE6y2+5VjZL6zWp84zEFKZ24ouI8m5xPj?=
=?windows-1251?Q?VBmANyryTT9BP18yFjDTHAZgDAY0MiqjcN3yoxymuNRJVz+AFB1y9DhJ?=
=?windows-1251?Q?WZMur5pB8wgYwaH+WT5oJ1+vHf54MhtmE/d/xErR3PU8TZoF6RWrziHE?=
=?windows-1251?Q?0QzQgtLDaonCkTSNa5LYw+6+7h3g99C7sHnRIHXaIyqz/ke3mp3ffPl4?=
=?windows-1251?Q?/BjhQJqx1LE12K8DiJVuAs+iT7Jeat6xkqL52w311Gir9xe0P9Z2J+EC?=
=?windows-1251?Q?umxIeVFzNdOzWE8e/cTzjIm+0BfL+ydPa8wfboxX9gibIlCK46bFBxM0?=
=?windows-1251?Q?pSAF/d2AHnx8T4i9DjFOrwrQzVqr5bmMB3k6wy8PMFotBURyRktIOLgI?=
=?windows-1251?Q?KwspluX0ZUyrY59jw6RCD1GhdbLhM/sGYnLTp3zOp/13DE9FvZ8t+qcz?=
=?windows-1251?Q?lsmnUvOFWb21R1N1ie4/RwDycaKUtXj2sK8jqcSYKkE2nfVJiJTY4LnB?=
=?windows-1251?Q?wJdC24kfrWTSgp+xGpegY7oS0r1lrhD9QtKPQKIn8bhljlZCa9HNiZjS?=
=?windows-1251?Q?R7VgNfF/8aUw0a6pRNM9OBaHGEJ3eLnzFSZIjuwjJYORa44UIzj5Q0Eu?=
=?windows-1251?Q?NQbHCjphAiyAWIuENh7y0NmJxBcsZ7+OkXUdyD9XnHxZWrlNmgfNxdFw?=
=?windows-1251?Q?6uc2yE1KofRIt2AOdq0aH0LKgf/c41aU70lZfD5xp+MZ8FFec9LLrbcC?=
=?windows-1251?Q?hrZi4VCjA57h9PH/ZfsnCrTDm85/Mdetk+/N/Jr4QOKWBg9m1cRtsSNT?=
=?windows-1251?Q?vupX4kjfza3rw32+Zsh0xJ73qAGmD1uToBp+RzigiVFOgxWB6fOsa0vP?=
=?windows-1251?Q?VZnZ06zeDiXvZecPB/JlieTDwHyPsoeakAGwwjB3babeLTDPziJb7HaT?=
=?windows-1251?Q?J/0cLwmeUvW27SNX3aGNF3nxsq2idONAONND8TRRAI3VgT9edfQMQwVF?=
=?windows-1251?Q?xw/0GmmU4HAy70m9X4c0eV7EyUTr6Tc6c5BK9/4GHiAdTzEq7p0BZczF?=
=?windows-1251?Q?H3vfZPgn063kSvNZ97+yAYoja/qQH0KJXvSYUeNLX17pEvfXibU7K+ox?=
=?windows-1251?Q?hg9tRo3oICWV7a/bSomAThUz+tMIEE8j2vKDZTlaUFFq6BEQmqEF1sJI?=
=?windows-1251?Q?+Ei6BEwrKXvkax4j2TQ=3D?=
X-Forefront-Antispam-Report:
CIP:114.6.82.34;CTRY:ID;LANG:en;SCL:5;SRV:;IPV:CAL;SFV:SPM;H:toyota.astra.co.id;PTR:114-6-82-34.resources.indosat.com;CAT:OSPM;SFS:(13230025)(4636009)(39860400002)(396003)(136003)(376002)(346002)(451199018)(109986016)(40470700004)(356005)(32650700002)(26005)(9686003)(6666004)(2860700004)(316002)(40480700001)(86362001)(966005)(83380400001)(35950700001)(82310400005)(8676002)(498600001)(336012)(40460700003)(24736004)(108616005)(70206006)(5660300002)(70586007)(82740400003)(2906002)(8936002)(41300700001)(81166007)(7366002)(7416002)(7406005)(4001630100005);DIR:OUT;SFP:1023;
X-OriginatorOrg: toyota.astra.co.id
X-MS-Exchange-CrossTenant-OriginalArrivalTime: 27 Jan 2023 04:35:00.9613
(UTC)
X-MS-Exchange-CrossTenant-Network-Message-Id: 464d4f31-47b0-4803-99e8-08db001fda68
X-MS-Exchange-CrossTenant-Id: 52d4e358-2ecb-48e2-bad4-d3c62441ff17
X-MS-Exchange-CrossTenant-OriginalAttributedTenantConnectingIp: TenantId=52d4e358-2ecb-48e2-bad4-d3c62441ff17;Ip=[114.6.82.34];Helo=[toyota.astra.co.id]
X-MS-Exchange-CrossTenant-AuthSource:
TYZAPC01FT053.eop-APC01.prod.protection.outlook.com
X-MS-Exchange-CrossTenant-AuthAs: Anonymous
X-MS-Exchange-CrossTenant-FromEntityHeader: HybridOnPrem
X-MS-Exchange-Transport-CrossTenantHeadersStamped: SG2PR02MB5796
X-Spam_score: 19.8
X-Spam_score_int: 198
X-Spam_bar: +++++++++++++++++++
X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",
has identified this incoming email as possible spam. The original
message has been attached to this so you can view it or label
similar future email. If you have any questions, see
@@CONTACT_ADDRESS@@ for details.
Content preview: âš [IMPORTANT CAUTION!]: This is e-mail from outside. Please
verify e-mail sender and subject carefully, Do not open unknown links, attachments
or non-related with your business e-mail and report sus [...]
Content analysis details: (19.8 points, 5.0 required)
pts rule name description
---- ---------------------- --------------------------------------------------
1.3 RCVD_IN_RP_RNBL RBL: Relay in RNBL,
https://senderscore.org/blacklistlookup/
[40.95.110.188 listed in bl.score.senderscore.com]
1.3 RCVD_IN_VALIDITY_RPBL RBL: Relay in Validity RPBL,
https://senderscore.org/blocklistlookup/
[40.95.110.188 listed in bl.score.senderscore.com]
0.0 SPF_HELO_FAIL SPF: HELO does not match SPF record (fail)
[SPF failed: Please see http://www.openspf.org/Why?s=helo;id=APC01-TYZ-obe.outbound.protection.outlook.com;ip=40.95.110.188;r=doctor.nl2k.ab.ca]
0.0 T_SPF_PERMERROR SPF: test of record failed (permerror)
0.0 NSL_RCVD_FROM_USER Received from User
0.0 AXB_X_FF_SEZ_S Forefront sez this is spam
0.0 FREEMAIL_FROM Sender email is commonly abused enduser mail provider
[ldk(at)epix.net]
1.1 MIME_HTML_ONLY BODY: Message only has text/html MIME parts
0.0 HTML_MESSAGE BODY: HTML included in message
1.0 FREEMAIL_REPLYTO Reply-To/From or Reply-To/body contain different
freemails
0.0 AXB_XMAILER_MIMEOLE_OL_024C2 Yet another X header trait
0.6 FSL_NEW_HELO_USER Spam's using Helo and User
0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid
0.0 FORGED_OUTLOOK_HTML Outlook can't send HTML message only
2.0 PDS_HELO_SPF_FAIL High profile HELO that fails SPF
0.0 KHOP_HELO_FCRDNS Relay HELO differs from its IP's reverse DNS
2.8 UNDISC_FREEM Undisclosed recipients + freemail reply-to
2.8 FORGED_MUA_OUTLOOK Forged mail pretending to be from MS Outlook
0.0 SPOOFED_FREEMAIL No description available.
1.0 SPOOFED_FREEM_REPTO Forged freemail sender with freemail reply-to
3.2 UNDISC_MONEY Undisclosed recipients + money/fraud signs
2.7 ADVANCE_FEE_4_NEW Appears to be advance fee fraud (Nigerian 419)
Subject: {SPAM?} You have an outstanding refund:Your Unclaime Funds!!!
" bottommargin=3D"5">
n" style=3D"max-width: 800px; width: 100%; border:#FF0000 1px solid;">
font-size: 14px; font-family: 'Segoe UI', Arial, Helvetica, sans-serif;;pad=
ding:5px;">
; font-family: 'Segoe UI', Arial, Helvetica, sans-serif;padding:10px;">
[IMPORTANT CAUTION!]: This is e-mail from outside. Please =
verify e-mail sender and subject carefully, Do not open unknown links, atta=
chments or non-related with your business e-mail and report suspicious e-ma=
il to
it.helpdesk@toyota.astra.co.id
Envelope-to: dave@doctor.nl2k.ab.ca
Delivery-date: Thu, 26 Jan 2023 21:50:40 -0700
Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.96)
(envelope-from
id 1pLGh1-000N0S-1l
for dave@doctor.nl2k.ab.ca;
Thu, 26 Jan 2023 21:50:27 -0700
Resent-From: The Doctor
Resent-Date: Thu, 26 Jan 2023 21:50:27 -0700
Resent-Message-ID:
Resent-To: Dave Yadallee
Received: from mail-tyzapc01rlhn2188.outbound.protection.outlook.com ([40.95.110.188]:41537 helo=APC01-TYZ-obe.outbound.protection.outlook.com)
by doctor.nl2k.ab.ca with esmtps (TLS1.2) tls TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384
(Exim 4.96)
(envelope-from
id 1pLGUq-000Mhj-0g
for doctor@doctor.nl2k.ab.ca;
Thu, 26 Jan 2023 21:37:15 -0700
ARC-Seal: i=1; a=rsa-sha256; s=arcselector9901; d=microsoft.com; cv=none;
b=N8lzrXZ5/1kwoznq7nKsvxAC0rJBJ+gicztgZ+bvMQLLZQtq4ERkDBGNCX8QiFl4oxwoJos7vpNQh1S9sjXcAbYdg6GN36vOTGhep1uh+N0eILA9O2dp0a3BtyKmGU8E0MZspmE8jwvpCMtLDQhLT5DV7qJQrRuZNwpJ0oBfxcpLr9xg2tgEGDMFiEHPYZQbwqIRYo6n2bFMQDy/2o7W9ZkGtKGnvMgs1hn5G0e82Lxom2ypEKnGAEk0BMJBVbiLgFSb9RnxFUxdOnyqkZHLvuRuYEJGlebXG5xsSe3v1PiayfuywJh4Vr7MoAgHqGQ2F62aCul2rlCZow7P56WuTQ==
ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com;
s=arcselector9901;
h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1;
bh=In7TGh4VyXtj9MpkJogzscW5OMwO3WPZa78VABUvg90=;
b=ebfbv2yoLeNAuu1SAuU/Hmy0W5uMBctvijgWL7rdkjS8D4ZaNpj4bci1sh0jehP5YWhoYxnCB5wON7BwoxJ8BiP5zTWr0lwslF8eqhyEG9eOrASqQAmRJ7MHwfMpA6+eE7R7ZE3U9jdIfTQ1o5/L3CUGZiGH/syoBqs8CIOuSqumieKEnLTp7gp7YtHRVb5AFTEK9Y0KqQTYAGTUDv1uBW2XYnQWA7YnzZWLwHCBFdktnvzeIjHaQtku2EgBWo6u5ZmU6ohXvHGHYWrvjPuJi/WZgLD8A514eklvE7+bKcs8u06i6uXeCDdnslagm4C74FzB+QUW3cdjdYaehD2yew==
ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=permerror (sender ip
is 114.6.82.34) smtp.rcpttodomain=adelphia.net smtp.mailfrom=epix.net;
dmarc=none action=none header.from=epix.net; dkim=none (message not signed);
arc=none
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
d=toyotaastra.onmicrosoft.com; s=selector2-toyotaastra-onmicrosoft-com;
h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck;
bh=In7TGh4VyXtj9MpkJogzscW5OMwO3WPZa78VABUvg90=;
b=eU4b4KbYzKTBRBhL59r7Vuh+sNqcshwNYUpjDf6e95ExSiFOXd4R6u6Wcrte7i0LFUne+xQGD+8kUtCcz0hSrevCVa36at4JkYyPGS3WUeMIuey6qsmTWmuo3GrQTfazzfZFahJ9daDx+tRfOLAPra6BuO8OhYFx9aWUWT+qhzc=
Received: from TYCPR01CA0063.jpnprd01.prod.outlook.com (2603:1096:405:2::27)
by SG2PR02MB5796.apcprd02.prod.outlook.com (2603:1096:4:1b7::5) with
Microsoft SMTP Server (version=TLS1_2,
cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.6043.21; Fri, 27 Jan
2023 04:35:03 +0000
Received: from TYZAPC01FT053.eop-APC01.prod.protection.outlook.com
(2603:1096:405:2:cafe::14) by TYCPR01CA0063.outlook.office365.com
(2603:1096:405:2::27) with Microsoft SMTP Server (version=TLS1_2,
cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.6043.23 via Frontend
Transport; Fri, 27 Jan 2023 04:35:02 +0000
X-MS-Exchange-Authentication-Results: spf=permerror (sender IP is 114.6.82.34)
smtp.mailfrom=epix.net; dkim=none (message not signed)
header.d=none;dmarc=none action=none header.from=epix.net;
Received-SPF: PermError (protection.outlook.com: domain of epix.net used an
invalid SPF mechanism)
Received: from toyota.astra.co.id (114.6.82.34) by
TYZAPC01FT053.mail.protection.outlook.com (10.118.152.149) with Microsoft
SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384) id
15.20.6043.21 via Frontend Transport; Fri, 27 Jan 2023 04:35:00 +0000
Received: from User (10.85.28.198) by VSV-C003-002100.toyota.astra.co.id
(10.85.11.214) with Microsoft SMTP Server id 15.0.1497.28; Fri, 27 Jan 2023
11:34:29 +0700
Reply-To:
From: David Eddie Baggett
Subject: You have an outstanding refund:Your Unclaime Funds!!!
Date: Thu, 26 Jan 2023 20:34:52 -0800
MIME-Version: 1.0
Content-Type: text/html; charset="utf-8"
Content-Transfer-Encoding: quoted-printable
X-Priority: 3
X-MSMail-Priority: Normal
X-Mailer: Microsoft Outlook Express 6.00.2600.0000
X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2600.0000
Message-ID: <73031aeca2b644beb8934f72a4353755@VSV-C003-002100.toyota.astra.co.id>
To: Undisclosed recipients:;
X-EOPAttributedMessage: 0
X-MS-PublicTrafficType: Email
X-MS-TrafficTypeDiagnostic: TYZAPC01FT053:EE_|SG2PR02MB5796:EE_
X-MS-Office365-Filtering-Correlation-Id: 464d4f31-47b0-4803-99e8-08db001fda68
X-MS-Exchange-SenderADCheck: 2
X-MS-Exchange-AntiSpam-Relay: 1
X-Microsoft-Antispam: BCL:0;
X-Microsoft-Antispam-Message-Info:
=?windows-1251?Q?9gSBQhC3QenlA+eq3e8ge5wTbsn/XqT7mfz0E8ay+ofBucxzeIH08ZhJ?=
=?windows-1251?Q?6dewRyET3p9MMUjEJs4fQQAWE6y2+5VjZL6zWp84zEFKZ24ouI8m5xPj?=
=?windows-1251?Q?VBmANyryTT9BP18yFjDTHAZgDAY0MiqjcN3yoxymuNRJVz+AFB1y9DhJ?=
=?windows-1251?Q?WZMur5pB8wgYwaH+WT5oJ1+vHf54MhtmE/d/xErR3PU8TZoF6RWrziHE?=
=?windows-1251?Q?0QzQgtLDaonCkTSNa5LYw+6+7h3g99C7sHnRIHXaIyqz/ke3mp3ffPl4?=
=?windows-1251?Q?/BjhQJqx1LE12K8DiJVuAs+iT7Jeat6xkqL52w311Gir9xe0P9Z2J+EC?=
=?windows-1251?Q?umxIeVFzNdOzWE8e/cTzjIm+0BfL+ydPa8wfboxX9gibIlCK46bFBxM0?=
=?windows-1251?Q?pSAF/d2AHnx8T4i9DjFOrwrQzVqr5bmMB3k6wy8PMFotBURyRktIOLgI?=
=?windows-1251?Q?KwspluX0ZUyrY59jw6RCD1GhdbLhM/sGYnLTp3zOp/13DE9FvZ8t+qcz?=
=?windows-1251?Q?lsmnUvOFWb21R1N1ie4/RwDycaKUtXj2sK8jqcSYKkE2nfVJiJTY4LnB?=
=?windows-1251?Q?wJdC24kfrWTSgp+xGpegY7oS0r1lrhD9QtKPQKIn8bhljlZCa9HNiZjS?=
=?windows-1251?Q?R7VgNfF/8aUw0a6pRNM9OBaHGEJ3eLnzFSZIjuwjJYORa44UIzj5Q0Eu?=
=?windows-1251?Q?NQbHCjphAiyAWIuENh7y0NmJxBcsZ7+OkXUdyD9XnHxZWrlNmgfNxdFw?=
=?windows-1251?Q?6uc2yE1KofRIt2AOdq0aH0LKgf/c41aU70lZfD5xp+MZ8FFec9LLrbcC?=
=?windows-1251?Q?hrZi4VCjA57h9PH/ZfsnCrTDm85/Mdetk+/N/Jr4QOKWBg9m1cRtsSNT?=
=?windows-1251?Q?vupX4kjfza3rw32+Zsh0xJ73qAGmD1uToBp+RzigiVFOgxWB6fOsa0vP?=
=?windows-1251?Q?VZnZ06zeDiXvZecPB/JlieTDwHyPsoeakAGwwjB3babeLTDPziJb7HaT?=
=?windows-1251?Q?J/0cLwmeUvW27SNX3aGNF3nxsq2idONAONND8TRRAI3VgT9edfQMQwVF?=
=?windows-1251?Q?xw/0GmmU4HAy70m9X4c0eV7EyUTr6Tc6c5BK9/4GHiAdTzEq7p0BZczF?=
=?windows-1251?Q?H3vfZPgn063kSvNZ97+yAYoja/qQH0KJXvSYUeNLX17pEvfXibU7K+ox?=
=?windows-1251?Q?hg9tRo3oICWV7a/bSomAThUz+tMIEE8j2vKDZTlaUFFq6BEQmqEF1sJI?=
=?windows-1251?Q?+Ei6BEwrKXvkax4j2TQ=3D?=
X-Forefront-Antispam-Report:
CIP:114.6.82.34;CTRY:ID;LANG:en;SCL:5;SRV:;IPV:CAL;SFV:SPM;H:toyota.astra.co.id;PTR:114-6-82-34.resources.indosat.com;CAT:OSPM;SFS:(13230025)(4636009)(39860400002)(396003)(136003)(376002)(346002)(451199018)(109986016)(40470700004)(356005)(32650700002)(26005)(9686003)(6666004)(2860700004)(316002)(40480700001)(86362001)(966005)(83380400001)(35950700001)(82310400005)(8676002)(498600001)(336012)(40460700003)(24736004)(108616005)(70206006)(5660300002)(70586007)(82740400003)(2906002)(8936002)(41300700001)(81166007)(7366002)(7416002)(7406005)(4001630100005);DIR:OUT;SFP:1023;
X-OriginatorOrg: toyota.astra.co.id
X-MS-Exchange-CrossTenant-OriginalArrivalTime: 27 Jan 2023 04:35:00.9613
(UTC)
X-MS-Exchange-CrossTenant-Network-Message-Id: 464d4f31-47b0-4803-99e8-08db001fda68
X-MS-Exchange-CrossTenant-Id: 52d4e358-2ecb-48e2-bad4-d3c62441ff17
X-MS-Exchange-CrossTenant-OriginalAttributedTenantConnectingIp: TenantId=52d4e358-2ecb-48e2-bad4-d3c62441ff17;Ip=[114.6.82.34];Helo=[toyota.astra.co.id]
X-MS-Exchange-CrossTenant-AuthSource:
TYZAPC01FT053.eop-APC01.prod.protection.outlook.com
X-MS-Exchange-CrossTenant-AuthAs: Anonymous
X-MS-Exchange-CrossTenant-FromEntityHeader: HybridOnPrem
X-MS-Exchange-Transport-CrossTenantHeadersStamped: SG2PR02MB5796
X-Spam_score: 19.8
X-Spam_score_int: 198
X-Spam_bar: +++++++++++++++++++
X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",
has identified this incoming email as possible spam. The original
message has been attached to this so you can view it or label
similar future email. If you have any questions, see
@@CONTACT_ADDRESS@@ for details.
Content preview: âš [IMPORTANT CAUTION!]: This is e-mail from outside. Please
verify e-mail sender and subject carefully, Do not open unknown links, attachments
or non-related with your business e-mail and report sus [...]
Content analysis details: (19.8 points, 5.0 required)
pts rule name description
---- ---------------------- --------------------------------------------------
1.3 RCVD_IN_RP_RNBL RBL: Relay in RNBL,
https://senderscore.org/blacklistlookup/
[40.95.110.188 listed in bl.score.senderscore.com]
1.3 RCVD_IN_VALIDITY_RPBL RBL: Relay in Validity RPBL,
https://senderscore.org/blocklistlookup/
[40.95.110.188 listed in bl.score.senderscore.com]
0.0 SPF_HELO_FAIL SPF: HELO does not match SPF record (fail)
[SPF failed: Please see http://www.openspf.org/Why?s=helo;id=APC01-TYZ-obe.outbound.protection.outlook.com;ip=40.95.110.188;r=doctor.nl2k.ab.ca]
0.0 T_SPF_PERMERROR SPF: test of record failed (permerror)
0.0 NSL_RCVD_FROM_USER Received from User
0.0 AXB_X_FF_SEZ_S Forefront sez this is spam
0.0 FREEMAIL_FROM Sender email is commonly abused enduser mail provider
[ldk(at)epix.net]
1.1 MIME_HTML_ONLY BODY: Message only has text/html MIME parts
0.0 HTML_MESSAGE BODY: HTML included in message
1.0 FREEMAIL_REPLYTO Reply-To/From or Reply-To/body contain different
freemails
0.0 AXB_XMAILER_MIMEOLE_OL_024C2 Yet another X header trait
0.6 FSL_NEW_HELO_USER Spam's using Helo and User
0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid
0.0 FORGED_OUTLOOK_HTML Outlook can't send HTML message only
2.0 PDS_HELO_SPF_FAIL High profile HELO that fails SPF
0.0 KHOP_HELO_FCRDNS Relay HELO differs from its IP's reverse DNS
2.8 UNDISC_FREEM Undisclosed recipients + freemail reply-to
2.8 FORGED_MUA_OUTLOOK Forged mail pretending to be from MS Outlook
0.0 SPOOFED_FREEMAIL No description available.
1.0 SPOOFED_FREEM_REPTO Forged freemail sender with freemail reply-to
3.2 UNDISC_MONEY Undisclosed recipients + money/fraud signs
2.7 ADVANCE_FEE_4_NEW Appears to be advance fee fraud (Nigerian 419)
Subject: {SPAM?} You have an outstanding refund:Your Unclaime Funds!!!
" bottommargin=3D"5">
n" style=3D"max-width: 800px; width: 100%; border:#FF0000 1px solid;">
font-size: 14px; font-family: 'Segoe UI', Arial, Helvetica, sans-serif;;pad=
ding:5px;">
=E2=9A=A0
; font-family: 'Segoe UI', Arial, Helvetica, sans-serif;padding:10px;">
[IMPORTANT CAUTION!]: This is e-mail from outside. Please =
verify e-mail sender and subject carefully, Do not open unknown links, atta=
chments or non-related with your business e-mail and report suspicious e-ma=
il to
it.helpdesk@toyota.astra.co.id
Your Unclaime Funds!!!
I am an auditor in a European bank and clearing house.
Our duty is to look into transaction records of Banks, securities comp=
anies and financial houses within Europe.
anies and financial houses within Europe.
We also work in collaboration with America, Asia, Africa and Australia=
n clearing houses. During my investigation on un-paid debts in various bank=
s and security companies, I discovered that you are to be paid for an INHER=
ITED /CONTRACT FUND which requires
presentation of certain documents and payment of fees before the fund coul=
d be released to you
n clearing houses. During my investigation on un-paid debts in various bank=
s and security companies, I discovered that you are to be paid for an INHER=
ITED /CONTRACT FUND which requires
presentation of certain documents and payment of fees before the fund coul=
d be released to you
View the website for more information: http://news.bbc.co.uk/1/hi/busi=
ness/5171222.stm
ness/5171222.stm
I want to inform you that the problem you are having is from your agen=
t/partners and the lawyer who is representing you, they did not revealed th=
e reason for delay of your payment, and My reason of contacting you is to i=
nform you to stop payment of any
such to the lawyer or to the financial house, as you will not receive your=
fund due to some anomalies we discovered in your file.
t/partners and the lawyer who is representing you, they did not revealed th=
e reason for delay of your payment, and My reason of contacting you is to i=
nform you to stop payment of any
such to the lawyer or to the financial house, as you will not receive your=
fund due to some anomalies we discovered in your file.
We are to protect your interest, please contact me immediately so we c=
an advice you on how you will receive your fund without any impediment.
v>
an advice you on how you will receive your fund without any impediment.
v>
You are hereby advised to maintain constant contact with me and avoid =
any interaction with those unscrupulous representatives.
any interaction with those unscrupulous representatives.
Yours faithfully.
David Eddie Baggett
+44 703 5911223
------------------------------------------------=
---------------------------------------------------------------------------=
-------------
This e-mail and any attachment may contain confidential or legally privileg=
ed information for use of PT. Toyota-Astra Motor (TAM) only. If you are not=
the intended recipient, you are not authorized to copy or disclose all or =
any part of it without the prior
written consent of the company.
Each e-mail that is sent to internal or external organizations are logged a=
nd can be used as evidence in case of rule violation.
---------------------------------------------------------------------------=
-------------------------------------------------------------
Trackbacks
Trackback specific URI for this entryThis link is not meant to be clicked. It contains the trackback URI for this entry. You can use this URI to send ping- & trackbacks from your own blog to this entry. To copy the link, right click and select "Copy Shortcut" in Internet Explorer or "Copy Link Location" in Mozilla.
No Trackbacks
Comments
Display comments as Linear | ThreadedNo comments