loan spam
Posted by Dave Yadallee onX-Mozilla-Status2: 00000000
Return-path:
Envelope-to: dave@doctor.nl2k.ab.ca
Delivery-date: Tue, 04 Aug 2026 19:21:00 -0600
Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.99.5 (FreeBSD))
(envelope-from
id 1wrQIh-000000003AX-0F3W
for dave@doctor.nl2k.ab.ca;
Tue, 04 Aug 2026 19:20:07 -0600
Resent-From: The Doctor
Resent-Date: Tue, 4 Aug 2026 19:20:06 -0600
Resent-Message-ID:
Resent-To: Dave Yadallee
Received: from antispam.kemendagri.go.id ([103.245.225.108]:39778 helo=mx2.kemendagri.go.id)
by doctor.nl2k.ab.ca with esmtps (TLS1.2) tls TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384
(Exim 4.99.5 (FreeBSD))
(envelope-from
id 1wrPzX-00000000PSu-2gqv
for doctor@doctor.nl2k.ab.ca;
Tue, 04 Aug 2026 19:00:30 -0600
X-Spam-Status: No
DKIM-Filter: OpenDKIM Filter v2.11.0 mx2.kemendagri.go.id 4hF9bq644czNcsTK
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=kemendagri.go.id;
s=default; t=1785888199;
bh=y0v1dt806hfvFk1I0ZWxSAhf0eKLTtExYqgNEiGhm6Y=;
h=Subject:To:From:Date:Reply-To:From;
b=CtcO4vJGnrFcayvJ8f6y6BgOZGw19q2AJXY76r5ms6zRiUD8Xoabg6IOmsRGo+Ily
+/Z+crCPs2FJLTfD/nP7GKgBHhVgf0zVGociqUvxJ0ydmiPIFBlfJ6K4LrZ8kBP6WR
qGZFF3YeWKKNY6rspdKDHKL8yBe0UggPBbfqDibU=
X-KEMENDAGRI-MailScanner-eFa-Watermark: 1786492998.65716@8HfLYDyf6OWicNjWVDicxg
X-KEMENDAGRI-MailScanner-eFa-From: rahmat.santoso@kemendagri.go.id
X-KEMENDAGRI-MailScanner-eFa-SpamScore: s
X-KEMENDAGRI-MailScanner-eFa: Found to be clean
X-KEMENDAGRI-MailScanner-eFa-ID: 4hF9bm5f4HzNcsTJ
X-KEMENDAGRI-MailScanner-eFa-Information: Please contact antixbon@kemendagri.go.id for more information
Received: from mail.kemendagri.go.id ([192.168.193.156] [192.168.193.156])
(using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits))
(no client certificate requested)
by mx2.kemendagri.go.id (MailScanner Milter) with SMTP id 4hF9bm5f4HzNcsTJ;
Wed, 5 Aug 2026 07:03:17 +0700 (WIB)
DKIM-Filter: OpenDKIM Filter v2.11.0 mx2.kemendagri.go.id 4hF9bm5f4HzNcsTJ
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=kemendagri.go.id;
s=default; t=1785888197;
bh=y0v1dt806hfvFk1I0ZWxSAhf0eKLTtExYqgNEiGhm6Y=;
h=Subject:To:From:Date:Reply-To:From;
b=BbGLx8jASTaX48uiGCaQrvla3eDOl8B3t/N8rYxzbrn8pS3I0b9X5T5sty0DxwKiY
rVdMagaSj0+ughDK2sMk0WZeVUenZrJzuhbkTTOLF1VIZWDEKjx7JdNm6hx7hAWWRI
XBp1M8dg8dqcBwYR4B64HXPNPCbFIc01bDtKi6Ks=
Received: from mail.kemendagri.go.id ([127.0.0.1])
by localhost (mail.kemendagri.go.id [127.0.0.1]) (amavis, port 10032)
with ESMTP id aJ2BPFQ2-QRV; Wed, 5 Aug 2026 07:03:15 +0700 (WIB)
DKIM-Filter: OpenDKIM Filter v2.10.3 mail.kemendagri.go.id E309940BE70
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=kemendagri.go.id;
s=359AE826-CC3E-11E7-97D5-4A7CDFCE563B; t=1785888194;
bh=y0v1dt806hfvFk1I0ZWxSAhf0eKLTtExYqgNEiGhm6Y=;
h=MIME-Version:To:From:Date:Message-Id;
b=GCnCdUzVRUNygDwFROMAFbH3VxMAnNXUTROVx/ihk7xENUXsTGdNqhOCncmdZaGfi
cohuzvuMukCnM3dIxt5rn5l+bZzEdvyrjxJfN6w9/fMh8BMMJxXAU/L16AkbWEI4Dw
WGjQtrXs41uL9PWwO1r9SKdgwQGlonD8VTJbooZwnFr+iVpCz/QBOtkx8eE+RC3qXh
EY7O5TGej5c5Fasf/Q3RI+IRTF5XbjxOTxT/nuOM737ChLwgLTczoYUOOXKR6925ZN
pfE8y+y4crnJwJCPeRqAPmuejVBPsMWCSA2YBhIpx8isbBHYLlOaBurRsbve7OAqxT
PIieQcASK8UuA==
X-Virus-Scanned: amavis at mail.kemendagri.go.id
Received: from mail.kemendagri.go.id ([127.0.0.1])
by localhost (mail.kemendagri.go.id [127.0.0.1]) (amavis, port 10026)
with ESMTP id C0DaMJWiTNxS; Wed, 5 Aug 2026 07:03:14 +0700 (WIB)
Received: from [10.146.77.55] (unknown [146.103.18.69])
by mail.kemendagri.go.id (Postfix) with ESMTPA id 69DA65F74F2;
Wed, 5 Aug 2026 07:03:11 +0700 (WIB)
Content-Type: text/plain; charset="iso-8859-1"
MIME-Version: 1.0
Content-Transfer-Encoding: quoted-printable
Content-Description: Mail message body
Subject: Attention
To: Recipients
From:
Date: Tue, 04 Aug 2026 17:03:07 -0700
Reply-To: abadwadiafinancial@gmail.com
Message-Id: <20260805000311.69DA65F74F2@mail.kemendagri.go.id>
X-Spam_score: 10.8
X-Spam_score_int: 108
X-Spam_bar: ++++++++++
X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",
has identified this incoming email as possible spam. The original
message has been attached to this so you can view it or label
similar future email. If you have any questions, see
@@CONTACT_ADDRESS@@ for details.
Content preview: Dear Sir/Madam, Are you seeking for a LOAN? Reply us with
your Full name,address,amount,needed,age,duration,via our email id: abadwadiafinancial@gmail.com
For more details
Content analysis details: (10.8 points, 5.0 required)
pts rule name description
---- ---------------------- --------------------------------------------------
1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org
[103.245.225.108 listed in dnsbl.ahbl.org]
[103.245.225.108 listed in dnsbl.ahbl.org]
[103.245.225.108 listed in dnsbl.ahbl.org]
[103.245.225.108 listed in dnsbl.ahbl.org]
[146.103.18.69 listed in dnsbl.ahbl.org]
[146.103.18.69 listed in dnsbl.ahbl.org]
[146.103.18.69 listed in dnsbl.ahbl.org]
[146.103.18.69 listed in dnsbl.ahbl.org]
0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org
[103.245.225.108 listed in dnsbl.ahbl.org]
0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org
[103.245.225.108 listed in dnsbl.ahbl.org]
0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org
[103.245.225.108 listed in dnsbl.ahbl.org]
1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org
[103.245.225.108 listed in dnsbl.ahbl.org]
1.5 RCVD_IN_SBL_XBL RBL: Received via a relay in Spamhaus SBL+XBL
[146.103.18.69 listed in sbl-xbl.spamhaus.org]
1.5 RCVD_IN_CBL RBL: Received via a relay in cbl.abuseat.org
[Listed by XBL, see
-3.0 RCVD_IN_RP_CERTIFIED RBL: Sender in ReturnPath Certified - Contact
cert-sa@returnpath.net
[Excessive Number of Queries |
-2.0 RCVD_IN_RP_SAFE RBL: Sender in ReturnPath Safe - Contact
safe-sa@returnpath.net
[Excessive Number of Queries |
-0.0 SPF_PASS SPF: sender matches SPF record
0.2 MR_NOT_ATTRIBUTED_IP Beta rule: an non-attributed IPv4 found in
headers
0.5 NO_RDNS Sending MTA has no reverse DNS (Postfix variant)
1.3 RCVD_IN_RP_RNBL RBL: Relay in RNBL,
https://senderscore.org/blacklistlookup/
[103.245.225.108 listed in bl.score.senderscore.com]
-0.0 T_RP_MATCHES_RCVD Envelope sender domain matches handover relay
domain
1.7 DEAR_SOMETHING BODY: Contains 'Dear (something)'
0.6 J_CHICKENPOX_47 BODY: 4alpha-pock-7alpha
1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org
[103.245.225.108 listed in will-spam-for-food.eu.org]
[103.245.225.108 listed in will-spam-for-food.eu.org]
[103.245.225.108 listed in will-spam-for-food.eu.org]
[103.245.225.108 listed in will-spam-for-food.eu.org]
[103.245.225.108 listed in will-spam-for-food.eu.org]
[103.245.225.108 listed in will-spam-for-food.eu.org]
[103.245.225.108 listed in will-spam-for-food.eu.org]
[103.245.225.108 listed in will-spam-for-food.eu.org]
0.0 NO_RDNS2 Sending MTA has no reverse DNS
0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid
2.5 FREEMAIL_FORGED_REPLYTO Freemail in Reply-To, but not From
1.0 TEQF_USR_POLITE To and from user nearly same + polite greeting
0.0 T_FILL_THIS_FORM_SHORT Fill in a short form with personal information
Subject: {SPAM?} Attention
Dear Sir/Madam, Are you seeking for a LOAN? Reply us with your Full name,ad=
dress,amount,needed,age,duration,via our email id: abadwadiafinancial@gmail=
.com For more details