[mdaemon-l] Phising Email

Tue, 21 Jan 2020 20:44:53 -0800 

Dear Pak Syafril,

Mohon bantuan analisa dan pencerahan untuk header dan log berikut:

X-MDAV-Result: clean
X-MDAV-Processed: mail.richtex.co.id, Wed, 22 Jan 2020 10:32:33 +0700
Return-path: <[email protected]>
Authentication-Results: mail.richtex.co.id;
        spf=pass [email protected];
        dkim=pass (good signature) header.d=sgs.com header.b=jyHd3KHZ0P;
        dmarc=pass header.from=sgs.com (p=reject sampling=97 pct=100);
        iprev=pass policy.iprev=40.107.21.117 (PTR
mail-vi1eur05on2117.outbound.protection.outlook.com);
        iprev=fail policy.iprev=40.107.21.117 reason="does not match" (HELO
EUR05-VI1-obe.outbound.protection.outlook.com);
        iprev=fail policy.iprev=40.107.21.117 reason="does not match" (MAIL
[email protected])
Received-SPF: pass (mail.richtex.co.id: domain sgs.com
        designates 40.107.21.117 as permitted sender)
        receiver=mail.richtex.co.id; client-ip=40.107.21.117;
        mechanism=ip4:40.107.0.0/16; envelope-from="[email protected]";
        helo=EUR05-VI1-obe.outbound.protection.outlook.com;
Received: by mail.richtex.co.id with ESMTPS id 60-md50000006101.msg; Wed, 22
Jan 2020 10:32:30 +0700
X-Spam-Processed: mail.richtex.co.id, Wed, 22 Jan 2020 10:32:30 +0700
        (not processed: message size (2342367) exceeds spam filter max
message size of (2097152))
X-MDDKIM-Result: unapproved (mail.richtex.co.id)
X-MDSPF-Result: unapproved (mail.richtex.co.id)
X-MDRemoteIP: 40.107.21.117
X-MDHelo: EUR05-VI1-obe.outbound.protection.outlook.com
X-MDArrival-Date: Wed, 22 Jan 2020 10:32:30 +0700
X-Rcpt-To: [email protected]
X-MDRcpt-To: [email protected]
X-Return-Path: [email protected]
X-Envelope-From: [email protected]
X-MDaemon-Deliver-To: [email protected]
X-CAV-Result: clean
ARC-Seal: i=1; a=rsa-sha256; s=arcselector9901; d=microsoft.com; cv=none;
 
b=k22X8jAOZ5x/l0cqlPNegNghpEiTGj9vXysLt0SRxzfpFgqBKfeFOTkvawbJnCT8eMDQpD5o+a
O9TCQub5FbkP+hTtQ9eaoCVSM6DGwTdVBG38yNix7hH1Gha25itGPIB5HYd8BgnApH5ltiTiRMnp
r9SiqklKUXkrlyw6rFWxvF4UxH3leCI2jnxjRcSWpMhIX2eMGHFPQmnhVKHi8nJ7ww/19TB6Z07I
tbmG4/pyyzf79B1hAm+sLFpKGoLd322yZWVVvRTZVKico9WI6nhuQ/IvBPJb5DKev/kVWmjd/0+Q
eu70nuN+5Sr+INY3e4Om6rM8M16gOLj7osMMrnlA==
ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed;
d=microsoft.com;
 s=arcselector9901;
 
h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-Sende
rADCheck;
 bh=KIlC4Yc4V6tZ18AFrt9VDZqiouQ2c75k2k7zeyJCf3Q=;
 
b=P+hguKEj8wYgeSoxWB5aGZVslrIWcXf50tBBipfQQfZvUfqcE1a3Cm81aixg6iMjxCWCBVJ7k1
MPf+xzKGp4TpcG7doDYbcs5Udud3nPc5VJ0qKXQYPeY7LL7/7axdLJRxF7rZrG+9a25xvGNxXbHw
xbs4s7rMre8arj6MAs/egEqJJbKOUYdMTW1AHGZCMZv8wBmbJKc7AdbmkRtq5U00LavuNiQ2Ivc5
ao55qwkbDWhSOXWzJGmrm8u148FsPiQcs73pgJdTgdmzvxqZ9LnzpvPwlHynicVLD7TiExvuWmrP
xCFeqeo/smdUODOLZJ1/k1lKk+23hhztbN0v+5qw==
ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass
 smtp.mailfrom=sgs.com; dmarc=pass action=none header.from=sgs.com;
dkim=pass
 header.d=sgs.com; arc=none
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=sgs.com;
s=selector2;
 
h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-Sende
rADCheck;
 bh=KIlC4Yc4V6tZ18AFrt9VDZqiouQ2c75k2k7zeyJCf3Q=;
 
b=jyHd3KHZ0PE0Nd9EtpzyWoAJDShA1PU+itI7ey4K2d7Zs5ZwmNTW9ASiZqgOxT8Qs8Xvb0qdkQ
ZFsaO73vyKjS6rPS/NuyNbMaa1jFC/HMCG50stRbgNGXTicJXCfdcjiv0pIW6AW0i90V3vNXTXuL
o56leV94/tHhoHT8btNY0=
Received: from VI1PR0502MB3085.eurprd05.prod.outlook.com (10.175.20.11) by
 VI1PR0502MB4078.eurprd05.prod.outlook.com (52.134.13.31) with Microsoft
SMTP
 Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id
 15.20.2644.24; Wed, 22 Jan 2020 03:31:43 +0000
Received: from VI1PR0502MB3085.eurprd05.prod.outlook.com
 ([fe80::4892:7432:1143:35f6]) by VI1PR0502MB3085.eurprd05.prod.outlook.com
 ([fe80::4892:7432:1143:35f6%7]) with mapi id 15.20.2644.027; Wed, 22 Jan
2020
 03:31:43 +0000
From: "Alkatiri, Hanif (Jakarta) ([email protected])"
<[email protected]>
To: "[email protected]" <[email protected]>, "[email protected]"
        <[email protected]>
CC: "Putri, Hanum (Jakarta)" <[email protected]>
Subject: Re  :New  Export Procedures/ Regulation to Middle East & Africa; PT
 Richtex MutiaraBusana
Thread-Topic: Re  :New  Export Procedures/ Regulation to Middle East &
Africa;
 PT Richtex MutiaraBusana
Thread-Index: AdXQ1EM7izyf62TmQvWJa62Xj4HYJg==
Date: Wed, 22 Jan 2020 03:31:43 +0000
Message-ID:
 
<vi1pr0502mb30850d6cbb490c761b40a42a95...@vi1pr0502mb3085.eurprd05.prod.outl
ook.com>
Accept-Language: en-US
Content-Language: en-US
X-MS-Has-Attach: yes
X-MS-TNEF-Correlator:
authentication-results: spf=none (sender IP is )
 [email protected]; 
x-originating-ip: [165.225.112.210]
x-ms-publictraffictype: Email
x-ms-office365-filtering-correlation-id:
82df9aeb-14ee-4d7f-b160-08d79eeb9a0b
x-ms-traffictypediagnostic: VI1PR0502MB4078:
x-ms-exchange-transport-forked: True
x-microsoft-antispam-prvs:
 
<vi1pr0502mb4078c6e001d331165a7d454095...@vi1pr0502mb4078.eurprd05.prod.outl
ook.com>
x-ms-oob-tlc-oobclassifiers: OLM:5797;
x-forefront-prvs: 029097202E
x-forefront-antispam-report:
 
SFV:NSPM;SFS:(10019020)(4636009)(346002)(366004)(396003)(39860400002)(136003
)(376002)(189003)(199004)(966005)(316002)(26005)(478600001)(66574012)(290600
2)(81166006)(81156014)(66556008)(66446008)(110136005)(76116006)(4326008)(665
76008)(8936002)(66946007)(450100002)(64756008)(66476007)(6506007)(7120040000
1)(86362001)(55236004)(8676002)(52536014)(186003)(5660300002)(33656002)(7696
005)(55016002)(9686003);DIR:OUT;SFP:1102;SCL:1;SRVR:VI1PR0502MB4078;H:VI1PR0
502MB3085.eurprd05.prod.outlook.com;FPR:;SPF:None;LANG:en;PTR:InfoNoRecords;
MX:1;A:1;
received-spf: None (protection.outlook.com: sgs.com does not designate
 permitted sender hosts)
x-ms-exchange-senderadcheck: 1
x-microsoft-antispam: BCL:0;
x-microsoft-antispam-message-info:
 
pLalGBctG4CK4ngQoI9zZdJlYQIEYoFUV3+wUvXlR1iHZOMghFtIaL+lehGjCqKFSfRdEuCyj8V/
9/kSRnKv3tgFcLxU6/S4TBOBxrSnCTppDK6NeV4W1+cSGg3NRpKiQY7ILImWGSUrWxKsweSCNjmw
0EH3TcaUvTsEqi4bZwQqakKp4FkeKBRQsj8zBPIVY82JO9Jbi/gXjp4HIIdLYOn7v+84yEtwMi5+
nMwduif8DdXXI9ezKDT+qZ9g7chdbNkHmYlAzXGhRmBSMq4FJHdE8Jvj0CFAyafLHYaCrsy1wbCG
rmLGUz/u5HD4jHUmtUnxhV59EL5y8z05oDXqB314m/QaISyniP3f6AqMj72Wi8cyehJJXBlXWPyw
SriOwGJRtQMc6z0TAmhh7oo6+lorHSPD9pDp4Zk5PvyWX//EMYMSFHZym/IyqfE9wL1GDjKyhccY
MA2uaFTLTm7qFoO+xpXTZDlWYWGfxW7WJyI=
Content-Type: multipart/mixed;
        
boundary="_007_VI1PR0502MB30850D6CBB490C761B40A42A950C0VI1PR0502MB3085_"
MIME-Version: 1.0
X-OriginatorOrg: sgs.com
X-MS-Exchange-CrossTenant-Network-Message-Id:
82df9aeb-14ee-4d7f-b160-08d79eeb9a0b
X-MS-Exchange-CrossTenant-originalarrivaltime: 22 Jan 2020 03:31:43.3256
 (UTC)
X-MS-Exchange-CrossTenant-fromentityheader: Hosted
X-MS-Exchange-CrossTenant-id: e96fa72b-c8d6-4957-96bd-c7f8dc30cc88
X-MS-Exchange-CrossTenant-mailboxtype: HOSTED
X-MS-Exchange-CrossTenant-userprincipalname:
mQ3/3o49aZS20blDpUm6asupax6TOgeHVetX39FdBpQdoixXO/jcXPu0wtS5ILKUADhYpgL25rqk
/frKTyeqnw==
X-MS-Exchange-Transport-CrossTenantHeadersStamped: VI1PR0502MB4078

Wed 2020-01-22 10:32:09.268: 01: ----------
Wed 2020-01-22 10:32:05.861: 05: [530486] Session 530486; child 0002
Wed 2020-01-22 10:32:05.861: 05: [530486] Accepting SMTP connection from
40.107.21.117:50401 to 10.0.1.2:25
Wed 2020-01-22 10:32:05.862: 03: [530486] --> 220 mail.richtex.co.id ESMTP
Wed, 22 Jan 2020 10:32:05 +0700
Wed 2020-01-22 10:32:06.053: 02: [530486] <-- EHLO
EUR05-VI1-obe.outbound.protection.outlook.com
Wed 2020-01-22 10:32:06.059: 01: [530486] EHLO/HELO response delayed 10
seconds
Wed 2020-01-22 10:32:16.060: 03: [530486] --> 250-mail.richtex.co.id Hello
EUR05-VI1-obe.outbound.protection.outlook.com [40.107.21.117], pleased to
meet you
Wed 2020-01-22 10:32:16.060: 03: [530486] --> 250-ETRN
Wed 2020-01-22 10:32:16.060: 07: [530486] Location Screening hiding AUTH
from country United States
Wed 2020-01-22 10:32:16.060: 03: [530486] --> 250-8BITMIME
Wed 2020-01-22 10:32:16.060: 03: [530486] --> 250-ENHANCEDSTATUSCODES
Wed 2020-01-22 10:32:16.060: 03: [530486] --> 250-STARTTLS
Wed 2020-01-22 10:32:16.060: 03: [530486] --> 250 SIZE
Wed 2020-01-22 10:32:16.251: 02: [530486] <-- STARTTLS
Wed 2020-01-22 10:32:16.251: 03: [530486] --> 220 2.7.0 Ready to start TLS
Wed 2020-01-22 10:32:16.695: 01: [530486] SSL negotiation successful (TLS
1.2, 256 bit key exchange, 256 bit AES encryption)
Wed 2020-01-22 10:32:16.920: 02: [530486] <-- EHLO
EUR05-VI1-obe.outbound.protection.outlook.com
Wed 2020-01-22 10:32:16.926: 03: [530486] --> 250-mail.richtex.co.id Hello
EUR05-VI1-obe.outbound.protection.outlook.com [40.107.21.117], pleased to
meet you
Wed 2020-01-22 10:32:16.926: 03: [530486] --> 250-ETRN
Wed 2020-01-22 10:32:16.926: 07: [530486] Location Screening hiding AUTH
from country United States
Wed 2020-01-22 10:32:16.926: 03: [530486] --> 250-8BITMIME
Wed 2020-01-22 10:32:16.926: 03: [530486] --> 250-ENHANCEDSTATUSCODES
Wed 2020-01-22 10:32:16.926: 03: [530486] --> 250 SIZE
Wed 2020-01-22 10:32:17.118: 02: [530486] <-- MAIL
FROM:<[email protected]> SIZE=2352374
Wed 2020-01-22 10:32:17.127: 05: [530486] Performing PTR lookup
(117.21.107.40.IN-ADDR.ARPA)
Wed 2020-01-22 10:32:17.157: 05: [530486] *  D=117.21.107.40.IN-ADDR.ARPA
TTL=(60) PTR=[mail-vi1eur05on2117.outbound.protection.outlook.com]
Wed 2020-01-22 10:32:17.224: 05: [530486] *
D=mail-vi1eur05on2117.outbound.protection.outlook.com TTL=(5)
A=[40.107.21.117]
Wed 2020-01-22 10:32:17.224: 05: [530486] ---- End PTR results
Wed 2020-01-22 10:32:17.228: 05: [530486] Performing IP lookup
(EUR05-VI1-obe.outbound.protection.outlook.com)
Wed 2020-01-22 10:32:17.244: 05: [530486] *
D=EUR05-VI1-obe.outbound.protection.outlook.com TTL=(52) A=[23.103.134.15]
Wed 2020-01-22 10:32:17.244: 05: [530486] ---- End IP lookup results
Wed 2020-01-22 10:32:17.255: 05: [530486] Performing IP lookup (sgs.com)
Wed 2020-01-22 10:32:17.288: 05: [530486] *  D=sgs.com TTL=(360)
A=[57.79.15.9]
Wed 2020-01-22 10:32:17.321: 05: [530486] *  P=010 S=000 D=sgs.com TTL=(15)
MX=[sgs-com.mail.protection.outlook.com]
Wed 2020-01-22 10:32:17.354: 05: [530486] *
D=sgs-com.mail.protection.outlook.com TTL=(0) A=[104.47.1.36]
Wed 2020-01-22 10:32:17.354: 05: [530486] *
D=sgs-com.mail.protection.outlook.com TTL=(0) A=[104.47.0.36]
Wed 2020-01-22 10:32:17.354: 05: [530486] ---- End IP lookup results
Wed 2020-01-22 10:32:17.357: 09: [530486] Performing SPF lookup
(EUR05-VI1-obe.outbound.protection.outlook.com / 40.107.21.117)
Wed 2020-01-22 10:32:17.373: 09: [530486] *  Policy: v=spf1
include:spf.protection.outlook.com -all
Wed 2020-01-22 10:32:17.373: 09: [530486] *  Evaluating
include:spf.protection.outlook.com: performing lookup
Wed 2020-01-22 10:32:17.389: 09: [530486] *    Policy: v=spf1
ip4:40.92.0.0/15 ip4:40.107.0.0/16 ip4:52.100.0.0/14 ip4:104.47.0.0/17
ip6:2a01:111:f400::/48 ip6:2a01:111:f403::/48 -all
Wed 2020-01-22 10:32:17.389: 09: [530486] *    Evaluating ip4:40.92.0.0/15:
no match
Wed 2020-01-22 10:32:17.389: 09: [530486] *    Evaluating ip4:40.107.0.0/16:
match
Wed 2020-01-22 10:32:17.389: 09: [530486] *  Evaluating
include:spf.protection.outlook.com: match
Wed 2020-01-22 10:32:17.389: 09: [530486] *  Result: pass
Wed 2020-01-22 10:32:17.389: 09: [530486] ---- End SPF results
Wed 2020-01-22 10:32:17.389: 09: [530486] Performing SPF lookup (sgs.com /
40.107.21.117)
Wed 2020-01-22 10:32:17.424: 09: [530486] *  Policy: v=spf1 mx a:spf.sgs.com
include:amazonses.com include:spf.protection.outlook.com
include:_spf.survmail.com -all
Wed 2020-01-22 10:32:17.456: 09: [530486] *  Evaluating mx: no match
Wed 2020-01-22 10:32:17.489: 09: [530486] *  Evaluating a:spf.sgs.com: no
match
Wed 2020-01-22 10:32:17.489: 09: [530486] *  Evaluating
include:amazonses.com: performing lookup
Wed 2020-01-22 10:32:17.505: 09: [530486] *    Policy: v=spf1
ip4:199.255.192.0/22 ip4:199.127.232.0/22 ip4:54.240.0.0/18
ip4:69.169.224.0/20 ip4:76.223.176.0/24 ip4:76.223.180.0/23
ip4:76.223.188.0/24 ip4:76.223.189.0/24 ip4:76.223.190.0/24 -all
Wed 2020-01-22 10:32:17.505: 09: [530486] *    Evaluating
ip4:199.255.192.0/22: no match
Wed 2020-01-22 10:32:17.505: 09: [530486] *    Evaluating
ip4:199.127.232.0/22: no match
Wed 2020-01-22 10:32:17.505: 09: [530486] *    Evaluating ip4:54.240.0.0/18:
no match
Wed 2020-01-22 10:32:17.505: 09: [530486] *    Evaluating
ip4:69.169.224.0/20: no match
Wed 2020-01-22 10:32:17.505: 09: [530486] *    Evaluating
ip4:76.223.176.0/24: no match
Wed 2020-01-22 10:32:17.505: 09: [530486] *    Evaluating
ip4:76.223.180.0/23: no match
Wed 2020-01-22 10:32:17.505: 09: [530486] *    Evaluating
ip4:76.223.188.0/24: no match
Wed 2020-01-22 10:32:17.506: 09: [530486] *    Evaluating
ip4:76.223.189.0/24: no match
Wed 2020-01-22 10:32:17.506: 09: [530486] *    Evaluating
ip4:76.223.190.0/24: no match
Wed 2020-01-22 10:32:17.506: 09: [530486] *    Evaluating -all: match
Wed 2020-01-22 10:32:17.506: 09: [530486] *  Evaluating
include:amazonses.com: no match
Wed 2020-01-22 10:32:17.506: 09: [530486] *  Evaluating
include:spf.protection.outlook.com: performing lookup
Wed 2020-01-22 10:32:17.506: 09: [530486] *    Policy (cache): v=spf1
ip4:40.92.0.0/15 ip4:40.107.0.0/16 ip4:52.100.0.0/14 ip4:104.47.0.0/17
ip6:2a01:111:f400::/48 ip6:2a01:111:f403::/48 -all
Wed 2020-01-22 10:32:17.506: 09: [530486] *    Evaluating ip4:40.92.0.0/15:
no match
Wed 2020-01-22 10:32:17.506: 09: [530486] *    Evaluating ip4:40.107.0.0/16:
match
Wed 2020-01-22 10:32:17.506: 09: [530486] *  Evaluating
include:spf.protection.outlook.com: match
Wed 2020-01-22 10:32:17.506: 09: [530486] *  Result: pass
Wed 2020-01-22 10:32:17.506: 09: [530486] ---- End SPF results
Wed 2020-01-22 10:32:17.506: 03: [530486] --> 250 2.1.0 Sender OK
Wed 2020-01-22 10:32:17.697: 02: [530486] <-- RCPT
TO:<[email protected]>
Wed 2020-01-22 10:32:17.705: 05: [530486] Performing DNS-BL lookup
(40.107.21.117 - connecting IP)
Wed 2020-01-22 10:32:17.740: 05: [530486] *  zen.spamhaus.org - passed
Wed 2020-01-22 10:32:18.007: 05: [530486] *  b.barracudacentral.org - passed
Wed 2020-01-22 10:32:18.203: 05: [530486] *  bl.spamcop.net - passed
Wed 2020-01-22 10:32:18.464: 05: [530486] *  truncate.gbudb.net - passed
Wed 2020-01-22 10:32:18.835: 05: [530486] *  dnsbl.spfbl.net - passed
Wed 2020-01-22 10:32:18.835: 05: [530486] ---- End DNS-BL results
Wed 2020-01-22 10:32:18.839: 03: [530486] --> 250 2.1.5 Recipient OK
Wed 2020-01-22 10:32:19.196: 02: [530486] <-- RCPT TO:<[email protected]>
Wed 2020-01-22 10:32:19.201: 03: [530486] --> 250 2.1.5 Recipient OK
Wed 2020-01-22 10:32:19.407: 02: [530486] <-- DATA
Wed 2020-01-22 10:32:19.408: 01: [530486] Creating temp file (SMTP):
d:\mdaemon\queues\temp\57\md50000000040.tmp
Wed 2020-01-22 10:32:19.408: 03: [530486] --> 354 Enter mail, end with
<CRLF>.<CRLF>
Wed 2020-01-22 10:32:25.261: 01: [530486] Message size: 2342367 bytes
Wed 2020-01-22 10:32:25.265: 10: [530486] Performing DKIM lookup
Wed 2020-01-22 10:32:25.265: 10: [530486] *  File:
d:\mdaemon\queues\temp\57\md50000000040.tmp
Wed 2020-01-22 10:32:25.265: 10: [530486] *  Message-ID:
<vi1pr0502mb30850d6cbb490c761b40a42a95...@vi1pr0502mb3085.eurprd05.prod.outl
ook.com>
Wed 2020-01-22 10:32:25.363: 10: [530486] * DKIM-Signature 1: v=1;
a=rsa-sha256; c=relaxed/relaxed; d=sgs.com; s=selector2; <some tags are not
logged>
Wed 2020-01-22 10:32:25.363: 10: [530486] *    Verification result: good
signature
Wed 2020-01-22 10:32:25.363: 10: [530486] *  Result: pass
Wed 2020-01-22 10:32:25.363: 10: [530486] ---- End DKIM results
Wed 2020-01-22 10:32:25.367: 19: [530486] Performing DMARC processing
Wed 2020-01-22 10:32:25.367: 19: [530486] *  File:
d:\mdaemon\queues\temp\57\md50000000040.tmp
Wed 2020-01-22 10:32:25.367: 19: [530486] *  Message-ID:
<vi1pr0502mb30850d6cbb490c761b40a42a95...@vi1pr0502mb3085.eurprd05.prod.outl
ook.com>
Wed 2020-01-22 10:32:25.367: 19: [530486] *  Author domain: sgs.com
Wed 2020-01-22 10:32:25.367: 19: [530486] *  Organizational domain: sgs.com
Wed 2020-01-22 10:32:25.367: 19: [530486] *  Query domain: _dmarc.sgs.com
Wed 2020-01-22 10:32:25.400: 19: [530486] *    Policy record: v=DMARC1;
p=reject; rua=mailto:[email protected],mailto:[email protected];
ruf=mailto:[email protected]; fo=1; pct=100
Wed 2020-01-22 10:32:25.408: 19: [530486] *  Verifying report recipient:
[email protected]
Wed 2020-01-22 10:32:25.408: 19: [530486] *  Query domain:
sgs.com._report._dmarc.vali.email
Wed 2020-01-22 10:32:25.564: 19: [530486] *    Policy record: v=DMARC1
Wed 2020-01-22 10:32:25.564: 19: [530486] *    Recipient
[email protected] is verified
Wed 2020-01-22 10:32:25.568: 19: [530486] *  Checking authentication
mechanisms for DMARC alignment
Wed 2020-01-22 10:32:25.568: 19: [530486] *    SPF: domain "sgs.com" passed
SPF check; and domain is DMARC aligned
Wed 2020-01-22 10:32:25.568: 19: [530486] *    DKIM: domain "sgs.com" (from
d= of signature #1) verified; and domain is DMARC aligned
Wed 2020-01-22 10:32:25.568: 19: [530486] *  Result: pass
Wed 2020-01-22 10:32:25.568: 19: [530486] ---- End DMARC results
Wed 2020-01-22 10:32:25.572: 11: [530486] Passing message through ClamAV
Plugin (d:\mdaemon\queues\temp\57\md50000000040.tmp)...
Wed 2020-01-22 10:32:25.572: 11: [530486] *  Message-ID:
<vi1pr0502mb30850d6cbb490c761b40a42a95...@vi1pr0502mb3085.eurprd05.prod.outl
ook.com>
Wed 2020-01-22 10:32:25.907: 11: [530486] *  Virus result: 0 - clean
Wed 2020-01-22 10:32:25.908: 07: [530486] Spam filter scan skipped; message
size (2342367) exceeds spam filter max message size of (2097152)
Wed 2020-01-22 10:32:25.911: 01: [530486] Message creation successful:
d:\mdaemon\queues\inbound\60\md50000006101.msg
Wed 2020-01-22 10:32:25.911: 03: [530486] --> 250 2.6.0 Ok, message saved
<Message-ID:
<vi1pr0502mb30850d6cbb490c761b40a42a95...@vi1pr0502mb3085.eurprd05.prod.outl
ook.com>>
Wed 2020-01-22 10:32:26.731: 02: [530486] <-- QUIT
Wed 2020-01-22 10:32:26.731: 04: [530486] *  Socket error 10054 - Connection
was reset by the other side!
Wed 2020-01-22 10:32:26.731: 01: [530486] SMTP session successful (Bytes
in/out: 2348582/3901)
Wed 2020-01-22 10:32:26.731: 01: ----------

Apakah ini hanya mail phising biasa atau sender terkena hijack? 
Karena banyak kejanggalan dalam konten emailnya.

Terima kasih.


-- 
--[mdaemon-l]----------------------------------------------------------
Milis ini untuk Diskusi antar pengguna MDaemon Mail Server di Indonesia

Netiket: https://wiki.openstack.org/wiki/MailingListEtiquette
Arsip: http://mdaemon-l.dutaint.com
Dokumentasi : http://mdaemon.dutaint.co.id
Berlangganan: Kirim mail ke [email protected]
Henti Langgan: Kirim mail ke [email protected]
Versi terakhir: MDaemon 19.5.3, SecurityGateway 6.5.1

Wed 2020-01-22 10:32:09.268: 01: ----------
Wed 2020-01-22 10:32:05.861: 05: [530486] Session 530486; child 0002
Wed 2020-01-22 10:32:05.861: 05: [530486] Accepting SMTP connection from 
40.107.21.117:50401 to 10.0.1.2:25
Wed 2020-01-22 10:32:05.862: 03: [530486] --> 220 mail.richtex.co.id ESMTP Wed, 
22 Jan 2020 10:32:05 +0700
Wed 2020-01-22 10:32:06.053: 02: [530486] <-- EHLO 
EUR05-VI1-obe.outbound.protection.outlook.com
Wed 2020-01-22 10:32:06.059: 01: [530486] EHLO/HELO response delayed 10 seconds
Wed 2020-01-22 10:32:16.060: 03: [530486] --> 250-mail.richtex.co.id Hello 
EUR05-VI1-obe.outbound.protection.outlook.com [40.107.21.117], pleased to meet 
you
Wed 2020-01-22 10:32:16.060: 03: [530486] --> 250-ETRN
Wed 2020-01-22 10:32:16.060: 07: [530486] Location Screening hiding AUTH from 
country United States
Wed 2020-01-22 10:32:16.060: 03: [530486] --> 250-8BITMIME
Wed 2020-01-22 10:32:16.060: 03: [530486] --> 250-ENHANCEDSTATUSCODES
Wed 2020-01-22 10:32:16.060: 03: [530486] --> 250-STARTTLS
Wed 2020-01-22 10:32:16.060: 03: [530486] --> 250 SIZE
Wed 2020-01-22 10:32:16.251: 02: [530486] <-- STARTTLS
Wed 2020-01-22 10:32:16.251: 03: [530486] --> 220 2.7.0 Ready to start TLS
Wed 2020-01-22 10:32:16.695: 01: [530486] SSL negotiation successful (TLS 1.2, 
256 bit key exchange, 256 bit AES encryption)
Wed 2020-01-22 10:32:16.920: 02: [530486] <-- EHLO 
EUR05-VI1-obe.outbound.protection.outlook.com
Wed 2020-01-22 10:32:16.926: 03: [530486] --> 250-mail.richtex.co.id Hello 
EUR05-VI1-obe.outbound.protection.outlook.com [40.107.21.117], pleased to meet 
you
Wed 2020-01-22 10:32:16.926: 03: [530486] --> 250-ETRN
Wed 2020-01-22 10:32:16.926: 07: [530486] Location Screening hiding AUTH from 
country United States
Wed 2020-01-22 10:32:16.926: 03: [530486] --> 250-8BITMIME
Wed 2020-01-22 10:32:16.926: 03: [530486] --> 250-ENHANCEDSTATUSCODES
Wed 2020-01-22 10:32:16.926: 03: [530486] --> 250 SIZE
Wed 2020-01-22 10:32:17.118: 02: [530486] <-- MAIL 
FROM:<[email protected]> SIZE=2352374
Wed 2020-01-22 10:32:17.127: 05: [530486] Performing PTR lookup 
(117.21.107.40.IN-ADDR.ARPA)
Wed 2020-01-22 10:32:17.157: 05: [530486] *  D=117.21.107.40.IN-ADDR.ARPA 
TTL=(60) PTR=[mail-vi1eur05on2117.outbound.protection.outlook.com]
Wed 2020-01-22 10:32:17.224: 05: [530486] *  
D=mail-vi1eur05on2117.outbound.protection.outlook.com TTL=(5) A=[40.107.21.117]
Wed 2020-01-22 10:32:17.224: 05: [530486] ---- End PTR results
Wed 2020-01-22 10:32:17.228: 05: [530486] Performing IP lookup 
(EUR05-VI1-obe.outbound.protection.outlook.com)
Wed 2020-01-22 10:32:17.244: 05: [530486] *  
D=EUR05-VI1-obe.outbound.protection.outlook.com TTL=(52) A=[23.103.134.15]
Wed 2020-01-22 10:32:17.244: 05: [530486] ---- End IP lookup results
Wed 2020-01-22 10:32:17.255: 05: [530486] Performing IP lookup (sgs.com)
Wed 2020-01-22 10:32:17.288: 05: [530486] *  D=sgs.com TTL=(360) A=[57.79.15.9]
Wed 2020-01-22 10:32:17.321: 05: [530486] *  P=010 S=000 D=sgs.com TTL=(15) 
MX=[sgs-com.mail.protection.outlook.com]
Wed 2020-01-22 10:32:17.354: 05: [530486] *  
D=sgs-com.mail.protection.outlook.com TTL=(0) A=[104.47.1.36]
Wed 2020-01-22 10:32:17.354: 05: [530486] *  
D=sgs-com.mail.protection.outlook.com TTL=(0) A=[104.47.0.36]
Wed 2020-01-22 10:32:17.354: 05: [530486] ---- End IP lookup results
Wed 2020-01-22 10:32:17.357: 09: [530486] Performing SPF lookup 
(EUR05-VI1-obe.outbound.protection.outlook.com / 40.107.21.117)
Wed 2020-01-22 10:32:17.373: 09: [530486] *  Policy: v=spf1 
include:spf.protection.outlook.com -all
Wed 2020-01-22 10:32:17.373: 09: [530486] *  Evaluating 
include:spf.protection.outlook.com: performing lookup
Wed 2020-01-22 10:32:17.389: 09: [530486] *    Policy: v=spf1 ip4:40.92.0.0/15 
ip4:40.107.0.0/16 ip4:52.100.0.0/14 ip4:104.47.0.0/17 ip6:2a01:111:f400::/48 
ip6:2a01:111:f403::/48 -all
Wed 2020-01-22 10:32:17.389: 09: [530486] *    Evaluating ip4:40.92.0.0/15: no 
match
Wed 2020-01-22 10:32:17.389: 09: [530486] *    Evaluating ip4:40.107.0.0/16: 
match
Wed 2020-01-22 10:32:17.389: 09: [530486] *  Evaluating 
include:spf.protection.outlook.com: match
Wed 2020-01-22 10:32:17.389: 09: [530486] *  Result: pass
Wed 2020-01-22 10:32:17.389: 09: [530486] ---- End SPF results
Wed 2020-01-22 10:32:17.389: 09: [530486] Performing SPF lookup (sgs.com / 
40.107.21.117)
Wed 2020-01-22 10:32:17.424: 09: [530486] *  Policy: v=spf1 mx a:spf.sgs.com 
include:amazonses.com include:spf.protection.outlook.com 
include:_spf.survmail.com -all
Wed 2020-01-22 10:32:17.456: 09: [530486] *  Evaluating mx: no match
Wed 2020-01-22 10:32:17.489: 09: [530486] *  Evaluating a:spf.sgs.com: no match
Wed 2020-01-22 10:32:17.489: 09: [530486] *  Evaluating include:amazonses.com: 
performing lookup
Wed 2020-01-22 10:32:17.505: 09: [530486] *    Policy: v=spf1 
ip4:199.255.192.0/22 ip4:199.127.232.0/22 ip4:54.240.0.0/18 ip4:69.169.224.0/20 
ip4:76.223.176.0/24 ip4:76.223.180.0/23 ip4:76.223.188.0/24 ip4:76.223.189.0/24 
ip4:76.223.190.0/24 -all
Wed 2020-01-22 10:32:17.505: 09: [530486] *    Evaluating ip4:199.255.192.0/22: 
no match
Wed 2020-01-22 10:32:17.505: 09: [530486] *    Evaluating ip4:199.127.232.0/22: 
no match
Wed 2020-01-22 10:32:17.505: 09: [530486] *    Evaluating ip4:54.240.0.0/18: no 
match
Wed 2020-01-22 10:32:17.505: 09: [530486] *    Evaluating ip4:69.169.224.0/20: 
no match
Wed 2020-01-22 10:32:17.505: 09: [530486] *    Evaluating ip4:76.223.176.0/24: 
no match
Wed 2020-01-22 10:32:17.505: 09: [530486] *    Evaluating ip4:76.223.180.0/23: 
no match
Wed 2020-01-22 10:32:17.505: 09: [530486] *    Evaluating ip4:76.223.188.0/24: 
no match
Wed 2020-01-22 10:32:17.506: 09: [530486] *    Evaluating ip4:76.223.189.0/24: 
no match
Wed 2020-01-22 10:32:17.506: 09: [530486] *    Evaluating ip4:76.223.190.0/24: 
no match
Wed 2020-01-22 10:32:17.506: 09: [530486] *    Evaluating -all: match
Wed 2020-01-22 10:32:17.506: 09: [530486] *  Evaluating include:amazonses.com: 
no match
Wed 2020-01-22 10:32:17.506: 09: [530486] *  Evaluating 
include:spf.protection.outlook.com: performing lookup
Wed 2020-01-22 10:32:17.506: 09: [530486] *    Policy (cache): v=spf1 
ip4:40.92.0.0/15 ip4:40.107.0.0/16 ip4:52.100.0.0/14 ip4:104.47.0.0/17 
ip6:2a01:111:f400::/48 ip6:2a01:111:f403::/48 -all
Wed 2020-01-22 10:32:17.506: 09: [530486] *    Evaluating ip4:40.92.0.0/15: no 
match
Wed 2020-01-22 10:32:17.506: 09: [530486] *    Evaluating ip4:40.107.0.0/16: 
match
Wed 2020-01-22 10:32:17.506: 09: [530486] *  Evaluating 
include:spf.protection.outlook.com: match
Wed 2020-01-22 10:32:17.506: 09: [530486] *  Result: pass
Wed 2020-01-22 10:32:17.506: 09: [530486] ---- End SPF results
Wed 2020-01-22 10:32:17.506: 03: [530486] --> 250 2.1.0 Sender OK
Wed 2020-01-22 10:32:17.697: 02: [530486] <-- RCPT TO:<[email protected]>
Wed 2020-01-22 10:32:17.705: 05: [530486] Performing DNS-BL lookup 
(40.107.21.117 - connecting IP)
Wed 2020-01-22 10:32:17.740: 05: [530486] *  zen.spamhaus.org - passed
Wed 2020-01-22 10:32:18.007: 05: [530486] *  b.barracudacentral.org - passed
Wed 2020-01-22 10:32:18.203: 05: [530486] *  bl.spamcop.net - passed
Wed 2020-01-22 10:32:18.464: 05: [530486] *  truncate.gbudb.net - passed
Wed 2020-01-22 10:32:18.835: 05: [530486] *  dnsbl.spfbl.net - passed
Wed 2020-01-22 10:32:18.835: 05: [530486] ---- End DNS-BL results
Wed 2020-01-22 10:32:18.839: 03: [530486] --> 250 2.1.5 Recipient OK
Wed 2020-01-22 10:32:19.196: 02: [530486] <-- RCPT TO:<[email protected]>
Wed 2020-01-22 10:32:19.201: 03: [530486] --> 250 2.1.5 Recipient OK
Wed 2020-01-22 10:32:19.407: 02: [530486] <-- DATA
Wed 2020-01-22 10:32:19.408: 01: [530486] Creating temp file (SMTP): 
d:\mdaemon\queues\temp\57\md50000000040.tmp
Wed 2020-01-22 10:32:19.408: 03: [530486] --> 354 Enter mail, end with 
<CRLF>.<CRLF>
Wed 2020-01-22 10:32:25.261: 01: [530486] Message size: 2342367 bytes
Wed 2020-01-22 10:32:25.265: 10: [530486] Performing DKIM lookup
Wed 2020-01-22 10:32:25.265: 10: [530486] *  File: 
d:\mdaemon\queues\temp\57\md50000000040.tmp
Wed 2020-01-22 10:32:25.265: 10: [530486] *  Message-ID: 
<vi1pr0502mb30850d6cbb490c761b40a42a95...@vi1pr0502mb3085.eurprd05.prod.outlook.com>
Wed 2020-01-22 10:32:25.363: 10: [530486] * DKIM-Signature 1: v=1; 
a=rsa-sha256; c=relaxed/relaxed; d=sgs.com; s=selector2; <some tags are not 
logged>
Wed 2020-01-22 10:32:25.363: 10: [530486] *    Verification result: good 
signature
Wed 2020-01-22 10:32:25.363: 10: [530486] *  Result: pass
Wed 2020-01-22 10:32:25.363: 10: [530486] ---- End DKIM results
Wed 2020-01-22 10:32:25.367: 19: [530486] Performing DMARC processing
Wed 2020-01-22 10:32:25.367: 19: [530486] *  File: 
d:\mdaemon\queues\temp\57\md50000000040.tmp
Wed 2020-01-22 10:32:25.367: 19: [530486] *  Message-ID: 
<vi1pr0502mb30850d6cbb490c761b40a42a95...@vi1pr0502mb3085.eurprd05.prod.outlook.com>
Wed 2020-01-22 10:32:25.367: 19: [530486] *  Author domain: sgs.com
Wed 2020-01-22 10:32:25.367: 19: [530486] *  Organizational domain: sgs.com
Wed 2020-01-22 10:32:25.367: 19: [530486] *  Query domain: _dmarc.sgs.com
Wed 2020-01-22 10:32:25.400: 19: [530486] *    Policy record: v=DMARC1; 
p=reject; rua=mailto:[email protected],mailto:[email protected]; 
ruf=mailto:[email protected]; fo=1; pct=100
Wed 2020-01-22 10:32:25.408: 19: [530486] *  Verifying report recipient: 
[email protected]
Wed 2020-01-22 10:32:25.408: 19: [530486] *  Query domain: 
sgs.com._report._dmarc.vali.email
Wed 2020-01-22 10:32:25.564: 19: [530486] *    Policy record: v=DMARC1
Wed 2020-01-22 10:32:25.564: 19: [530486] *    Recipient [email protected] 
is verified
Wed 2020-01-22 10:32:25.568: 19: [530486] *  Checking authentication mechanisms 
for DMARC alignment
Wed 2020-01-22 10:32:25.568: 19: [530486] *    SPF: domain "sgs.com" passed SPF 
check; and domain is DMARC aligned
Wed 2020-01-22 10:32:25.568: 19: [530486] *    DKIM: domain "sgs.com" (from d= 
of signature #1) verified; and domain is DMARC aligned
Wed 2020-01-22 10:32:25.568: 19: [530486] *  Result: pass
Wed 2020-01-22 10:32:25.568: 19: [530486] ---- End DMARC results
Wed 2020-01-22 10:32:25.572: 11: [530486] Passing message through ClamAV Plugin 
(d:\mdaemon\queues\temp\57\md50000000040.tmp)...
Wed 2020-01-22 10:32:25.572: 11: [530486] *  Message-ID: 
<vi1pr0502mb30850d6cbb490c761b40a42a95...@vi1pr0502mb3085.eurprd05.prod.outlook.com>
Wed 2020-01-22 10:32:25.907: 11: [530486] *  Virus result: 0 - clean
Wed 2020-01-22 10:32:25.908: 07: [530486] Spam filter scan skipped; message 
size (2342367) exceeds spam filter max message size of (2097152)
Wed 2020-01-22 10:32:25.911: 01: [530486] Message creation successful: 
d:\mdaemon\queues\inbound\60\md50000006101.msg
Wed 2020-01-22 10:32:25.911: 03: [530486] --> 250 2.6.0 Ok, message saved 
<Message-ID: 
<vi1pr0502mb30850d6cbb490c761b40a42a95...@vi1pr0502mb3085.eurprd05.prod.outlook.com>>
Wed 2020-01-22 10:32:26.731: 02: [530486] <-- QUIT
Wed 2020-01-22 10:32:26.731: 04: [530486] *  Socket error 10054 - Connection 
was reset by the other side!
Wed 2020-01-22 10:32:26.731: 01: [530486] SMTP session successful (Bytes 
in/out: 2348582/3901)
Wed 2020-01-22 10:32:26.731: 01: ----------
X-MDAV-Result: clean
X-MDAV-Processed: mail.richtex.co.id, Wed, 22 Jan 2020 10:32:33 +0700
Return-path: <[email protected]>
Authentication-Results: mail.richtex.co.id;
        spf=pass [email protected];
        dkim=pass (good signature) header.d=sgs.com header.b=jyHd3KHZ0P;
        dmarc=pass header.from=sgs.com (p=reject sampling=97 pct=100);
        iprev=pass policy.iprev=40.107.21.117 (PTR 
mail-vi1eur05on2117.outbound.protection.outlook.com);
        iprev=fail policy.iprev=40.107.21.117 reason="does not match" (HELO 
EUR05-VI1-obe.outbound.protection.outlook.com);
        iprev=fail policy.iprev=40.107.21.117 reason="does not match" (MAIL 
[email protected])
Received-SPF: pass (mail.richtex.co.id: domain sgs.com
        designates 40.107.21.117 as permitted sender)
        receiver=mail.richtex.co.id; client-ip=40.107.21.117;
        mechanism=ip4:40.107.0.0/16; envelope-from="[email protected]";
        helo=EUR05-VI1-obe.outbound.protection.outlook.com;
Received: by mail.richtex.co.id with ESMTPS id 60-md50000006101.msg; Wed, 22 
Jan 2020 10:32:30 +0700
X-Spam-Processed: mail.richtex.co.id, Wed, 22 Jan 2020 10:32:30 +0700
        (not processed: message size (2342367) exceeds spam filter max message 
size of (2097152))
X-MDDKIM-Result: unapproved (mail.richtex.co.id)
X-MDSPF-Result: unapproved (mail.richtex.co.id)
X-MDRemoteIP: 40.107.21.117
X-MDHelo: EUR05-VI1-obe.outbound.protection.outlook.com
X-MDArrival-Date: Wed, 22 Jan 2020 10:32:30 +0700
X-Rcpt-To: [email protected]
X-MDRcpt-To: [email protected]
X-Return-Path: [email protected]
X-Envelope-From: [email protected]
X-MDaemon-Deliver-To: [email protected]
X-CAV-Result: clean
ARC-Seal: i=1; a=rsa-sha256; s=arcselector9901; d=microsoft.com; cv=none;
 
b=k22X8jAOZ5x/l0cqlPNegNghpEiTGj9vXysLt0SRxzfpFgqBKfeFOTkvawbJnCT8eMDQpD5o+aO9TCQub5FbkP+hTtQ9eaoCVSM6DGwTdVBG38yNix7hH1Gha25itGPIB5HYd8BgnApH5ltiTiRMnpr9SiqklKUXkrlyw6rFWxvF4UxH3leCI2jnxjRcSWpMhIX2eMGHFPQmnhVKHi8nJ7ww/19TB6Z07ItbmG4/pyyzf79B1hAm+sLFpKGoLd322yZWVVvRTZVKico9WI6nhuQ/IvBPJb5DKev/kVWmjd/0+Qeu70nuN+5Sr+INY3e4Om6rM8M16gOLj7osMMrnlA==
ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com;
 s=arcselector9901;
 
h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck;
 bh=KIlC4Yc4V6tZ18AFrt9VDZqiouQ2c75k2k7zeyJCf3Q=;
 
b=P+hguKEj8wYgeSoxWB5aGZVslrIWcXf50tBBipfQQfZvUfqcE1a3Cm81aixg6iMjxCWCBVJ7k1MPf+xzKGp4TpcG7doDYbcs5Udud3nPc5VJ0qKXQYPeY7LL7/7axdLJRxF7rZrG+9a25xvGNxXbHwxbs4s7rMre8arj6MAs/egEqJJbKOUYdMTW1AHGZCMZv8wBmbJKc7AdbmkRtq5U00LavuNiQ2Ivc5ao55qwkbDWhSOXWzJGmrm8u148FsPiQcs73pgJdTgdmzvxqZ9LnzpvPwlHynicVLD7TiExvuWmrPxCFeqeo/smdUODOLZJ1/k1lKk+23hhztbN0v+5qw==
ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass
 smtp.mailfrom=sgs.com; dmarc=pass action=none header.from=sgs.com; dkim=pass
 header.d=sgs.com; arc=none
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=sgs.com; s=selector2;
 
h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck;
 bh=KIlC4Yc4V6tZ18AFrt9VDZqiouQ2c75k2k7zeyJCf3Q=;
 
b=jyHd3KHZ0PE0Nd9EtpzyWoAJDShA1PU+itI7ey4K2d7Zs5ZwmNTW9ASiZqgOxT8Qs8Xvb0qdkQZFsaO73vyKjS6rPS/NuyNbMaa1jFC/HMCG50stRbgNGXTicJXCfdcjiv0pIW6AW0i90V3vNXTXuLo56leV94/tHhoHT8btNY0=
Received: from VI1PR0502MB3085.eurprd05.prod.outlook.com (10.175.20.11) by
 VI1PR0502MB4078.eurprd05.prod.outlook.com (52.134.13.31) with Microsoft SMTP
 Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id
 15.20.2644.24; Wed, 22 Jan 2020 03:31:43 +0000
Received: from VI1PR0502MB3085.eurprd05.prod.outlook.com
 ([fe80::4892:7432:1143:35f6]) by VI1PR0502MB3085.eurprd05.prod.outlook.com
 ([fe80::4892:7432:1143:35f6%7]) with mapi id 15.20.2644.027; Wed, 22 Jan 2020
 03:31:43 +0000
From: "Alkatiri, Hanif (Jakarta) ([email protected])" 
<[email protected]>
To: "[email protected]" <[email protected]>, "[email protected]"
        <[email protected]>
CC: "Putri, Hanum (Jakarta)" <[email protected]>
Subject: Re  :New  Export Procedures/ Regulation to Middle East & Africa; PT
 Richtex MutiaraBusana
Thread-Topic: Re  :New  Export Procedures/ Regulation to Middle East & Africa;
 PT Richtex MutiaraBusana
Thread-Index: AdXQ1EM7izyf62TmQvWJa62Xj4HYJg==
Date: Wed, 22 Jan 2020 03:31:43 +0000
Message-ID:
 
<vi1pr0502mb30850d6cbb490c761b40a42a95...@vi1pr0502mb3085.eurprd05.prod.outlook.com>
Accept-Language: en-US
Content-Language: en-US
X-MS-Has-Attach: yes
X-MS-TNEF-Correlator:
authentication-results: spf=none (sender IP is )
 [email protected]; 
x-originating-ip: [165.225.112.210]
x-ms-publictraffictype: Email
x-ms-office365-filtering-correlation-id: 82df9aeb-14ee-4d7f-b160-08d79eeb9a0b
x-ms-traffictypediagnostic: VI1PR0502MB4078:
x-ms-exchange-transport-forked: True
x-microsoft-antispam-prvs:
 
<vi1pr0502mb4078c6e001d331165a7d454095...@vi1pr0502mb4078.eurprd05.prod.outlook.com>
x-ms-oob-tlc-oobclassifiers: OLM:5797;
x-forefront-prvs: 029097202E
x-forefront-antispam-report:
 
SFV:NSPM;SFS:(10019020)(4636009)(346002)(366004)(396003)(39860400002)(136003)(376002)(189003)(199004)(966005)(316002)(26005)(478600001)(66574012)(2906002)(81166006)(81156014)(66556008)(66446008)(110136005)(76116006)(4326008)(66576008)(8936002)(66946007)(450100002)(64756008)(66476007)(6506007)(71200400001)(86362001)(55236004)(8676002)(52536014)(186003)(5660300002)(33656002)(7696005)(55016002)(9686003);DIR:OUT;SFP:1102;SCL:1;SRVR:VI1PR0502MB4078;H:VI1PR0502MB3085.eurprd05.prod.outlook.com;FPR:;SPF:None;LANG:en;PTR:InfoNoRecords;MX:1;A:1;
received-spf: None (protection.outlook.com: sgs.com does not designate
 permitted sender hosts)
x-ms-exchange-senderadcheck: 1
x-microsoft-antispam: BCL:0;
x-microsoft-antispam-message-info:
 
pLalGBctG4CK4ngQoI9zZdJlYQIEYoFUV3+wUvXlR1iHZOMghFtIaL+lehGjCqKFSfRdEuCyj8V/9/kSRnKv3tgFcLxU6/S4TBOBxrSnCTppDK6NeV4W1+cSGg3NRpKiQY7ILImWGSUrWxKsweSCNjmw0EH3TcaUvTsEqi4bZwQqakKp4FkeKBRQsj8zBPIVY82JO9Jbi/gXjp4HIIdLYOn7v+84yEtwMi5+nMwduif8DdXXI9ezKDT+qZ9g7chdbNkHmYlAzXGhRmBSMq4FJHdE8Jvj0CFAyafLHYaCrsy1wbCGrmLGUz/u5HD4jHUmtUnxhV59EL5y8z05oDXqB314m/QaISyniP3f6AqMj72Wi8cyehJJXBlXWPywSriOwGJRtQMc6z0TAmhh7oo6+lorHSPD9pDp4Zk5PvyWX//EMYMSFHZym/IyqfE9wL1GDjKyhccYMA2uaFTLTm7qFoO+xpXTZDlWYWGfxW7WJyI=
Content-Type: multipart/mixed;
        boundary="_007_VI1PR0502MB30850D6CBB490C761B40A42A950C0VI1PR0502MB3085_"
MIME-Version: 1.0
X-OriginatorOrg: sgs.com
X-MS-Exchange-CrossTenant-Network-Message-Id: 
82df9aeb-14ee-4d7f-b160-08d79eeb9a0b
X-MS-Exchange-CrossTenant-originalarrivaltime: 22 Jan 2020 03:31:43.3256
 (UTC)
X-MS-Exchange-CrossTenant-fromentityheader: Hosted
X-MS-Exchange-CrossTenant-id: e96fa72b-c8d6-4957-96bd-c7f8dc30cc88
X-MS-Exchange-CrossTenant-mailboxtype: HOSTED
X-MS-Exchange-CrossTenant-userprincipalname: 
mQ3/3o49aZS20blDpUm6asupax6TOgeHVetX39FdBpQdoixXO/jcXPu0wtS5ILKUADhYpgL25rqk/frKTyeqnw==
X-MS-Exchange-Transport-CrossTenantHeadersStamped: VI1PR0502MB4078

Kirim email ke