OutlookUservoice_icon_outlook Outlook Feedback by UserVoice

Outlook.com

New feedback from Outlook.com

This is another example of Outlook.com filters/blocked senders that fail to delete or block designated sources. I will send you about 12 to help you identify how they are evading the filters and blocked senders. In the "To:" field, I have replaced my email address with the word "Removed".
For expedience, the headers are truncated after a certain point.
1)
Received: from CO1NAM03HT056.eop-NAM03.prod.protection.outlook.com
(2603:10b6:300:117::22) by BL0PR05MB5218.namprd05.prod.outlook.com with HTTPS
via MWHPR03CA0012.NAMPRD03.PROD.OUTLOOK.COM; Thu, 18 Oct 2018 13:08:52 +0000
Received: from CO1NAM03FT045.eop-NAM03.prod.protection.outlook.com
(10.152.80.55) by CO1NAM03HT056.eop-NAM03.prod.protection.outlook.com
(10.152.81.79) with Microsoft SMTP Server (version=TLS1_2,
cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.1250.12; Thu, 18 Oct
2018 13:08:51 +0000
Authentication-Results: spf=none (sender IP is 221.121.12.250)
smtp.mailfrom=esd-gmbh.de; hotmail.com; dkim=none (message not signed)
header.d=none;hotmail.com; dmarc=none action=none header.from=esd-gmbh.de;
Received-SPF: None (protection.outlook.com: esd-gmbh.de does not designate
permitted sender hosts)
Received: from localhost (221.121.12.250) by
CO1NAM03FT045.mail.protection.outlook.com (10.152.81.214) with Microsoft SMTP
Server id 15.20.1250.12 via Frontend Transport; Thu, 18 Oct 2018 13:08:50
+0000
X-IncomingTopHeaderMarker: OriginalChecksum:3F84E615D95DA27B21114190FBB9D516DC00BA088BBAD84611C21755978695B6;UpperCasedChecksum:4EC09AA224058CD93959D9834946A7B2DF2E248DBF641873529212C730AAFD50;SizeAsReceived:498;Count:13
Mound-Precautions-Complaining: 9658bd6842ed4df
To: Removed
Message-ID: <28bb1855.48cae72-9dfc@esd-gmbh.de>
Content-Transfer-Encoding: 7bit
Content-Type: text/html; charset="UTF-8"; format=flowed; delsp=yes
Atheism-Inker: thorn
Date: Fri, 19 Oct 2018 03:42:41 +0000
Enviousness-Salting: 749
Subject: Peaktolg, Security alert for your linked account ID 5545
Practicing-Appraisal: 1B9A175AD34D
Auto-Submitted: no
From: Accounts <deviouslyqfc@esd-gmbh.de>
X-IncomingHeaderCount: 13
Return-Path: deviouslyqfc@esd-gmbh.de
X-MS-Exchange-Organization-ExpirationStartTime: 18 Oct 2018 13:08:51.1151
(UTC)
X-MS-Exchange-Organization-ExpirationStartTimeReason: OriginalSubmit
X-MS-Exchange-Organization-ExpirationInterval: 2:00:00:00.0000000
X-MS-Exchange-Organization-ExpirationIntervalReason: OriginalSubmit
X-MS-Exchange-Organization-Network-Message-Id: c3cc7c5a-7f35-4d22-0412-08d634fad945
X-EOPAttributedMessage: 0
X-EOPTenantAttributedMessage: 84df9e7f-e9f6-40af-b435-aaaaaaaaaaaa:0
X-MS-Exchange-Organization-MessageDirectionality: Incoming
X-Microsoft-Exchange-Diagnostics: 1;CO1NAM03FT045;1:dA73coRXddZgN+2gP94r3d09P60DB0sa2oFep8BsZwXp2t35uxpYVvx1yZq4HafhY1WQ+hUiJyIEAxUG0FesesQR2n6q9UKPjIJKSerUhI8BHxm73YA+We5bRBSPV/cf
X-Forefront-Antispam-Report: EFV:NLI;
X-MS-Exchange-Organization-AuthSource:
CO1NAM03FT045.eop-NAM03.prod.protection.outlook.com
X-MS-Exchange-Organization-AuthAs: Anonymous
X-MS-PublicTrafficType: Email
X-MS-Office365-Filtering-Correlation-Id: c3cc7c5a-7f35-4d22-0412-08d634fad945
X-Microsoft-Antispam:
BCL:0;PCL:0;RULEID:(5000110)(711020)(4605076)(610169)(8291501071);SRVR:CO1NAM03HT056;
X-Microsoft-Exchange-Diagnostics:
1;CO1NAM03HT056;3:wZJt47nSL9QUEP5NJydVccL5w2yZVRUsNxHwSZYjAzc8Clre1YzLXwBvmCq99Y9DMzsIquxgYCJ59AFAFB82N9eyNnV+LlxE9yUuLWN4lgJEq1vWO4o4RwPN+aw6pyN2PaB47bGn9CFatyO8OTEGajv3hxCTA3f2GEzI64tshI7OEzjs//kgwZcYfOJjR34F6k60MwQ1G+ueRvd6aS+M5UJE8X8rytaXsZofcITzQ4Fp1t5cdcrI1nFWWUZG0OIi6CUFfU5RE+Qz7UudJDOjdfN75c16zp5XeCEegm/4C7TfBtVLAfxu+TrgzLNgEwcpFsU9OHwG68U+upRaAJ2c5g==;25:2VA5G1s0FEmPjxfsOaxmsbUbzibbFaQZM7imNh39RnA4+G6PONJbc7VYzVRZN2MXuZarxQdcA5V0xcfz6lz89gFlYYb0WeCo1vu+H0sswEqYX3OpU+8Zum5R9NakZxBwuhV14l7GDE4pBX2PDesX3a9aFMIt2L53ELm768JiLBNNLGJ4HUV7Ldhw1eNXMsJAPewZlahp6k0sy0IV1FQFf607R7T7mxpLj/f+6EF7tMkeFYNaYtjOXXCHlEe3CZ0qhzXU85doj1yESEwFRjxtr5KozwHn/egzTboQ8iB6za8Cm6vvu9bD0GRsTWFjmgxD50r+683OVib2DXFN7Exh4A==;31:JgkqW4xeI1iaPG8Ek7+Zg9QQgFK4ogn0WY4PwwD5wFyDX4SD4YQG7AEhkW/XMsvEyVLP8u394r5QT3dN4TppbTjqrF3GOA6JVNKy/Xs0IGQ5L9SWiiYydHGf8IIwCBogDrgjTJKiAjNOQ4O9O60a0mg9mf+R0uZAqD0IQrToafY+lg8+TVieaSMY6ItgsP0cJLxIaLwtnUXZbk6muRcsmUWdIVxsyw6QKfdlzfRaZDw=
X-MS-TrafficTypeDiagnostic: CO1NAM03HT056:
X-MS-Exchange-EOPDirect: true
X-Sender-IP: 221.121.12.250
X-SID-PRA: DEVIOUSLYQFC@ESD-GMBH.DE
X-SID-Result: NONE
X-MS-Exchange-Organization-PCL: 2
X-Exchange-Antispam-Report-Test:
UriScan:(192374486261705)(194151415913766)(71457273570760)(6911010853514);
X-Exchange-Antispam-Report-CFA-Test:
BCL:0;PCL:0;RULEID:(444111676)(1160499021)(52401380)(52601095)(52606095)(52602095)(52606095)(52602095)(52505095)(52406095)(52402095)(52303095)(52203095)(88862240)(88860193)(82015058);SRVR:CO1NAM03HT056;BCL:0;PCL:0;RULEID:;SRVR:CO1NAM03HT056;
X-Microsoft-Exchange-Diagnostics:
1;CO1NAM03HT056;4:vQOrINuWVLPlEqL+vyoGNWSHzlBAoTLMgLmGdfx5sRfh+E0uF9A4ru+QCnVZORobf2OkFz0HJHH9JBrSxSjRyPOdFyepPVa2IKgoK3W6sMkZsrOTwRGB+AxGE0Tq+bYMlpwtnAYE2iU6k/DTy4/zhoob5SFUmAnxJRw0T8kIOe0GOitqDX1J7nf3SEzX5C3/oErlvrJGraRgmVkYsZpgSfMftJNEvc5BRDzZDicVfgwakE8ko3+cTCc1WAolWr8yCK6sX+OedCe6DJI0VSabfvSlfbVPWHqgp0bnuq5DWiO0cEfBF04k4tg6Me/nUy2gzbbxBpEuVNtxX8VTfGAKLfxaLTuW0truX5647Z9CNxLvc4hEBwx7ia09IFvdNNYH8mZOug+7sr5w9Ggdj4MwFzBkVGZl5eC9XLsRbTQ3554=;6:AaKfXr6bIOnyVYGiPWESTQ5iiLRSaujSEzpncywK4uyCyA5bLkiJAQCkXvMLtaAA48rd3RtoO0HgnTwVjZh8FgxTT1xPt0XBD9GSl3PksF0jQMvfME4EoAmjhbveLoj9UNZrmq6AJPZ9K2fFJcnp+tPigZclTBpKb1+Vbsm/EFASY0mbPeBuFevQ6CAomSv/kcQLl1PQIDJRz2o4gbjICnV/YuVJsaieQoH09sNh0+uHqBpFrKwMgzw59n8caZsCCm1qrzdkPt388oYy0ahaPxOf2noFvfKXEj5SdojS2V92jF/XGVXeI/t/WNqCeqygnyXUDVACeb/mjjhKv1FNKq9c2I10ivXLdz3KS7j0P/8oILrX7lYsPsXcFPrKayGDL8JsXAK4H5lbw4jVcJ66XGEaNFafw5oih9L9U0aufhKiAwgytCHPlniArn3nNRPsqYp6YFPpbDTTne5AqOScPg==
X-Microsoft-Antispam-Message-Info:
4Co8BKw2N9ZsT7Rl7x/sq71yQ0rbRrVIWaXA0KCO4Pn2usJLNbaosrkg+2CtCk9EQY0vh9FPUahLdkJOs2C0FNWumk1X9e18anIHuOh1+lMQvgOlAJoGfeza5Xj8MNq1Y4CFF7w+V10LXEZeEoc2F0fl3r8zpXqJUkrk0pzmF6vsb2pXS8NRlYJy1liw11NI+OJFrrJSOjvjAJQ+ltc6tSxFyfpvXyiDegGX4gqyX+o9SlNdM/y5y8iSExfB5Pz7OM1YekbGLoVb134zDkyfdSrrDzX0ZSnX2qtv9tAEn4rU6+zC5lE3exIzbVwY6kmiNu2j6oWHHX+dOI4wdK2lpDii/VSYcBjZwwRn+fisB3FepslRP6UUaFILNv5S+xRdfy1OjPMXtE2+Jd/giBFZhzuCSEc2CTpneL9CQgV5T0SBGqwBTCyELb3SNVYsBSXvxbxgAQ3JM+woYwh4U/MbnR8Y5y770mkZjyXxK76VxIPyrWnbSTfdfVWn+v8CfdP4eZ12FEIfHaYQGCXJ6YPmXl3NWiRYZZx/HggbxHBPlug=
X-Microsoft-Exchange-Diagnostics:
1;CO1NAM03HT056;5:zZ2nKon1C76EzqmP/IexQrzJoO00Uh1I5DQvfCQrtxWtVXxH9pxUA2wAbM0wIPtw9lKUkTDH0SnnqIPuFBk+mq2xkILgXKgQuisxZ8a4YzwmfmnoNrwU8f4zjwDZmKcrVMeMXG8aXJEX7/CKggAp8Lp/8TDwwJ7m0vVDglWwOUE=;7:hIUUixZU/6+P7hk5uyNHWo2WZhm5wAjS/BWMWdApDUo/Qp/n3l0XxGk58BiIOxv9HS0QawASbJGOKbXLgXUCkUtTPFDitKZ1+ciShDulC1FtLGHnFYtGQAeD0kqy1AOCBEFHZVjZMgSFgOefZbuQhFFCNW1KQ6ocTXeYYa3zc5he9U0xnxLCIr+/XKwUOfsei6yNXeJ+wTfkhsE+RhRNMUryp/p2sEQ2JjuRAXrJqOp9Aq75CgQVsW8zrR7QVn2C
X-OriginatorOrg: outlook.com
X-MS-Exchange-CrossTenant-OriginalArrivalTime: 18 Oct 2018 13:08:50.4900
(UTC)
X-MS-Exchange-CrossTenant-Network-Message-Id: c3cc7c5a-7f35-4d22-0412-08d634fad945
X-MS-Exchange-CrossTenant-Id: 84df9e7f-e9f6-40af-b435-aaaaaaaaaaaa
X-MS-Exchange-CrossTenant-FromEntityHeader: Internet
X-MS-Exchange-CrossTenant-RMS-PersistedConsumerOrg:
24fd1209-d934-423e-a578-ee886993c07f
X-MS-Exchange-Transport-CrossTenantHeadersStamped: CO1NAM03HT056
X-MS-Exchange-Transport-EndToEndLatency: 00:00:01.7487984
X-MS-Exchange-Processed-By-BccFoldering: 15.20.1250.004

8 votes
Vote
Sign in
(thinking…)
Sign in with: facebook google
Signed in as (Sign out)
You have left! (?) (thinking…)
thomas sheehan shared this idea  ·   ·  Flag idea as inappropriate…  ·  Admin →

Hey there!

Thank you for using Outlook.com and reaching out to us regarding your recent experience.

Currently, this channel is dedicated to feedback requests only, but we recently added in-app support to assist you with your questions and concerns.

To contact in-app support please use the following steps:

Sign into your email account on any web browser on a pc or Mac, www.outlook.com .

Click the ? in the top menu bar to open the Help pane.

Click on the Help link toward the bottom of the pane to open the Contact Support box.

We look forward to assisting you there!

All the best

The Outlook Team

PS: Please use the Help Section of the app for any questions, we are not able to see replies to this address.

10 comments

Sign in
(thinking…)
Sign in with: facebook google
Signed in as (Sign out)
Submitting...
  • thomas sheehan commented  ·   ·  Flag as inappropriate

    Failing filters, example 12, Last sample:

    Received: from SN1NAM01HT073.eop-nam01.prod.protection.outlook.com
    (2603:10b6:403:2::32) by BL0PR05MB5218.namprd05.prod.outlook.com with HTTPS
    via BN4PR12CA0022.NAMPRD12.PROD.OUTLOOK.COM; Fri, 5 Oct 2018 04:15:29 +0000
    Received: from SN1NAM01FT051.eop-nam01.prod.protection.outlook.com
    (10.152.64.58) by SN1NAM01HT073.eop-nam01.prod.protection.outlook.com
    (10.152.64.240) with Microsoft SMTP Server (version=TLS1_2,
    cipher=TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384) id 15.20.1185.13; Fri, 5 Oct
    2018 04:15:25 +0000
    Authentication-Results: spf=softfail (sender IP is 162.144.140.131)
    smtp.mailfrom=shorcan.com; hotmail.com; dkim=none (message not signed)
    header.d=none;hotmail.com; dmarc=none action=none header.from=shorcan.com;
    Received-SPF: SoftFail (protection.outlook.com: domain of transitioning
    shorcan.com discourages use of 162.144.140.131 as permitted sender)
    Received: from server.calasanzvirtual.com (162.144.140.131) by
    SN1NAM01FT051.mail.protection.outlook.com (10.152.64.150) with Microsoft SMTP
    Server id 15.20.1185.13 via Frontend Transport; Fri, 5 Oct 2018 04:15:25
    +0000
    X-IncomingTopHeaderMarker: OriginalChecksum:879BDE1FC1B608DBCF6E26C8BDFE0E245970980EC589ED356F4C2288DFCAC983;UpperCasedChecksum:8DC52D0BB39CA2C4082AD2EE5FBD45844FEB83B2AE6247838092C09CD12E9DF9;SizeAsReceived:976;Count:17
    X-LinkedIn-fbl: b172817d6744bb825ff1352de9d1e55aaa36f7378b6b2fa26a9baa
    X-LinkedIn-Id: b9fd96511cfbb8cbfe5fa959f7f22
    Content-Transfer-Encoding: 7bit
    X-LinkedIn-Class: EMAIL-DEFAULT
    Subject: You appeared in 5 search this week
    List-Unsubscribe: <https://www.linkedin.com/e/v2?e=aead39f13d75&t=lun&midToken=4d7754ce3b&ek=email_notification_single_search_appearance_05&li=7&m=unsub&ts=unsub&loid=46b347d6c2985e8c213a6e371c5b9741d9d29512642beb8d17e9952aac131b26>
    Message-ID: <a8728-7e692713138f@shorcan.com>
    X-LinkedIn-Template: email_notification_single_search_appearance_05
    To: Removed
    Feedback-ID: email_notification_single_search_appearance_05:linkedin
    Serif-Faults: universals
    From: LinkedIn <eludex0@shorcan.com>
    Content-Type: text/html; charset="UTF-8"
    Content-ID: html-body
    Require-Recipient-Valid-Since: peaktolg@hotmail.com; Fri, 5 Oct 2018 04:15:24 +0000
    Date: Fri, 5 Oct 2018 04:15:24 +0000
    X-IncomingHeaderCount: 17
    Return-Path: eludex0@shorcan.com
    X-MS-Exchange-Organization-ExpirationStartTime: 05 Oct 2018 04:15:25.5780
    (UTC)
    X-MS-Exchange-Organization-ExpirationStartTimeReason: Original Submit
    X-MS-Exchange-Organization-ExpirationInterval: 2:00:00:00.0000000
    X-MS-Exchange-Organization-ExpirationIntervalReason: Original Submit
    X-MS-Exchange-Organization-Network-Message-Id: 6faf4281-6461-495b-e07a-08d62a792d1c
    X-EOPAttributedMessage: 0
    X-EOPTenantAttributedMessage: 84df9e7f-e9f6-40af-b435-aaaaaaaaaaaa:0
    X-MS-Exchange-Organization-MessageDirectionality: Incoming
    X-Microsoft-Exchange-Diagnostics: 1;SN1NAM01FT051;1:Q+TxaTDV9XmnYz6j03VyB5xIHSUK9cga3+Ip2863u8Y+mJg66CWw+RQnyqHYsJxVcEGRlCyvqwRFICDUWmJrslMeAYxL1g+we7/SxiKjwZ0rxO2lS8RbUPSnczoqYGSP
    X-Forefront-Antispam-Report: EFV:NLI;
    X-MS-Exchange-Organization-AuthSource:
    SN1NAM01FT051.eop-nam01.prod.protection.outlook.com
    X-MS-Exchange-Organization-AuthAs: Anonymous
    X-MS-PublicTrafficType: Email
    X-MS-Office365-Filtering-Correlation-Id: 6faf4281-6461-495b-e07a-08d62a792d1c
    X-Microsoft-Antispam:
    BCL:0;PCL:0;RULEID:(5000110)(711020)(4605076)(610169)(630170)(8291501071);SRVR:SN1NAM01HT073;
    X-Microsoft-Exchange-Diagnostics:
    1;SN1NAM01HT073;3:vFGNhuQkWHOlHKuq9YGrvvTgQRYkvKoK2zk/PrUWqTgxV0CiPDpGdtN4seMHL2MHuS3Aw5InM5MXvG0yOf9PwJwd4cT7WrBfomFfRchXLrkUYXo1xe9y1Potwb9AsDcH6iI/kiWgCD9kz8YzlmGoI26lEw6HdAVXIdYkU4IupIu4LQnaTCZ+YI92biiBOTj3d1VQpt2GqpRWK5xDHsa+o2ZCDpoDJAQL7qUE+vxdmGVGU4c2MYmTMthypnA+McSjBXF+N+Ja/gvLeR2QZTCOkq5aMpJRyYqQqeVdipVlJWXVugAAVSG05cLB6WGug+jy;25:Nfnl+0NaSfIlXe6vP+KsSfoFBRC6eIrHYjQvW0cv8yvC4KDuOoX1f+VuOaQ8E1ev81gs4xGWQ9gNyWVqs7HIZGNRZsI1sPahl/vcCkUjIBWAnBhafcQP5d4jJzdyCg6BvJlKqMow/U+0TXnjBlvmLegOVyx5kch0mJHFeVbYseKMGhZEUsF0DRMJVEZeMMPGIO2hAErRusaK+LFapFTQezjEK4Lb8BOhD2PCJi2TY5U3UEPBs0OM5U6lbztYVFVYeLiPO+r4kUzfvrXrtTJXT35EmE9oFCDUiQ90OX7YNd+A1HcsABODK7dAYSYe04V8xJhMemkc+rCt5qFSNkl3JA==;31:4UAhXFnxhUVFUEJuzNWXWJjvMiEP4ivsroe4cpf3bBf/WSVMU94Fr8tZuJGQOZdWMZW4XEzZpN09BK8f7Xq419AezSB157N5yRrG1fG7DIA8y9fZ8Do9f0iL738+v8zNjSfTIbeUw3unc4Aj1AZ6ZsBbza+7Z2j5obzWOk5IRMqgVCChpKiq1dPwsLApl6r+8P0bVnB0swPw52zscmS0VKsWHpx7MjOc1bs9fc6EMQs=
    X-MS-TrafficTypeDiagnostic: SN1NAM01HT073:
    X-MS-Exchange-EOPDirect: true
    X-Sender-IP: 162.144.140.131
    X-SID-PRA: ELUDEX0@SHORCAN.COM
    X-SID-Result: FAIL
    X-MS-Exchange-Organization-PCL: 2
    X-Exchange-Antispam-Report-Test:
    UriScan:(194151415913766)(116415991822766)(190501279198761)(227612066756510)(240632212295403)(24487441151036);
    X-Exchange-Antispam-Report-CFA-Test:
    BCL:0;PCL:0;RULEID:(444111676)(2750499021)(52401380)(52601095)(52606095)(52605095)(52606095)(52605095)(52606095)(52605095)(52606095)(52605095)(52606095)(52605095)(52606095)(52605095)(52606095)(52605095)(52606095)(52605095)(52505095)(52504095)(5240

  • thomas sheehan commented  ·   ·  Flag as inappropriate

    Failing filters, example 11)

    Received: from SN1NAM01HT065.eop-nam01.prod.protection.outlook.com
    (2603:10b6:207:3d::42) by BL0PR05MB5218.namprd05.prod.outlook.com with HTTPS
    via BL0PR02CA0065.NAMPRD02.PROD.OUTLOOK.COM; Sat, 13 Oct 2018 18:40:56 +0000
    Received: from SN1NAM01FT027.eop-nam01.prod.protection.outlook.com
    (10.152.64.53) by SN1NAM01HT065.eop-nam01.prod.protection.outlook.com
    (10.152.64.177) with Microsoft SMTP Server (version=TLS1_2,
    cipher=TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384) id 15.20.1250.12; Sat, 13 Oct
    2018 18:40:55 +0000
    Authentication-Results: spf=fail (sender IP is 212.230.255.161)
    smtp.mailfrom=snolab.ca; hotmail.com; dkim=none (message not signed)
    header.d=none;hotmail.com; dmarc=none action=none header.from=snolab.ca;
    Received-SPF: Fail (protection.outlook.com: domain of snolab.ca does not
    designate 212.230.255.161 as permitted sender)
    receiver=protection.outlook.com; client-ip=212.230.255.161; helo=localhost;
    Received: from localhost (212.230.255.161) by
    SN1NAM01FT027.mail.protection.outlook.com (10.152.65.58) with Microsoft SMTP
    Server id 15.20.1250.12 via Frontend Transport; Sat, 13 Oct 2018 18:40:54
    +0000
    X-IncomingTopHeaderMarker: OriginalChecksum:CA52685198D7DF4E294E51800477C29F8527054C08D4685214B62417D51A3D9E;UpperCasedChecksum:272A472AC5304129C80ACA4FC5CED9EB98C818737EF8A49022AAD099E6387728;SizeAsReceived:569;Count:14
    From: Accounts <gshayer@snolab.ca>
    Sympathized-Longs: 84654
    Subject: Peaktolg, Critical security alert for your linked account ID 69718
    Message-ID: <89a2f8cab-2be749eb@snolab.ca>
    Contradistinction-Trapped-Corporal: fc197645b74b463
    Drove-Wheat: 8DB7E36CEB94927B
    Disowned-Timesharing-Gnawing: thanklessly
    Date: Sat, 13 Oct 2018 20:41:13 +0000
    To: Removed
    Content-Transfer-Encoding: 7bit
    Errors-To: upgqznbkjqm@snolab.ca
    Supposed-Inevitabilities-Arisings: 5
    Content-Type: text/html; charset="UTF-8"; format=flowed; delsp=yes
    X-IncomingHeaderCount: 14
    Return-Path: gshayer@snolab.ca
    X-MS-Exchange-Organization-ExpirationStartTime: 13 Oct 2018 18:40:54.9501
    (UTC)
    X-MS-Exchange-Organization-ExpirationStartTimeReason: OriginalSubmit
    X-MS-Exchange-Organization-ExpirationInterval: 2:00:00:00.0000000
    X-MS-Exchange-Organization-ExpirationIntervalReason: OriginalSubmit
    X-MS-Exchange-Organization-Network-Message-Id: 8c7e8bfc-5af7-4fff-3a93-08d6313b68bc
    X-EOPAttributedMessage: 0
    X-EOPTenantAttributedMessage: 84df9e7f-e9f6-40af-b435-aaaaaaaaaaaa:0
    X-MS-Exchange-Organization-MessageDirectionality: Incoming
    X-Microsoft-Exchange-Diagnostics: 1;SN1NAM01FT027;1:XDPq3HfAvdli/5ojBWmo7dyijcXCBLI3brcXmgB6tRUj6BpxDGbFmfRt9g7+Wx+rOXbOM2j9cLzV3PLx9sHHMWQTKEPiT+55Z02BuBOx0MQqf0EAclCaO/LnKQ3EpQMR
    X-Forefront-Antispam-Report: EFV:NLI;
    X-MS-Exchange-Organization-AuthSource:
    SN1NAM01FT027.eop-nam01.prod.protection.outlook.com
    X-MS-Exchange-Organization-AuthAs: Anonymous
    X-MS-PublicTrafficType: Email
    X-MS-Office365-Filtering-Correlation-Id: 8c7e8bfc-5af7-4fff-3a93-08d6313b68bc
    X-Microsoft-Antispam:
    BCL:0;PCL:0;RULEID:(5000110)(711020)(4605076)(610169)(630170)(8291501071);SRVR:SN1NAM01HT065;
    X-Microsoft-Exchange-Diagnostics:
    1;SN1NAM01HT065;3:bN586HRCA1SXLuSbJk4fwt6K1IlEfZ6VGzat6ZZKBdiR3nRcRZ1il1YrjLlZJnMVfonRL2pDX1sHvl1IOEGdJ74SK1I7rCOamJKphJeuJqzTwm4zLRWbyG5VBPfSlYf+ezE67+eQx9Vhyh3rWJrxYOqvdR0Kdls+be7lGRx4RpHQiVd6VQX65mkI0nwsJ4cd/iB8oAN+OHdluOCIn5DP7jL5GEcsMJnQgFLc2E9SA6JSCuClMP/f6BAeyF83nbYAP8pGDug7LyNqKcaFQi3IGwcw/qEB4EmjYl8WJn4RYIyYL2GzaPoy/VjgaepwSARKP9Z1DLfuc8aiU11bUgin/A==;25:l+l1dJZlUDCsvwjNDkH/x0AC0dhcqA788RhHKPEJpoFKUzGZPAnTdLik3AbfzNmhRO9/qbfRF6VJyf9A83xbZBSA2UwxM6MpnXMBqR04buCO32yqQyTqscjTgu9BK8bJ+E3L/boORh9NjZKtvrTAFXreEv5LFvdD/txrQR9l8skbtX4/JCugdKIP2qTjwtllzadTP4LIgd5iUpc3C/rysbi4mdjgt7forFBnAfovwLhwmd1EPyTDDWQ6F517Mt3LkETLKEIA/DBwXhJBc4V6dP3PDQg4xTYg4lGh8RGQz7YMgYZsXcLgbHahHSw+l4ElXfX/6+SzO6FbclzCSN5eJA==;31:s9XVBurHtc5kdrk7EVW2tLgFc9jtzCtuGiV65zzvWsspsN9M+4yl0LKURh0vfmmthJCBq3epb4FmV02eW0h8uHanJYp1FwkvmpWtujUO68oV31WxRRALfTu05Z7huMeF+TesV4Trui4CUJoTooujgkRjTpYIvF4Kchp4kL21M4cnVmnWhe4o6DHzmuM0tA4gK8CGp641FmFxF/OMXuxMLWVgVWbBOpfeUNH8oWBOGHc=
    X-MS-TrafficTypeDiagnostic: SN1NAM01HT065:
    X-MS-Exchange-EOPDirect: true
    X-Sender-IP: 212.230.255.161
    X-SID-PRA: GSHAYER@SNOLAB.CA
    X-SID-Result: FAIL
    X-MS-Exchange-Organization-PCL: 8
    X-Exchange-Antispam-Report-Test:
    UriScan:(192374486261705)(194151415913766)(71457273570760)(6911010853514)(140577242042927);
    X-Exchange-Antispam-Report-CFA-Test:
    BCL:0;PCL:8;RULEID:(444111676)(1160499021)(2220353)(52401380)(52601095)(52606095)(52602095)(52606095)(52602095)(52505095)(52406095)(52402095)(52303095)(52206095)(88862240)(88860193)(82015058);SRVR:SN1NAM01HT065;BCL:0;PCL:8;RULEID:;SRVR:SN1NAM01HT065;
    X-Microsoft-Exchange-Diagnostics:
    =?utf-8?B?MTtTTjFOQU0wMUhUMDY1OzQ6WnFoQm80V3lsaS95NlRCekNXNks1SU9iMTdX?=
    =?utf-8?B?TDZydkI4M1BaVXNBQllVSm5xWjNRcjB5b0xwbXBsLzhpUGxXWHJJM1Uvd1pE?=
    =?utf-8?B?d3cyTW53UXJpZnBueFVvM09jTHFFY1ZrcjJiZG5BdnlFSUJObVUzeERZN0dR?=
    =?utf-8?B?eGN5bmVZZWNDQWNtdm4vVUdJYWJ4QTRwRDloR2F6R0x5VFplZ3VaQ2x6WWlt?=
    =?utf-8?B?a2hBM3pmZ

  • thomas sheehan commented  ·   ·  Flag as inappropriate

    Failing filters, example 10)
    Received: from SN1NAM02HT253.eop-nam02.prod.protection.outlook.com
    (2603:10b6:207:18::43) by BL0PR05MB5218.namprd05.prod.outlook.com with HTTPS
    via BL0PR0102CA0030.PROD.EXCHANGELABS.COM; Mon, 15 Oct 2018 05:07:51 +0000
    Received: from SN1NAM02FT057.eop-nam02.prod.protection.outlook.com
    (10.152.72.57) by SN1NAM02HT253.eop-nam02.prod.protection.outlook.com
    (10.152.73.84) with Microsoft SMTP Server (version=TLS1_2,
    cipher=TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384) id 15.20.1250.11; Mon, 15 Oct
    2018 05:07:49 +0000
    Authentication-Results: spf=none (sender IP is 103.215.136.13)
    smtp.mailfrom=fogdata.se; hotmail.com; dkim=none (message not signed)
    header.d=none;hotmail.com; dmarc=none action=none header.from=fogdata.se;
    Received-SPF: None (protection.outlook.com: fogdata.se does not designate
    permitted sender hosts)
    Received: from web13.flexidomain.com (103.215.136.13) by
    SN1NAM02FT057.mail.protection.outlook.com (10.152.73.105) with Microsoft SMTP
    Server id 15.20.1250.11 via Frontend Transport; Mon, 15 Oct 2018 05:07:48
    +0000
    X-IncomingTopHeaderMarker: OriginalChecksum:58581C91849D620DA28B5D342F921CEE29E7B3FC81D52DA69A9DA728C4261757;UpperCasedChecksum:87B402633526F44A4E358832E851FF53102138897DC5E3E4A1ABDC4C8F4FCDD8;SizeAsReceived:530;Count:14
    Message-ID: <e215b_e8a9a_c45eefc@fogdata.se>
    X-PHP-Originating-Script: 1692:balancers.php
    Subject: Returned email message (Removed)
    Stationing-Revels: 98f9de14f5
    Ring-Corn: chassis
    Content-Transfer-Encoding: 7bit
    To: Removed
    Date: Mon, 15 Oct 2018 13:07:44 +0000
    Ailments-Multiplications-Woonsocket: 287
    From: GoogleSupport <fe28.vitamin90.jeca@fogdata.se>
    Unjustly-Ski-Bridged: 47
    Content-Type: text/html; charset="UTF-8"
    Errors-To: isfopedkelsbhfg@fogdata.se
    X-IncomingHeaderCount: 14
    Return-Path: fe28.vitamin90.jeca@fogdata.se
    X-MS-Exchange-Organization-ExpirationStartTime: 15 Oct 2018 05:07:49.6684
    (UTC)
    X-MS-Exchange-Organization-ExpirationStartTimeReason: OriginalSubmit
    X-MS-Exchange-Organization-ExpirationInterval: 2:00:00:00.0000000
    X-MS-Exchange-Organization-ExpirationIntervalReason: OriginalSubmit
    X-MS-Exchange-Organization-Network-Message-Id: bad9e879-ba6a-439a-7f2a-08d6325c2744
    X-EOPAttributedMessage: 0
    X-EOPTenantAttributedMessage: 84df9e7f-e9f6-40af-b435-aaaaaaaaaaaa:0
    X-MS-Exchange-Organization-MessageDirectionality: Incoming
    X-Microsoft-Exchange-Diagnostics: 1;SN1NAM02FT057;1:HKsO4zINQuEhwdFkhme0VusDfLV2/11PWGdtQz3jl6v7uaBeY4AqivBhBH0jIx29MBDT6pNzrFfarscaEVEUpNSpT+NEZW0DS25U8KiTd1+oF2SzUo6XPde4FYuh8J41
    X-Forefront-Antispam-Report: EFV:NLI;
    X-MS-Exchange-Organization-AuthSource:
    SN1NAM02FT057.eop-nam02.prod.protection.outlook.com
    X-MS-Exchange-Organization-AuthAs: Anonymous
    X-MS-PublicTrafficType: Email
    X-MS-Office365-Filtering-Correlation-Id: bad9e879-ba6a-439a-7f2a-08d6325c2744
    X-Microsoft-Antispam:
    BCL:0;PCL:0;RULEID:(5000110)(711020)(4605076)(610169)(8291501071);SRVR:SN1NAM02HT253;
    X-Microsoft-Exchange-Diagnostics:
    1;SN1NAM02HT253;3:wwEokiDzpNyt3dUS8GVF9uiL8YWgoukjBLkc7wzi9oFxTIY5bCRKWlWHkr3mjCZyv10NKmF9uRNVZJJ6YwHYl7sEwe4gHo7m5kiE/PtJb1AqKqxFcYVzgl5ikLzv4awPzE79DDNImu2EHGx8o+l0WRRpqi0OTVsVnQkfZcUs9Amh4Gv5Q6nA89ADM+KLtBi1AX0tbtmSw28ncGF6rQFriwELFyDBOSt0q7CW8OEhE678qmLWIBaqRgynOwOUhFAt5wa/i/OXQnyzgzuI7UMAIew6RL6tm2UYyO4h7Kxprx9SxOPYVfF2nPyTKCssHGP9cRLJOrex20q5Fi5PXQtUng==;25:4Ao9+/cQoK3OF0HWqUnTIkUqO49bY5ier+aM/AJj1Lz0pNxIGmn9zvdhChk8yofL+dP99ep5e0+46APAfHMts6tSz4AmvNG8ozreWYkpqm7E+4rqd58Yd5czcKDLILw1ZrNUXZ2CeEjeWFBgI5IG4OieENsiSDHm8k57KgmsyBudDAxxkKaodpUl7B7H0bkA0IWouRExykRoCBZ/XyL4gFhjOFSgwX27VfDCxEUIEo0CIVPzoJcfZ0sPcOEflyj/R6NnaLPlNSmDmL+Vgtbue5KqznrFm6KQAEDH5G89/ws7GYX+Xjs+Orvc5rONJTgCfvvRtvsJlfBo1Azmudt6Sw==;31:FDWdBTOOH3cI7HRIbsEVm38ps1CVCLHe65CHNvy/paLfnqeRdwwwRLPPXaPhUIXflS4sE7n7PoN3vMipglVf2WJhue6zY/7mD9tN1imgzgHpWyRslwjW+TlZ4kQMEE9vaMywEfzzkzbspyQBpJTsJh1GL81fV0Tl4sC3lgFafPtps6M3hSNQdkzXQYmNI65/jkT3eqqZe0TaxWfJhJdu/3Hj4hT9/1PGcghYsXyKshg=
    X-MS-TrafficTypeDiagnostic: SN1NAM02HT253:
    X-MS-Exchange-EOPDirect: true
    X-Sender-IP: 103.215.136.13
    X-SID-PRA: FE28.VITAMIN90.JECA@FOGDATA.SE
    X-SID-Result: NONE
    X-MS-Exchange-Organization-PCL: 8
    X-Exchange-Antispam-Report-Test: UriScan:(163750095850)(69424030613257);
    X-Exchange-Antispam-Report-CFA-Test:
    BCL:0;PCL:8;RULEID:(444111676)(2220353)(52401380)(52601095)(52606095)(52602095)(52606095)(52602095)(52606095)(52602095)(52505095)(52504095)(52406095)(52402095)(52305095)(52206095)(88862240)(88860193)(82015058);SRVR:SN1NAM02HT253;BCL:0;PCL:8;RULEID:;SRVR:SN1NAM02HT253;
    X-Microsoft-Exchange-Diagnostics:
    1;SN1NAM02HT253;4:AZH56ohqP9lcdZJ//CQbCA2mIGGY3uz/4Ufb6JrGa2afSAj+8tv0Q8kmhy5yReiAcmUCv7Og2T5Sdm4ah8mKtYxwxm9XTygE9XMWJYS16vtkCJB/Em8ki3Dj/HFcQJz9ScXOBtsFtZbYEhzZS57MQajIN/Wqq0mgE9wNusZxf3NTOD0wI53avU6IwE2RwdWoVqzyGabMYQWKu0/BP/Oi0+sgupH5q3Q16j7MqmHy18ajsTJ0j7GoF6N+Yhg0hl+1PCPXMlLIYVX9uGLYNjonRbd0lvx9pjIYNuxWxjHo6ibvZv+PyyLjGaNyJDH8MaBHc5NSnlE0YvQ2FJvOvbX9nMVVsQKR61L5D1ov19vBv0s=;6:85A21/Cym46IWVTmlGPuK+DMmBy7KghJFHton78sDG1T/IalJHV+IgKhQhaJpnQYUoQiz5liNA+3fUVyidUp7UpCHP5C/yM1Dte

  • thomas sheehan commented  ·   ·  Flag as inappropriate

    Failing filters, example 9)
    Received: from AM5EUR02HT047.eop-EUR02.prod.protection.outlook.com
    (2603:10b6:405:15::19) by BL0PR05MB5218.namprd05.prod.outlook.com with HTTPS
    via BN6PR1701CA0009.NAMPRD17.PROD.OUTLOOK.COM; Tue, 16 Oct 2018 09:59:50
    +0000
    Received: from AM5EUR02FT059.eop-EUR02.prod.protection.outlook.com
    (10.152.8.56) by AM5EUR02HT047.eop-EUR02.prod.protection.outlook.com
    (10.152.9.96) with Microsoft SMTP Server (version=TLS1_2,
    cipher=TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384) id 15.20.1228.17; Tue, 16 Oct
    2018 09:59:49 +0000
    Authentication-Results: spf=none (sender IP is 85.214.29.50)
    smtp.mailfrom=inoxmare.it; hotmail.com; dkim=none (message not signed)
    header.d=none;hotmail.com; dmarc=none action=none header.from=inoxmare.it;
    Received-SPF: None (protection.outlook.com: inoxmare.it does not designate
    permitted sender hosts)
    Received: from h2016842.stratoserver.net (85.214.29.50) by
    AM5EUR02FT059.mail.protection.outlook.com (10.152.9.204) with Microsoft SMTP
    Server id 15.20.1250.18 via Frontend Transport; Tue, 16 Oct 2018 09:59:49
    +0000
    X-IncomingTopHeaderMarker: OriginalChecksum:374FF0607A504827DFABD31FDDEA14A56D64EAC88527AA3094ED28CD30B2549A;UpperCasedChecksum:CD0556B099BF0C952356B18930BCAD0EB48D330D221E6C1594D2463D04F4CFDA;SizeAsReceived:366;Count:9
    Date: Tue, 16 Oct 2018 11:59:49 +0000
    Content-Type: text/html; charset="UTF-8"
    From: Chris Skaggs Support <alducci@inoxmare.it>
    Beguiles-Expansible-Malt: 7FFA9959F
    To: Removed
    Content-Transfer-Encoding: 7bit
    Message-ID: <d74dcd95.132c82b1.9625147147684@h2016842.stratoserver.net>
    Subject: You have private messages
    X-IncomingHeaderCount: 9
    Return-Path: alducci@inoxmare.it
    X-MS-Exchange-Organization-ExpirationStartTime: 16 Oct 2018 09:59:49.5333
    (UTC)
    X-MS-Exchange-Organization-ExpirationStartTimeReason: OriginalSubmit
    X-MS-Exchange-Organization-ExpirationInterval: 2:00:00:00.0000000
    X-MS-Exchange-Organization-ExpirationIntervalReason: OriginalSubmit
    X-MS-Exchange-Organization-Network-Message-Id: d912329c-70b5-4b43-7a08-08d6334e1c55
    X-EOPAttributedMessage: 0
    X-EOPTenantAttributedMessage: 84df9e7f-e9f6-40af-b435-aaaaaaaaaaaa:0
    X-MS-Exchange-Organization-MessageDirectionality: Incoming
    X-Microsoft-Exchange-Diagnostics: 1;AM5EUR02FT059;1:20vViReewPf5wkCkOzHfzQ41zb1RQ5PKxFAM8hkKTLATfRzg+yBM+jrEFc+Kr5fPpRr2U+bIbPJuxR2d1VEWpLy5a+R/Bd6jFcVk3RbGFtomyZ+G0kIy9Hmhakdd2WYF
    X-Forefront-Antispam-Report: EFV:NLI;
    X-MS-Exchange-Organization-AuthSource:
    AM5EUR02FT059.eop-EUR02.prod.protection.outlook.com
    X-MS-Exchange-Organization-AuthAs: Anonymous
    X-MS-PublicTrafficType: Email
    X-MS-Office365-Filtering-Correlation-Id: d912329c-70b5-4b43-7a08-08d6334e1c55
    X-Microsoft-Antispam:
    BCL:0;PCL:0;RULEID:(5000110)(711020)(4605076)(610169)(8291501071);SRVR:AM5EUR02HT047;
    X-Microsoft-Exchange-Diagnostics:
    1;AM5EUR02HT047;3:c1iDjOnPV6FcUOi6s6Jrnepq/squr3I+wgl80yQpXURvu2CMyavrXYUrLcqiOvxyhqIdKecYCzGP2wrdTxoHB9JzpV7mECuVCsNecRm3+8GP1ApnKKIHPs6WdjT/j38X3WXC15Jl5v6d3t0Xovxjcr4ZNkPcFHyQi1rF67MKkgXBbA0jHQz3dbqeOyeB8+c6TPYtssZfPWfPIO6xZBdPdghihv8uBAj/V0ICqCOxHzk0lLfqJWXhVvKk2GHJiDtM39/+VazJC9Btzzw1lpWbla3ZI1AuAjnaUSfMfntaU9BTA0cKF2mz20qZOK5dn/SwUvVyT3zzrvcXEwYSkNpAyA==;25:rlT9Ofhv290DK0kx67EO+f3ULw1dYCGa1+QmPCQ2t3d4pabsjg6+92NYH225hBxwCMuSAvy9eAkl8hAiHnE9vMJ/FydCtMdNyLWL3ikjYvzjkb8Qm2e6tXP9AVLTMduHdRuTij+ZlMS/UR//oa3e0DITzCkpZDf7nQPPyylqTDYPpeLki76qb+WwSDkTdyE2mwPK2AFrsWVWER1a8gS7won7PokNE+YegNUcExFEp3f9jL94o7FbTG8TlIvvTKeLSUEhrcomJdd38Ts2zf9SGAQnbj36zIJ4Vj24jKj7icu7Y0UV0lDU9vOrYP583PdTD7tHFjbWZJ8oanXCjdtE/Q==;31:egoDcj9S/p7AkzkYEg7219bfLzTsVBiSl7adgsOtRUaISwPIusFoV1UuTyfmEU+SqT21kJ0QhWX7MDmbQoT5nkpuvQxp+g2ZiwgGI5lfmvjVQ4GD/GUCk00jDj3v4e+tFT0AGXVUWtnPMAXEjstDXZIKVCXkkiigIRN+memaXupG2HbtwljqWlaMQhy+YeZY56KZ54B7ihc9epOmhqlk3obW0lS/6htM69Aj10UzSRs=
    X-MS-TrafficTypeDiagnostic: AM5EUR02HT047:
    X-MS-Exchange-EOPDirect: true
    X-Sender-IP: 85.214.29.50
    X-SID-PRA: ALDUCCI@INOXMARE.IT
    X-SID-Result: NONE
    X-MS-Exchange-Organization-PCL: 8
    X-Exchange-Antispam-Report-Test:
    UriScan:(194151415913766)(135811390041837)(38223240042209);
    X-Exchange-Antispam-Report-CFA-Test:
    BCL:0;PCL:8;RULEID:(444111676)(1160499021)(2220353)(52401380)(52601095)(52606095)(52606095)(52606095)(52606095)(52505095)(52406095)(52303095)(52206095)(88862240)(88860193)(82015058);SRVR:AM5EUR02HT047;BCL:0;PCL:8;RULEID:;SRVR:AM5EUR02HT047;
    X-Microsoft-Exchange-Diagnostics:
    1;AM5EUR02HT047;4:mX5+j6xzzcH+eM6qja+3Ntaqqhu8LmxW8LbE5uuX4OEp8ceobFxsC/NLO0jnLRkkaw1+WGQavn+hpbvARsI7TmY+MYF2QOakTOmoHZdNnBaxhVge35CmJ7Tn25SbcFolgZgcihCQnRK769M/wRvDbPedl2kUSzySviPeLHE/BV5BrvkJ1VbmH+8/XWBfJFnpYsVksFWdENOwFqX/itKbiGafcgBHjyTBAas0JrpwFy6mLzJ4/5zRdgJTX4vXBV16LSblilbiOCMAHfJ8OW9My0jIGeG/9YQ47hatSeG59UjDYGKhid6O4xNBEh3kBk1Fxy4lAGYfYjsmdund6Z/JaPBLbT7npJY/53dWVb9WlBuvzzBMZ0J2OYgY9SuobaO2;6:oHEPeCsVpkoOAo9Fn+Q1HUNFpCX1OGFQhHm3cL7SW22t4Pfp8+59pZhQzUmiDPJ20uSp3jjh2akqUbp/c7qn09ETc2tiVAEzNR2XKqcSW23IOR/yfTCVMunW6UFSuz0ZEW3BFDl0KihZVW6Rn6RNaG7OHV/Se3JfgXdd4mQy7JdBJTQ4bWQDT+e8t1fqLonh8VlHss+GXJ0HJ6gjVYnneZ+hAwThtH7DNF2TJlhoBrn1htUV6bF7MS8ohJt8/X

  • thomas sheehan commented  ·   ·  Flag as inappropriate

    Failing filters, example 8)

    Received: from AM5EUR03HT230.eop-EUR03.prod.protection.outlook.com
    (2603:10b6:404:b6::23) by BL0PR05MB5218.namprd05.prod.outlook.com with HTTPS
    via BN6PR08CA0085.NAMPRD08.PROD.OUTLOOK.COM; Tue, 16 Oct 2018 11:42:43 +0000
    Received: from AM5EUR03FT056.eop-EUR03.prod.protection.outlook.com
    (10.152.16.59) by AM5EUR03HT230.eop-EUR03.prod.protection.outlook.com
    (10.152.17.169) with Microsoft SMTP Server (version=TLS1_2,
    cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.1250.12; Tue, 16 Oct
    2018 11:42:42 +0000
    Authentication-Results: spf=softfail (sender IP is 217.160.235.20)
    smtp.mailfrom=cox.com; hotmail.com; dkim=none (message not signed)
    header.d=none;hotmail.com; dmarc=fail action=none header.from=cox.com;
    Received-SPF: SoftFail (protection.outlook.com: domain of transitioning
    cox.com discourages use of 217.160.235.20 as permitted sender)
    Received: from eduklab.com (217.160.235.20) by
    AM5EUR03FT056.mail.protection.outlook.com (10.152.17.224) with Microsoft SMTP
    Server id 15.20.1250.12 via Frontend Transport; Tue, 16 Oct 2018 11:42:42
    +0000
    X-IncomingTopHeaderMarker: OriginalChecksum:FA14197983D9F6C22F88F0FD54F7F6572506C7942C50409142AE00BF80D28849;UpperCasedChecksum:5758B9574B6FC63CB39C614C17B0131A740651F3D66107BE0F503DFA20CF2184;SizeAsReceived:478;Count:12
    To: Removed
    Subject: Cerys Keyes sent you a Private invite
    From: Cerys Keyes <jose.agosto@cox.com>
    Signature-Incompetents: enameling
    Content-Transfer-Encoding: 7bit
    Savagers-Contester-Booms: F6922F81985384
    Content-Type: text/html; charset="utf-8"
    Date: Tue, 16 Oct 2018 13:42:42 +0000
    Cometary-Intelsat-Baptists: 1bd62372d
    Message-ID: <20181016014242.F47A0B6D29@cox.com>
    Expressible-Critiquing: contrasted
    X-IncomingHeaderCount: 12
    Return-Path: jose.agosto@cox.com
    X-MS-Exchange-Organization-ExpirationStartTime: 16 Oct 2018 11:42:42.6698
    (UTC)
    X-MS-Exchange-Organization-ExpirationStartTimeReason: OriginalSubmit
    X-MS-Exchange-Organization-ExpirationInterval: 2:00:00:00.0000000
    X-MS-Exchange-Organization-ExpirationIntervalReason: OriginalSubmit
    X-MS-Exchange-Organization-Network-Message-Id: 4dbfa43f-1cec-4941-5ba6-08d6335c7bcf
    X-EOPAttributedMessage: 0
    X-EOPTenantAttributedMessage: 84df9e7f-e9f6-40af-b435-aaaaaaaaaaaa:0
    X-MS-Exchange-Organization-MessageDirectionality: Incoming
    X-Microsoft-Exchange-Diagnostics: 1;AM5EUR03FT056;1:YplGAqqf1Qpt7Iizvdb02ZhVMgrleNyYLH4hqccR5+75qkdQNPYjgvJNMHRhZ24J53HW1JQITHsKBC1L2ZUHVtK0oM1yhzBoJcg1CKnhSvEQyQ/RSeR2/OZIr6xI4N2B
    X-Forefront-Antispam-Report: EFV:NLI;
    X-MS-Exchange-Organization-AuthSource:
    AM5EUR03FT056.eop-EUR03.prod.protection.outlook.com
    X-MS-Exchange-Organization-AuthAs: Anonymous
    X-MS-PublicTrafficType: Email
    X-MS-Office365-Filtering-Correlation-Id: 4dbfa43f-1cec-4941-5ba6-08d6335c7bcf
    X-Microsoft-Antispam:
    BCL:0;PCL:0;RULEID:(5000110)(711020)(4605076)(610169)(630170)(8291501071);SRVR:AM5EUR03HT230;
    X-Microsoft-Exchange-Diagnostics:
    1;AM5EUR03HT230;3:6P+/xhLYlOol2zxxkiGhtlKAoNpC+aNe5RpKQfprpoC+DCk6+MqI9NF+3RpZuAH7Qd/j9L5pJW/6/pt9aUTnt66qBBZRGRoRJ5ZFblU57tKp5G1a2xoLoYsEQ1OwnjqV5NKPVORGopkxEDR35+opmlIM5HWWghxfHCjadTJZU38PqgocZtlUCE0WoMQ6mGrlDqklxVamgX/UxSZtGwO+lXIxsik2xc9O4PKR9lXPCsQYLO7oncdmMNhNJhuAGUIRRh4LrU/4tIyAFI7FkLJomIaQ/1IjSS0bV3Y7N8f3mQ4ZxQAe2molySd6k38KxX1YRzgjWQIESPBquizoQr7C8w==;25:hsmY9pMu3gvINkxQK4XMzFtFZ777ScgMoxfL0CTHCrKvA75gcBrRf5SnwRwIbWJ4J44AiRtbQBYdlVpjMb8yrVET7ThZT9STCJxvRMLeRwbReMzGrocRB3/IAPv0U2rF62tuLDp2+Vy2z5OlX/xlRiRNgLLARnr6lljqxRD07sM5k8I3iCtiAM9YgdI34T6T7hgT+UPc7wr+0O8Xjb9AJZgVnPsXiYkfTr8gyb5NcU5VT1JHOtvprBba4q9UE9bmR6ZxurOPIqb7fzDMjLPPzHfKt3UwMMqDLhndXMA6e4U2ujq8YaB0LO1bAMzX9+nEqCzo+UgtNIJlNSBUwdmwhA==;31:+HCGjfve1lblDfuC5fDOHIm0n1io80U9a++cWMwTsTHS8lzgBqBXvxjjy/xwfrj2N3vvixn7dLDR5IwZt+ozf7hUH/DtjUVVNtzTYYX1a2A3PX/XdtJEFIqbL4MXEH5quMvno9XUu5A1Vyiw7rpaNiWFCx+2n2ZkiaAxwjOUdTlXkaQ5i9HZygwrbNWKNprE+9ehF0bxFfPShXbifiG0QgDYlcvnmLTQ6f3qPtyOcXY=
    X-MS-TrafficTypeDiagnostic: AM5EUR03HT230:
    X-MS-Exchange-EOPDirect: true
    X-Sender-IP: 217.160.235.20
    X-SID-PRA: JOSE.AGOSTO@COX.COM
    X-SID-Result: FAIL
    X-MS-Exchange-Organization-PCL: 2
    X-Exchange-Antispam-Report-Test: UriScan:(107671067580682)(166494164430575);
    X-Exchange-Antispam-Report-CFA-Test:
    BCL:0;PCL:0;RULEID:(444111676)(2300196)(52401380)(52601095)(52606095)(52602095)(52606095)(52602095)(52505095)(52406095)(52301095)(52205095)(88862240)(88860193)(82015058);SRVR:AM5EUR03HT230;BCL:0;PCL:0;RULEID:;SRVR:AM5EUR03HT230;

  • thomas sheehan commented  ·   ·  Flag as inappropriate

    Failing filters, example 7)

    Received: from VE1EUR03HT200.eop-EUR03.prod.protection.outlook.com
    (2603:10b6:207:3c::38) by BL0PR05MB5218.namprd05.prod.outlook.com with HTTPS
    via BL0PR02CA0025.NAMPRD02.PROD.OUTLOOK.COM; Wed, 17 Oct 2018 16:45:13 +0000
    Received: from VE1EUR03FT031.eop-EUR03.prod.protection.outlook.com
    (10.152.18.51) by VE1EUR03HT200.eop-EUR03.prod.protection.outlook.com
    (10.152.18.191) with Microsoft SMTP Server (version=TLS1_2,
    cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.1250.12; Wed, 17 Oct
    2018 16:45:03 +0000
    Authentication-Results: spf=none (sender IP is 104.131.133.63)
    smtp.mailfrom=klehr.com; hotmail.com; dkim=none (message not signed)
    header.d=none;hotmail.com; dmarc=permerror action=none header.from=klehr.com;
    Received-SPF: None (protection.outlook.com: klehr.com does not designate
    permitted sender hosts)
    Received: from localhost (104.131.133.63) by
    VE1EUR03FT031.mail.protection.outlook.com (10.152.18.69) with Microsoft SMTP
    Server id 15.20.1250.12 via Frontend Transport; Wed, 17 Oct 2018 16:45:03
    +0000
    X-IncomingTopHeaderMarker: OriginalChecksum:97E894DC6E30EA1BAF5136F250A47F3A296974D52319C20E3F61FC076EB92198;UpperCasedChecksum:429C678991B757862A21544750B67D0650B57B6A82B1AD9869E76C43E22A9AF4;SizeAsReceived:461;Count:12
    To: Removed
    Date: Wed, 17 Oct 2018 16:45:03 +0000
    From: Joann Solarin Advisor <mcnsynthetic@klehr.com>
    Message-ID: <f87ba.6379e835.e13181e@klehr.com>
    Eligibility-Excuse-Reciprocate: 81C795A7ED1FCFFF
    Content-Transfer-Encoding: 7bit
    Edmonds-Impostor: EC92594E2
    Content-Type: text/html; charset="UTF-8"
    Deviants-Defaulted: d5a95d6e9
    Real-Encamping: 3
    Subject: New order Joann Solarin Advisor
    X-IncomingHeaderCount: 12
    Return-Path: mcnsynthetic@klehr.com
    X-MS-Exchange-Organization-ExpirationStartTime: 17 Oct 2018 16:45:03.8917
    (UTC)
    X-MS-Exchange-Organization-ExpirationStartTimeReason: OriginalSubmit
    X-MS-Exchange-Organization-ExpirationInterval: 2:00:00:00.0000000
    X-MS-Exchange-Organization-ExpirationIntervalReason: OriginalSubmit
    X-MS-Exchange-Organization-Network-Message-Id: 01068694-f2d7-496e-e347-08d6344fe33b
    X-EOPAttributedMessage: 0
    X-EOPTenantAttributedMessage: 84df9e7f-e9f6-40af-b435-aaaaaaaaaaaa:0
    X-MS-Exchange-Organization-MessageDirectionality: Incoming
    X-Microsoft-Exchange-Diagnostics: 1;VE1EUR03FT031;1:H9jQt8cnL2D/rSjd3mr+sq/tvhUInVKHzErFJXYRYaLjc6SYy70X2sAO0daip7S2cbjsBSSLN/hRLYVDzaLbu/ou3Nht+yefgtp51x0dGwl9rHNp4SikQgHBeXQRGoPM
    X-Forefront-Antispam-Report: EFV:NLI;
    X-MS-Exchange-Organization-AuthSource:
    VE1EUR03FT031.eop-EUR03.prod.protection.outlook.com
    X-MS-Exchange-Organization-AuthAs: Anonymous
    X-MS-PublicTrafficType: Email
    X-MS-Office365-Filtering-Correlation-Id: 01068694-f2d7-496e-e347-08d6344fe33b
    X-Microsoft-Antispam:
    BCL:0;PCL:0;RULEID:(5000110)(711020)(4605076)(610169)(8291501071);SRVR:VE1EUR03HT200;
    X-Microsoft-Exchange-Diagnostics:
    1;VE1EUR03HT200;3:J/DkxonZr7XWkBvkCHBOLaA65XDpY0MUDB/tnuLL6+n0BuiXVO4qI9MYgNjOsA/54cpAi4eWt5mb/ITVc1wyNWW/uQFLwutJB8sWChUjM0Vgd7WKrjwKZY7tTNnDdMjOhuzFfSlwTt6jsdCwbsQ7qlF0lXjI8pqtb8vZ01Vn5XEOYNNzwHLXjG0UMXR4+ohQ31O/eTaLEtONI9d2fM8gwN3kpCY3a4M64F1pb/E4Kfr2JoTrxfKzGmdBei5OBc54T9cfkpZLXD74DSo5BTohqwdrkZ/ieQbCo4gM9+OLienPqzHINBAzUU3czzTqssiCAbHO4mlXoJqyM05ajDMWGQ==;25:9GwMXuE0WFA5eUJcAef1ichNZz+PaQxauD+e8xUGXXyM2yC7we1cq7nlKKqM5QXixUs5y3GgmJTtDTWLuVH0pyvccIhj6UGDvayr/+XxrTAVi569qdZt1xNI5hh7DGqdmoEjPxepaBceY0FoJ6w/ihYdBKlxAMA3IqWlPJyHwZRksyU3XpzmJu7pq5teJY1rEqxnQzNvu5F9PwH6sHhokpZV4AoX9N3zF8g0mkDcvbrsa+n1E+SV9ofUAFn4VJIsaD6+RYGzEJlVErktqVP6XGA+kvthUJYGAcU8h3wupocLl60NzOk22b51hhXwWLR8Dk+s2tUvrCFGSHsglW7CVw==;31:Eup4MtAEKNBUpVkUOtrtdqm7lBP27xIR06J/A6h1/uxnFimtGJFPtFY+MEhNiiCAt1se06uKtvvPgs0LnlAcPBrxjbUpUTqD8IPfLBFyhXuSD+hm3ZYkdj/1ys5z+E48kCStW6W2Q67vTb/OH/gFGk6pAnJgL5zmdUKhbJlKM9f79VXZ0g/MuiKoManyVZuVXGpHKZ0BkF8EpwGGJnDkfj7eDoFkL56Vguzxxx1ZVgM=
    X-MS-TrafficTypeDiagnostic: VE1EUR03HT200:
    X-MS-Exchange-EOPDirect: true
    X-Sender-IP: 104.131.133.63
    X-SID-PRA: MCNSYNTHETIC@KLEHR.COM
    X-SID-Result: NONE
    X-MS-Exchange-Organization-PCL: 8
    X-Exchange-Antispam-Report-Test: UriScan:(196560044828405);
    X-Exchange-Antispam-Report-CFA-Test:
    BCL:0;PCL:8;RULEID:(444111676)(1160499021)(2220353)(52401380)(52601095)(52606095)(52603095)(52606095)(52603095)(52606095)(52603095)(52505095)(52406095)(52402095)(52305095)(52206095)(88862240)(88860193)(82015058);SRVR:VE1EUR03HT200;BCL:0;PCL:8;RULEID:;SRVR:VE1EUR03HT200;
    X-Microsoft-Exchange-Diagnostics:
    1;VE1EUR03HT200;4:NFXYPXOokJt4g0HglsH3HcyoZqlgeGu8M7ZK+Kg91iAw/fKFksOq5b0EMqARhyB3XZzF2uYcFhIG3UB1+/7uFW1QAa7V7xgz2uRemHCMvJ+lbuwTsqu5ptr9KHrKSNO698Y0kr/20kNNbcbBUpHlEbubQQ5lI5WXbo40ps6EPqHimzaHotpWR/6rMD+***/CWQMTph00yPpndLE+RhlL/QTw+JHibx3eOTohQcHpvMWGhaaaqSVYeRX/9or1KWVwfmsbSfZeXmRWAGC8nsX7crv2p17jcknjIOsh/UorPc7IOosaGmOjMU+BMfamA+L5;6:yJaWW7fBVt4Lwv01Nx5B5D7bUT4Qlkc17J+3nFRVZZC82byWcKzZJtau9AhlMj48fKpgavyvqjG4k152jW8op/DBOG+RV4qAEf+oHoMxU33lbvIcjVi9I5jYmWFdzuQJ64nMPPqLNllYqCGg9bJSOAqOy6jdpl6MHyVTRPoNcnXiANw2Q5ZxaZAffmG/Fv0seN2YqB0iG7S6+cgM0vw5xFc0egCoKIXDOP0uwXHJbPpvEGuyTVJfGGH/

  • thomas sheehan commented  ·   ·  Flag as inappropriate

    Failing filters, example 6)

    Received: from DB5EUR03HT132.eop-EUR03.prod.protection.outlook.com
    (10.172.112.156) by BL0PR05MB5218.namprd05.prod.outlook.com with HTTPS via
    BN6PR2001CA0018.NAMPRD20.PROD.OUTLOOK.COM; Thu, 18 Oct 2018 00:04:25 +0000
    Received: from DB5EUR03FT038.eop-EUR03.prod.protection.outlook.com
    (10.152.20.54) by DB5EUR03HT132.eop-EUR03.prod.protection.outlook.com
    (10.152.21.140) with Microsoft SMTP Server (version=TLS1_2,
    cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.1250.12; Thu, 18 Oct
    2018 00:04:23 +0000
    Authentication-Results: spf=none (sender IP is 46.101.118.37)
    smtp.mailfrom=fcmail.com; hotmail.com; dkim=none (message not signed)
    header.d=none;hotmail.com; dmarc=none action=none header.from=fcmail.com;
    Received-SPF: None (protection.outlook.com: fcmail.com does not designate
    permitted sender hosts)
    Received: from localhost (46.101.118.37) by
    DB5EUR03FT038.mail.protection.outlook.com (10.152.21.84) with Microsoft SMTP
    Server id 15.20.1250.12 via Frontend Transport; Thu, 18 Oct 2018 00:04:23
    +0000
    X-IncomingTopHeaderMarker: OriginalChecksum:BBAB35B07D985636928B8386057053A27DD8ED4D8BEBFD98B609804F8B14BAB4;UpperCasedChecksum:FC477A880879890C273898CE8691E94F22AFD6CEBD07462D24F440FC5AFD3D89;SizeAsReceived:534;Count:14
    Message-ID: <42a3de2e95691.b58e997@fcmail.com>
    To: Removed
    Content-Transfer-Encoding: 7bit
    Date: Thu, 18 Oct 2018 00:04:23 +0000
    From: Service <guns4@fcmail.com>
    List-Unsubscribe: <mailto:pqjwnahc@fcmail.com>
    Forcibly-Transient-Curls: 5
    Content-Type: text/html; charset="UTF-8"; format=flowed; delsp=yes
    Subject: Peaktolg, Critical alert for your account #73884
    X-Auto-Response-Suppress: None
    Czech-Contester-Compare: 82
    Errors-To: wxqbeedryh@fcmail.com
    Duplications-Catheters: 2f6df32b
    X-IncomingHeaderCount: 14
    Return-Path: guns4@fcmail.com
    X-MS-Exchange-Organization-ExpirationStartTime: 18 Oct 2018 00:04:23.8420
    (UTC)
    X-MS-Exchange-Organization-ExpirationStartTimeReason: OriginalSubmit
    X-MS-Exchange-Organization-ExpirationInterval: 2:00:00:00.0000000
    X-MS-Exchange-Organization-ExpirationIntervalReason: OriginalSubmit
    X-MS-Exchange-Organization-Network-Message-Id: 187b36a1-34ee-4e86-1a32-08d6348d42fd
    X-EOPAttributedMessage: 0
    X-EOPTenantAttributedMessage: 84df9e7f-e9f6-40af-b435-aaaaaaaaaaaa:0
    X-MS-Exchange-Organization-MessageDirectionality: Incoming
    X-Microsoft-Exchange-Diagnostics: 1;DB5EUR03FT038;1:FZVQYoAYkV+Ux0h4h3WAEqkGRX6xbonfzJ3CfnHbxmGjEnthUGUJAW9Y8TlE3r05hcS1ORAGZtI7p1VIbEuMlt2LR/RvSnrpxJ+oHos2kNlKifPoAFt01/HB57fhkSyd
    X-Forefront-Antispam-Report: EFV:NLI;
    X-MS-Exchange-Organization-AuthSource:
    DB5EUR03FT038.eop-EUR03.prod.protection.outlook.com
    X-MS-Exchange-Organization-AuthAs: Anonymous
    X-MS-PublicTrafficType: Email
    X-MS-Office365-Filtering-Correlation-Id: 187b36a1-34ee-4e86-1a32-08d6348d42fd
    X-Microsoft-Antispam:
    BCL:0;PCL:0;RULEID:(5000110)(711020)(4605076)(610169)(8291501071);SRVR:DB5EUR03HT132;
    X-Microsoft-Exchange-Diagnostics:
    1;DB5EUR03HT132;3:4sCYgkgonehBMaaVh69ogmHL6/CSwFZc8ZAS4pPYZB/d8wbEr0auuOUT7V+DuyClp4rc1TB6KFAKK1c74qQqu/jR4zyh2c0x8WY5nfVZXUPvCX3trl68W3VdZQbwv05iw1/zqjCIEx0b7GT0GPXlJo5OdFDZAzmC73fYEOH6XLNgexh2umjFW3WOY0aPI+xHO22kQtNWmqiRPm6j49ACBXhEvLpkwgcEw4xyIpWhIGgVc9yFgwGtazV0k3O/t6yz8TS6TZUWt3thuExmDSPCE8V6+6ozL7kSi5bDc2BGnLId/0HbWKnaxzUW0xIq8ES6Q6ULC+DNpBAptjar1gU5ww==;25:R4CDsTavVe7usvo3AuqwoMzxuCZw8MzpXQLl+ahCv9udkuaZAUPSyuIpWTgVdMiu/rJqvTXJ85Mv8Z81W/9naOOdNA86MHjRhxmg3qjGe5IeEd8gxklT+pijN0dYeGgt2ZoF5ilHkpuZmxkd9kcTt5M8qy6HgxOBqcaXutApJWL4F8KNjx0sJEHps+d5zmYf3DChYPHsieijgxNNwyNup77eyOh9xGIUcViw+Ljnf7TMlhIAUUjoC9MogBctBtZ+8RocsPHynm2j0kiajGXPTTvsRJRWTU4H72FTKMRN4k+A6QFDrIiz3HWXG+iBEfoDru617sx5zgA4f5tBdlrvNb3wbs2J8tnebMbrt84ibW0=
    X-MS-TrafficTypeDiagnostic: DB5EUR03HT132:
    X-MS-Exchange-EOPDirect: true
    X-Sender-IP: 46.101.118.37
    X-SID-PRA: GUNS4@FCMAIL.COM
    X-SID-Result: NONE
    X-MS-Exchange-Organization-PCL: 8
    X-Microsoft-Exchange-Diagnostics:
    1;DB5EUR03HT132;31:3/aGcnxRGR6i8c8N8MAan4AZr195GjfjDVf8xkWHEQtCMyWd9VgktAgA3vp24DLxYfpK+mwyQmuGT/5ujzfcA5Z8igSVfbDHZVOH3ER9KcBnCm1IdD2h+SRX8ePOVb8iq0VzwO/EtAOjJN+6GB03QMDP0o4qomqNe4RXc97H2IetZaiXtEUolwV3hhckR/vjlboHUrj1R2pZQBJLSpt8iD+3QQp0BESrsyuRPSvNkEk=;4:z5qcjDiuxdlJnL4BLFfy1rgH8/2nZI5LJBq5Btbxq3d88HHn007iqWoPcp03CP9V9/TRru6OA3cX+kQUs0VqsLJhuTKpAhlLhFtJQQjgjPgqvZVRhXc8Hry7MvCKB4QFIjVGXz5H95hlqdNXdICcj++yq1+DTTm3dm/v/ZA9ALJ7VzZNvoCtb4W3shAz1EZyeg8EzXDIGEcIk4yhIbjX55ioew0nWyCMGsUL8GDCCeDnjQ/iJzTzwZtOItSYHmzJgiTIDkkjKAQW15N+fkDDbC7l8dPiSrZP2e0AutG/HZqII6xsFzjspt3QorryXxQc24w9+I0HThrylDTEkdomH5Cgx+zfIbdCnO4n9qI/rIbfSZRf5DgILMQE6Meuou7yoNx7TR/Q1BiZ6BW5SRnGLFhn2W0ulnYSm7rCXL6+Ylsjg/dMLIU6LE96+2v3p4jK80a4ejBqZ4Lac7qVNMM4lnZgatMrNuiZ6lZ/F0qOcXc=
    X-Exchange-Antispam-Report-Test:
    UriScan:(78813514240607)(194151415913766)(71457273570760)(6911010853514)(120474695177632)(3908916348139);
    X-Exchange-Antispam-Report-CFA-Test:
    BCL:0;PCL:8;RULEID:(444111676)(2220353)(52401380)(52601095)(52606095)(52602095)(52606095)(52602095)(52505095)(52501095)(52406095)(52402095)(52303095)(52206095)(88862240)(8886

  • thomas sheehan commented  ·   ·  Flag as inappropriate

    Failing filters, example 5)

    Received: from SN1NAM01HT070.eop-nam01.prod.protection.outlook.com
    (2603:10b6:404:13f::17) by BL0PR05MB5218.namprd05.prod.outlook.com with HTTPS
    via BN6PR14CA0031.NAMPRD14.PROD.OUTLOOK.COM; Thu, 18 Oct 2018 03:54:37 +0000
    Received: from SN1NAM01FT020.eop-nam01.prod.protection.outlook.com
    (10.152.64.60) by SN1NAM01HT070.eop-nam01.prod.protection.outlook.com
    (10.152.65.253) with Microsoft SMTP Server (version=TLS1_2,
    cipher=TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384) id 15.20.1250.12; Thu, 18 Oct
    2018 03:54:36 +0000
    Authentication-Results: spf=none (sender IP is 178.62.64.240)
    smtp.mailfrom=freightliner.com; hotmail.com; dkim=none (message not signed)
    header.d=none;hotmail.com; dmarc=none action=none
    header.from=freightliner.com;
    Received-SPF: None (protection.outlook.com: freightliner.com does not
    designate permitted sender hosts)
    Received: from 87541-68311.cloudwaysapps.com (178.62.64.240) by
    SN1NAM01FT020.mail.protection.outlook.com (10.152.65.195) with Microsoft SMTP
    Server id 15.20.1250.12 via Frontend Transport; Thu, 18 Oct 2018 03:54:36
    +0000
    X-IncomingTopHeaderMarker: OriginalChecksum:68D345B02C3F68D946815D27E997D07C2B6F38F9747B7A4799A1BC394EA72FAC;UpperCasedChecksum:66F85858BBF09AF25CFE30ABAA317D5DA9AE370411ED64018EB34BB9B834AAC8;SizeAsReceived:513;Count:13
    Subject: Shipping charge
    Content-Transfer-Encoding: quoted-printable
    From: Sherman Dillard Chief <pranalysts@freightliner.com>
    Message-ID: <38d7f6282.925d65e8.6247968356963@87541-68311.cloudwaysapps.com>
    To: Removed
    Contrary-Rename: C46732947CAD778
    Stag-Hide: B8C197E65A1EFB
    Pretender-Reconstructs: 5EC792792A
    Impossibility-Returns: d53f2c92c886
    Content-Type: text/html; charset="UTF-8"
    Stillness-Aborts-Reassembly: 419b6cf2e213be5
    Date: Thu, 18 Oct 2018 03:54:36 -0700
    X-IncomingHeaderCount: 13
    Return-Path: pranalysts@freightliner.com
    X-MS-Exchange-Organization-ExpirationStartTime: 18 Oct 2018 03:54:36.4374
    (UTC)
    X-MS-Exchange-Organization-ExpirationStartTimeReason: OriginalSubmit
    X-MS-Exchange-Organization-ExpirationInterval: 2:00:00:00.0000000
    X-MS-Exchange-Organization-ExpirationIntervalReason: OriginalSubmit
    X-MS-Exchange-Organization-Network-Message-Id: 79526169-56c1-4856-e56b-08d634ad6bef
    X-EOPAttributedMessage: 0
    X-EOPTenantAttributedMessage: 84df9e7f-e9f6-40af-b435-aaaaaaaaaaaa:0
    X-MS-Exchange-Organization-MessageDirectionality: Incoming
    X-Microsoft-Exchange-Diagnostics: 1;SN1NAM01FT020;1:CPANLliVr3RH6Z7Mst89UqDfGAEUVGt2Kzgrt/aiJ911r9X0CxMho1NECmGLI9kDvxzInH+fjdPw24ENO7X2xTu8ckuMAq1pGmAPBWrqxbWWISiSGegbqJ+NPXewy9lf
    X-Forefront-Antispam-Report: EFV:NLI;
    X-MS-Exchange-Organization-AuthSource:
    SN1NAM01FT020.eop-nam01.prod.protection.outlook.com
    X-MS-Exchange-Organization-AuthAs: Anonymous
    X-MS-PublicTrafficType: Email
    X-MS-Office365-Filtering-Correlation-Id: 79526169-56c1-4856-e56b-08d634ad6bef
    X-Microsoft-Antispam:
    BCL:0;PCL:0;RULEID:(5000110)(711020)(4605076)(610169)(8291501071);SRVR:SN1NAM01HT070;
    X-Microsoft-Exchange-Diagnostics:
    1;SN1NAM01HT070;3:9qMKZWhvQL6fcPR8Sc5Hlq1d3W9LK22NHeokkSOQwOC1aC47Wot3IQEtY+gckheQ7Mi8+QE4xaA6Xo1SFuVdsUAW5ZRgMGYm0xSt9my5rC//bCTjyrdW3aQRh8i93XfsVhR7aohdebEQdQsNG/V5R1VfECD2k5p926SqTmO1s5dwxmLjb7Vi2mD9k1BY9MlzyEghQ7b3ZsGhueVV1QxFmFZoOQxhHcEq5OioLcVE/uni7KMnD+frKXZasZNWTTzFjtcdWarfzLJ7WsiSmNIMoUBpE/SFA/AFVTPJdS45F8/jkfUZCxMW23RWLuNyZ3uBJgZtdzYJQnOu2qwgOsieYw==;25:MkqMuyG35j/Cqch5aZ9T/eUzIQyNuYwAM5KRM+BZrzxmalP7xX9vL1Jqjcx+ZmVu5wrZizB84ivDB5LRHCFT6XDJmCt6Lj8gHLgN5FCQx9YfsLo5hdHLxYbmcVJPeN1G93eLoe+U6IbnwAISCyWbyEC1xjPZuEPQ5LD9fNX053TQ7VUy+M74ATDeTEF4HgWInag/jkRuYSIQ0qvoi7vMbNp2J6qi6adBmefdDnNuDh1a1Iq003vdIZ1cxFIU6qFnVSPQJkIAIaLKza7ZRPZ8jovJ5xCxas9TjnzqmqwdnslP9BIZ33NSlZHh2m24RzLOtwggL7Ml8CeLLFsjo/uXPw==;31:SxfWfdCpDZ8j+06DIcvuNpsrK42qPVgWaWFyTmNg2ruC4VL8Vqo4vME4opwGOG+7XhFjlHsmrK52t0I4Mi7jHERi7ngKAwDMri222vzqu2GAVI4vzTCmCrwBL3KMgps30KhpMcxoC506gEZgswl0pn5ZTvAMblX+B1uPCJnXmNgwzGrnoJXEXBnyzp7f2xkBG85ITPoUm7xHVf56JGPy7nTuLb8sGcfGD4xu1BYESLk=
    X-MS-TrafficTypeDiagnostic: SN1NAM01HT070:
    X-MS-Exchange-EOPDirect: true
    X-Sender-IP: 178.62.64.240
    X-SID-PRA: PRANALYSTS@FREIGHTLINER.COM
    X-SID-Result: NONE
    X-MS-Exchange-Organization-PCL: 2
    X-Exchange-Antispam-Report-Test: UriScan:(194151415913766)(166494164430575);
    X-Exchange-Antispam-Report-CFA-Test:
    BCL:0;PCL:0;RULEID:(444111676)(52401380)(52601095)(52606095)(52604095)(52606095)(52604095)(52606095)(52604095)(52606095)(52604095)(52505095)(52406095)(52303095)(52206095)(88862240)(88860193)(82015058);SRVR:SN1NAM01HT070;BCL:0;PCL:0;RULEID:;SRVR:SN1NAM01HT070;
    X-Microsoft-Exchange-Diagnostics:
    1;SN1NAM01HT070;4:/MC6h14hRX6e4mcq6czYQ/SvmCtWTDDQD1Cn6lfwd6z8tXr8hEmG/bV1S4l9L5Eaw7rEXsekKUUnD+ud0bGxgWgGFyIKKjIofG4hBRQauUhrcxDZWUUBuAVFuPzs46bRkwe5j/yol6TEeYZpwU/Tc47i7X5rJCmvNu4ROdUD88+/65dwSK73z/afzKSnUqWusKjXlg3rkcvdw5qLsPkrTYWX5a/eimgXjM7FlhhLwwJy+EYndN89q103f2HqouP0tcIvoaXeH+50D5r3+Ni0W6gHMUIZ/AHJsmME2pv4MUPeltwBSM8kyQW5Ln97BN2yUSKKJlHw+dS7oIa7RbOlH+bRW5PYU5wRrJZWabHKxig=;6:sHJVRkh3PejWlQDohlIGYRirU2wnDc9NmSRJSyvE+0/y0bhr4h2O0HUFjZoBeVyl7OvzfN87f

  • thomas sheehan commented  ·   ·  Flag as inappropriate

    Failing filters, example 3)

    Received: from BY2NAM05HT026.eop-nam05.prod.protection.outlook.com
    (2603:10b6:300:117::24) by BL0PR05MB5218.namprd05.prod.outlook.com with HTTPS
    via MWHPR03CA0014.NAMPRD03.PROD.OUTLOOK.COM; Thu, 18 Oct 2018 09:08:09 +0000
    Received: from BY2NAM05FT023.eop-nam05.prod.protection.outlook.com
    (10.152.100.58) by BY2NAM05HT026.eop-nam05.prod.protection.outlook.com
    (10.152.100.227) with Microsoft SMTP Server (version=TLS1_2,
    cipher=TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384) id 15.20.1250.2; Thu, 18 Oct
    2018 09:08:08 +0000
    Authentication-Results: spf=softfail (sender IP is 184.154.108.237)
    smtp.mailfrom=csiw.com; hotmail.com; dkim=none (message not signed)
    header.d=none;hotmail.com; dmarc=none action=none header.from=csiw.com;
    Received-SPF: SoftFail (protection.outlook.com: domain of transitioning
    csiw.com discourages use of 184.154.108.237 as permitted sender)
    Received: from us6.tmd.cloud (184.154.108.237) by
    BY2NAM05FT023.mail.protection.outlook.com (10.152.100.160) with Microsoft
    SMTP Server id 15.20.1250.2 via Frontend Transport; Thu, 18 Oct 2018 09:08:08
    +0000
    X-IncomingTopHeaderMarker: OriginalChecksum:7B11B1B97364460A89814A6658F8FDBFE13685708865493CC66E988A3A8E733A;UpperCasedChecksum:919C6E267EFC99EFABBDA513FEC906015FC8F31742D68E22662A11F7BD0368DC;SizeAsReceived:420;Count:12
    Content-Type: text/html; charset="UTF-8"
    From: Google Reminder <cs@csiw.com>
    To: Removed
    Content-Transfer-Encoding: 7bit
    Date: Thu, 18 Oct 2018 09:08:08 +0000
    Hurts-Variably: disrupts
    Subject: Undeliverable messages Peaktolg
    Gasping-Israeli-Malign: paula
    Message-ID: <4bf99_8c5e53_9ccc16@csiw.com>
    Auto-Submitted: no
    Errors-To: xfqiagqkjcixxo@csiw.com
    X-IncomingHeaderCount: 12
    Return-Path: cs@csiw.com
    X-MS-Exchange-Organization-ExpirationStartTime: 18 Oct 2018 09:08:08.5557
    (UTC)
    X-MS-Exchange-Organization-ExpirationStartTimeReason: OriginalSubmit
    X-MS-Exchange-Organization-ExpirationInterval: 2:00:00:00.0000000
    X-MS-Exchange-Organization-ExpirationIntervalReason: OriginalSubmit
    X-MS-Exchange-Organization-Network-Message-Id: 28fd40a5-23de-433f-5a85-08d634d938d5
    X-EOPAttributedMessage: 0
    X-EOPTenantAttributedMessage: 84df9e7f-e9f6-40af-b435-aaaaaaaaaaaa:0
    X-MS-Exchange-Organization-MessageDirectionality: Incoming
    X-Microsoft-Exchange-Diagnostics: 1;BY2NAM05FT023;1:aXwgtD+zDPRynOS3nSJGavXoWSckZcLRsZWl5h8FTkOXgj4QgOyUSVKx8u9wBY2/c2y+bsq4qV3Dof4RPY+syHHGlosidE6nmL0me/9QKSsLesvIfZ8d0UH0iggL/GQ8
    X-Forefront-Antispam-Report: EFV:NLI;
    X-MS-Exchange-Organization-AuthSource:
    BY2NAM05FT023.eop-nam05.prod.protection.outlook.com
    X-MS-Exchange-Organization-AuthAs: Anonymous
    X-MS-PublicTrafficType: Email
    X-MS-Office365-Filtering-Correlation-Id: 28fd40a5-23de-433f-5a85-08d634d938d5
    X-Microsoft-Antispam:
    BCL:0;PCL:0;RULEID:(5000110)(711020)(4605076)(610169)(630170)(8291501071);SRVR:BY2NAM05HT026;
    X-Microsoft-Exchange-Diagnostics:
    1;BY2NAM05HT026;3:pwD4H2Klb9SklPFNQ4C/A7fRfgPx+FIoEz6dGqwrEC6STLegzN967T+H4apgXWLlmv8o0aBd+ei7MvwXG+8djkxBTHCMZYgjEmjqt1XLtC3kqDw+ZmsK43YfRMQUSipydUbTEJwPNu5HuKbGo2k+/hNX9e5bZNdnflPOyLQI6+LlJCngJx5InsbySQxC6EcYiu1oQe8P4nSC5UT/e/4ct4QmKjUc3XeMUXcZVZjHYUIPMcWq39vZXbcYg9wqqVFec5YDSSNfVZH6hh7YeD1FwLa5UrdUscON5va78rDM58B1dupHcLw+c3fr8L+VMoJj/YQD+r978E/42qSQae9xiw==;25:4sbCTZjQjrvQmteI1DlLFnI1BKJzuAGB+zm6n9GGXbfBC6qSOt07GpZ1Ct4j2Nr0fLZG7ZvzE0KpEwXIwm3YI7xc6tgztFNAErMCa02AQrM1vVKfwtZMWjnZEew9a3c/5bQlqm76Nmz/LtIAbU8GtHd5J0uTx/qXhDLYZRcPk/x4Z/+CiErULDqMTF71MFy3JZWxc0xwtrp/rW0567ZrL0CZma0c0xGm6KLnuQHiuxcKTLUxPQMuFIjfWUgKnGm/9Vm5kiy/obCzPo6gzNaOC4o0pBfyQ88aydTQ4/HTAVbdNrCSS2EJF0FpbhcvaibtyUMUaeMZbTt/XQMwt/iCNw==;31:l8c2A4Qqs1oDJBKa/7socBJpoF/8WIkpwKrcBMpyNkzyG3ongO4Y7W7L3oHtuKte2gIVlDS8x0qvPfv3enWwUy2RAIxa6kbhTsz3k0TblUfMniC9fMvTOBs0rUr2nIQGZadnyQV8iVQbHoRzSSKFk+UFjR3WTRPYlqq7SIxvsgGU0H1uodapybzbgVoEQWovbmhx+h3IeEiDlXAmM21LVDhTnKy2c0OcYDUmaNmd+lA=
    X-MS-TrafficTypeDiagnostic: BY2NAM05HT026:
    X-MS-Exchange-EOPDirect: true
    X-Sender-IP: 184.154.108.237
    X-SID-PRA: CS@CSIW.COM
    X-SID-Result: FAIL
    X-MS-Exchange-Organization-PCL: 8
    X-Exchange-Antispam-Report-Test:
    UriScan:(163750095850)(25915859609805)(50302081469323);
    X-Exchange-Antispam-Report-CFA-Test:
    BCL:0;PCL:8;RULEID:(444111676)(2220353)(52401380)(52601095)(52606095)(52604095)(52606095)(52604095)(52606095)(52604095)(52505095)(52504095)(52406095)(52402095)(52304095)(52206095)(88862240)(88860193)(82015058);SRVR:BY2NAM05HT026;BCL:0;PCL:8;RULEID:;SRVR:BY2NAM05HT026;
    X-Microsoft-Exchange-Diagnostics:
    1;BY2NAM05HT026;4:ZCY57S98jki8vyQV+HNzIBimaBzJBauRDVmy1pw4cMvgcv3trTOC/NMe277iFK+4qjOlaVRB3Zz5K/qsr6j3qEHC/uVmFPXs5IPD9Wu1W4s7FAPnNIEQkykP8rx2CG4LFF0w08eKYGOMdXrFWY5sQ5BmxkZMEPlUP9Ro9ujfYtfeLUYGfWbQfcDO9gjuUlSx1BXPP9PdtdYVyZDTMTSMyL6Yifc9BPMZCICfjEdk3Sxt2lQdDAC3+xTW+V6Egv9icfs1U3/5GsvYQ7K96CFFfh/B8R7Icfl1iGr5ZV2ZZKn/FTOLOphF8vKJtvavC7pCbc83XTp+n1XbsHa5+MhfsMGigHy8wrQYl7RFU0SjSBGAKQhggKvYV9bz7CNq9fvQ;6:dfVFOeYapWl1cHfXV6VXi70rw3EbexoI/Vs5BH7xgTULWD+eKBoaxyeUnF7Cy/QV9vMVddfga89jh2xdMc24TNgCQ1y2kZrA7C45ZiQrrJjVB0yzORNl9863QYIyLsYZqoNw5FZstho1NdSgaP52nmlBXiIZf4pwBr

  • thomas sheehan commented  ·   ·  Flag as inappropriate

    Failing filters and blocked senders; example 2:
    Received: from BY2NAM05HT196.eop-nam05.prod.protection.outlook.com
    (2603:10b6:207:18::43) by BL0PR05MB5218.namprd05.prod.outlook.com with HTTPS
    via BL0PR0102CA0030.PROD.EXCHANGELABS.COM; Thu, 18 Oct 2018 10:32:25 +0000
    Received: from BY2NAM05FT058.eop-nam05.prod.protection.outlook.com
    (10.152.100.51) by BY2NAM05HT196.eop-nam05.prod.protection.outlook.com
    (10.152.101.141) with Microsoft SMTP Server (version=TLS1_2,
    cipher=TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384) id 15.20.1250.2; Thu, 18 Oct
    2018 10:32:24 +0000
    Authentication-Results: spf=none (sender IP is 193.169.178.191)
    smtp.mailfrom=wanadoo.fr; hotmail.com; dkim=none (message not signed)
    header.d=none;hotmail.com; dmarc=none action=none header.from=wanadoo.fr;
    Received-SPF: None (protection.outlook.com: wanadoo.fr does not designate
    permitted sender hosts)
    Received: from mail.rvs-holding.ru (193.169.178.191) by
    BY2NAM05FT058.mail.protection.outlook.com (10.152.100.195) with Microsoft
    SMTP Server id 15.20.1250.2 via Frontend Transport; Thu, 18 Oct 2018 10:32:23
    +0000
    X-IncomingTopHeaderMarker: OriginalChecksum:ECE4599409422122D56F6C58751AF4BA48A2C5C6DC59D14191042D25211FC740;UpperCasedChecksum:D049ADBD054180BD744C92218BD6E8AB1D12C6B9463C421A5E222B3DE5980F66;SizeAsReceived:393;Count:10
    Subject: Messenger new notification
    To: Removed
    Tensest-Typo-Nightmares: D95ABAC3B
    Reappear-Pabst: d63e942e3
    From: Savannah George Chief <jsp.montigny@wanadoo.fr>
    Message-ID: <629f19ef9.4e9bcc14.1811658761375@mail.rvs-holding.ru>
    Date: Thu, 18 Oct 2018 13:32:24 +0000
    Content-Transfer-Encoding: 7bit
    Content-Type: text/html; charset="UTF-8"
    X-IncomingHeaderCount: 10
    Return-Path: jsp.montigny@wanadoo.fr
    X-MS-Exchange-Organization-ExpirationStartTime: 18 Oct 2018 10:32:24.4831
    (UTC)
    X-MS-Exchange-Organization-ExpirationStartTimeReason: OriginalSubmit
    X-MS-Exchange-Organization-ExpirationInterval: 2:00:00:00.0000000
    X-MS-Exchange-Organization-ExpirationIntervalReason: OriginalSubmit
    X-MS-Exchange-Organization-Network-Message-Id: 8944d72e-bcd9-4108-a673-08d634e4fe66
    X-EOPAttributedMessage: 0
    X-EOPTenantAttributedMessage: 84df9e7f-e9f6-40af-b435-aaaaaaaaaaaa:0
    X-MS-Exchange-Organization-MessageDirectionality: Incoming
    X-Microsoft-Exchange-Diagnostics: 1;BY2NAM05FT058;1:714pudRSOyrIjTZc+RMaT0Q2ziKwkFWg1M5n3kFIaIBpQAgmEpJ3goRffESzztdBYNowHs7bC8muJzqAQMUEr7jIqCoOKRpJgLEhlxcEXQwpjqQ7ykB5//vO1oRNzvCF
    X-Forefront-Antispam-Report: EFV:NLI;
    X-MS-Exchange-Organization-AuthSource:
    BY2NAM05FT058.eop-nam05.prod.protection.outlook.com
    X-MS-Exchange-Organization-AuthAs: Anonymous
    X-MS-PublicTrafficType: Email
    X-MS-Office365-Filtering-Correlation-Id: 8944d72e-bcd9-4108-a673-08d634e4fe66
    X-Microsoft-Antispam:
    BCL:0;PCL:0;RULEID:(5000110)(711020)(4605076)(610169)(8291501071);SRVR:BY2NAM05HT196;
    X-Microsoft-Exchange-Diagnostics:
    1;BY2NAM05HT196;3:PiXpuLBA48duDrwu94lri+MjBPRcx7K3s6CP/WZWBOFJTYN+7ZCeke+uaw0KOuelhClpjy9DtRtM4yFkewW3/fK/FdlG88OGbSSSHijBfXEwjMGHiDX4uXeYxicQrs4su/MbzAlKaOhkVQs5d7o0/UuO+QkI3nJXiHwQvGnSzjiCqvLT1+BWOgd4XHGpN91a0lxfMzJg+NLEWeY0wkclfxY8DynV9oAcVRhZJPd23zC+7KGrPhfg5JiFCJ8So+l74r/EklzjNVxIqz1r6n++91KudlFs5OyinsX91msgrCkjJx4VrdFjF20r7P2FuVM4NXeqH+8veGPHVfmuqrLfrA==;25:CvLVlcFYKJLscgprqMAsVpImJDRYidDn44LFiGr/Hvvdf1mzvUMRb29diDkJXiD8wfh+yVbuo1wtDeuiH3DLsvYPTq3mzUBUwnUKK0LZatoBZg92oZGDkqA2fA06uaCC27GmAQyS9rdT1MRogH7xtTv8z9QqGq5/1jGj8A1cq1EEHcIhAxtMwohL6lw6CtkOHDl6VcjNaw/Pkv7P/JcnqHzGbDwaDhgmaxFNoBbSKKZYY8C3SN7rNovjScF71P9pTMgMb45DEKZhdP/n7GADyklQevULU6bDdYQPXEVUoMc3ept0YPDTsxpimBVqKaCduqGxsgmDMzYwfmeW0go2Imrw8TE67WRZtv3DGsFjUaU=
    X-MS-TrafficTypeDiagnostic: BY2NAM05HT196:
    X-MS-Exchange-EOPDirect: true
    X-Sender-IP: 193.169.178.191
    X-SID-PRA: JSP.MONTIGNY@WANADOO.FR
    X-SID-Result: NONE
    X-MS-Exchange-Organization-PCL: 2
    X-Microsoft-Exchange-Diagnostics:
    1;BY2NAM05HT196;31:Qm3wJFOZkcY/2cg5sIR4oL+KBqGlSKaqiY1pgLyneoGF/uwiop0H+72s2cQ87zzlE6ED7yelJ2Rbv482gMcdeK4JQFhqABlmuSsvlp6q0VR1uXtPwbmst03YcdrZnWy2wgXF6kU2LxOEhh90J0vigreFxAS6p59BVP5qKYMjJnAgIxBkkzxQW1Z4TH1n55h8TJCKFNte8MXTpw51D7Y4Oqz2x8iBry5ENE7ASTrcpik=;4:LESg14cYHDmTp+WTBnQJmNjlzrOPJUTR8Kzm+4y9FnUDmaa2Hrjjb+d0gMe4TK2Z12hAvk2YxLsJjbpDkXuzFnXaVAm13Wv82Psb6GZKBEEgHmZK/lTaLZVFbAtFytaPwwCg38ZF2OC0VgbvGwyaO16AE7As1sbTQvim5lF0Ziq6p4kXxh4KTRGFuaQJ7VegKWbMDRmqR1Z7pLobFFeNmsfBeYjz15nLwS2W/aNn93RlEP1kAemFOuepD8xw7kW9gXG20EURufjtIpxP8oHAQzZX4tmCYvXKq8Y2U/D0BLDwR7KXw77x5jlKRLib42cu
    X-Exchange-Antispam-Report-Test: UriScan:(194151415913766);
    X-Exchange-Antispam-Report-CFA-Test:
    BCL:0;PCL:0;RULEID:(444111676)(1160499021)(52401380)(52601095)(52606095)(52604095)(52606095)(52604095)(52606095)(52604095)(52505095)(52406095)(52404095)(52304095)(52206095)(88862240)(88860193)(82015058);SRVR:BY2NAM05HT196;BCL:0;PCL:0;RULEID:;SRVR:BY2NAM05HT196;
    X-Microsoft-Antispam-Message-Info:
    l/YKJigA7+MVUSS5yPNyEY7/peZg3oBtABcc8JINnbDXkcEvLmT7ak/bZ6lj1oWz/hkjuCb4QLqvgN60dPbyYowPubYXAlh6BrK5BZzZBQNGt+Ptc8e7cUaKg04afTYoLgswlI6jD7URIxvopsxoHIcAc1r3BcKDSAKaVeUHrCvywYoZCMeQtDGOgWMs/MxEMZ+kxNJjabS+KQ7p0iMcERHSOml9D

Outlook.com

Feedback and Knowledge Base