OutlookUservoice_icon_outlook Outlook Feedback by UserVoice

Outlook.com

New feedback from Outlook.com

This is another example of Outlook.com filters/blocked senders that fail to delete or block designated sources. I will send you about 12 to help you identify how they are evading the filters and blocked senders. In the "To:" field, I have replaced my email address with the word "Removed".
For expedience, the headers are truncated after a certain point.
1)
Received: from CO1NAM03HT056.eop-NAM03.prod.protection.outlook.com
(2603:10b6:300:117::22) by BL0PR05MB5218.namprd05.prod.outlook.com with HTTPS
via MWHPR03CA0012.NAMPRD03.PROD.OUTLOOK.COM; Thu, 18 Oct 2018 13:08:52 +0000
Received: from CO1NAM03FT045.eop-NAM03.prod.protection.outlook.com
(10.152.80.55) by CO1NAM03HT056.eop-NAM03.prod.protection.outlook.com
(10.152.81.79) with Microsoft SMTP Server (version=TLS1_2,
cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.1250.12; Thu, 18 Oct
2018 13:08:51 +0000
Authentication-Results: spf=none (sender IP is 221.121.12.250)
smtp.mailfrom=esd-gmbh.de; hotmail.com; dkim=none (message not signed)
header.d=none;hotmail.com; dmarc=none action=none header.from=esd-gmbh.de;
Received-SPF: None (protection.outlook.com: esd-gmbh.de does not designate
permitted sender hosts)
Received: from localhost (221.121.12.250) by
CO1NAM03FT045.mail.protection.outlook.com (10.152.81.214) with Microsoft SMTP
Server id 15.20.1250.12 via Frontend Transport; Thu, 18 Oct 2018 13:08:50
+0000
X-IncomingTopHeaderMarker: OriginalChecksum:3F84E615D95DA27B21114190FBB9D516DC00BA088BBAD84611C21755978695B6;UpperCasedChecksum:4EC09AA224058CD93959D9834946A7B2DF2E248DBF641873529212C730AAFD50;SizeAsReceived:498;Count:13
Mound-Precautions-Complaining: 9658bd6842ed4df
To: Removed
Message-ID: <28bb1855.48cae72-9dfc@esd-gmbh.de>
Content-Transfer-Encoding: 7bit
Content-Type: text/html; charset="UTF-8"; format=flowed; delsp=yes
Atheism-Inker: thorn
Date: Fri, 19 Oct 2018 03:42:41 +0000
Enviousness-Salting: 749
Subject: Peaktolg, Security alert for your linked account ID 5545
Practicing-Appraisal: 1B9A175AD34D
Auto-Submitted: no
From: Accounts <deviouslyqfc@esd-gmbh.de>
X-IncomingHeaderCount: 13
Return-Path: deviouslyqfc@esd-gmbh.de
X-MS-Exchange-Organization-ExpirationStartTime: 18 Oct 2018 13:08:51.1151
(UTC)
X-MS-Exchange-Organization-ExpirationStartTimeReason: OriginalSubmit
X-MS-Exchange-Organization-ExpirationInterval: 2:00:00:00.0000000
X-MS-Exchange-Organization-ExpirationIntervalReason: OriginalSubmit
X-MS-Exchange-Organization-Network-Message-Id: c3cc7c5a-7f35-4d22-0412-08d634fad945
X-EOPAttributedMessage: 0
X-EOPTenantAttributedMessage: 84df9e7f-e9f6-40af-b435-aaaaaaaaaaaa:0
X-MS-Exchange-Organization-MessageDirectionality: Incoming
X-Microsoft-Exchange-Diagnostics: 1;CO1NAM03FT045;1:dA73coRXddZgN+2gP94r3d09P60DB0sa2oFep8BsZwXp2t35uxpYVvx1yZq4HafhY1WQ+hUiJyIEAxUG0FesesQR2n6q9UKPjIJKSerUhI8BHxm73YA+We5bRBSPV/cf
X-Forefront-Antispam-Report: EFV:NLI;
X-MS-Exchange-Organization-AuthSource:
CO1NAM03FT045.eop-NAM03.prod.protection.outlook.com
X-MS-Exchange-Organization-AuthAs: Anonymous
X-MS-PublicTrafficType: Email
X-MS-Office365-Filtering-Correlation-Id: c3cc7c5a-7f35-4d22-0412-08d634fad945
X-Microsoft-Antispam:
BCL:0;PCL:0;RULEID:(5000110)(711020)(4605076)(610169)(8291501071);SRVR:CO1NAM03HT056;
X-Microsoft-Exchange-Diagnostics:
1;CO1NAM03HT056;3:wZJt47nSL9QUEP5NJydVccL5w2yZVRUsNxHwSZYjAzc8Clre1YzLXwBvmCq99Y9DMzsIquxgYCJ59AFAFB82N9eyNnV+LlxE9yUuLWN4lgJEq1vWO4o4RwPN+aw6pyN2PaB47bGn9CFatyO8OTEGajv3hxCTA3f2GEzI64tshI7OEzjs//kgwZcYfOJjR34F6k60MwQ1G+ueRvd6aS+M5UJE8X8rytaXsZofcITzQ4Fp1t5cdcrI1nFWWUZG0OIi6CUFfU5RE+Qz7UudJDOjdfN75c16zp5XeCEegm/4C7TfBtVLAfxu+TrgzLNgEwcpFsU9OHwG68U+upRaAJ2c5g==;25:2VA5G1s0FEmPjxfsOaxmsbUbzibbFaQZM7imNh39RnA4+G6PONJbc7VYzVRZN2MXuZarxQdcA5V0xcfz6lz89gFlYYb0WeCo1vu+H0sswEqYX3OpU+8Zum5R9NakZxBwuhV14l7GDE4pBX2PDesX3a9aFMIt2L53ELm768JiLBNNLGJ4HUV7Ldhw1eNXMsJAPewZlahp6k0sy0IV1FQFf607R7T7mxpLj/f+6EF7tMkeFYNaYtjOXXCHlEe3CZ0qhzXU85doj1yESEwFRjxtr5KozwHn/egzTboQ8iB6za8Cm6vvu9bD0GRsTWFjmgxD50r+683OVib2DXFN7Exh4A==;31:JgkqW4xeI1iaPG8Ek7+Zg9QQgFK4ogn0WY4PwwD5wFyDX4SD4YQG7AEhkW/XMsvEyVLP8u394r5QT3dN4TppbTjqrF3GOA6JVNKy/Xs0IGQ5L9SWiiYydHGf8IIwCBogDrgjTJKiAjNOQ4O9O60a0mg9mf+R0uZAqD0IQrToafY+lg8+TVieaSMY6ItgsP0cJLxIaLwtnUXZbk6muRcsmUWdIVxsyw6QKfdlzfRaZDw=
X-MS-TrafficTypeDiagnostic: CO1NAM03HT056:
X-MS-Exchange-EOPDirect: true
X-Sender-IP: 221.121.12.250
X-SID-PRA: DEVIOUSLYQFC@ESD-GMBH.DE
X-SID-Result: NONE
X-MS-Exchange-Organization-PCL: 2
X-Exchange-Antispam-Report-Test:
UriScan:(192374486261705)(194151415913766)(71457273570760)(6911010853514);
X-Exchange-Antispam-Report-CFA-Test:
BCL:0;PCL:0;RULEID:(444111676)(1160499021)(52401380)(52601095)(52606095)(52602095)(52606095)(52602095)(52505095)(52406095)(52402095)(52303095)(52203095)(88862240)(88860193)(82015058);SRVR:CO1NAM03HT056;BCL:0;PCL:0;RULEID:;SRVR:CO1NAM03HT056;
X-Microsoft-Exchange-Diagnostics:
1;CO1NAM03HT056;4:vQOrINuWVLPlEqL+vyoGNWSHzlBAoTLMgLmGdfx5sRfh+E0uF9A4ru+QCnVZORobf2OkFz0HJHH9JBrSxSjRyPOdFyepPVa2IKgoK3W6sMkZsrOTwRGB+AxGE0Tq+bYMlpwtnAYE2iU6k/DTy4/zhoob5SFUmAnxJRw0T8kIOe0GOitqDX1J7nf3SEzX5C3/oErlvrJGraRgmVkYsZpgSfMftJNEvc5BRDzZDicVfgwakE8ko3+cTCc1WAolWr8yCK6sX+OedCe6DJI0VSabfvSlfbVPWHqgp0bnuq5DWiO0cEfBF04k4tg6Me/nUy2gzbbxBpEuVNtxX8VTfGAKLfxaLTuW0truX5647Z9CNxLvc4hEBwx7ia09IFvdNNYH8mZOug+7sr5w9Ggdj4MwFzBkVGZl5eC9XLsRbTQ3554=;6:AaKfXr6bIOnyVYGiPWESTQ5iiLRSaujSEzpncywK4uyCyA5bLkiJAQCkXvMLtaAA48rd3RtoO0HgnTwVjZh8FgxTT1xPt0XBD9GSl3PksF0jQMvfME4EoAmjhbveLoj9UNZrmq6AJPZ9K2fFJcnp+tPigZclTBpKb1+Vbsm/EFASY0mbPeBuFevQ6CAomSv/kcQLl1PQIDJRz2o4gbjICnV/YuVJsaieQoH09sNh0+uHqBpFrKwMgzw59n8caZsCCm1qrzdkPt388oYy0ahaPxOf2noFvfKXEj5SdojS2V92jF/XGVXeI/t/WNqCeqygnyXUDVACeb/mjjhKv1FNKq9c2I10ivXLdz3KS7j0P/8oILrX7lYsPsXcFPrKayGDL8JsXAK4H5lbw4jVcJ66XGEaNFafw5oih9L9U0aufhKiAwgytCHPlniArn3nNRPsqYp6YFPpbDTTne5AqOScPg==
X-Microsoft-Antispam-Message-Info:
4Co8BKw2N9ZsT7Rl7x/sq71yQ0rbRrVIWaXA0KCO4Pn2usJLNbaosrkg+2CtCk9EQY0vh9FPUahLdkJOs2C0FNWumk1X9e18anIHuOh1+lMQvgOlAJoGfeza5Xj8MNq1Y4CFF7w+V10LXEZeEoc2F0fl3r8zpXqJUkrk0pzmF6vsb2pXS8NRlYJy1liw11NI+OJFrrJSOjvjAJQ+ltc6tSxFyfpvXyiDegGX4gqyX+o9SlNdM/y5y8iSExfB5Pz7OM1YekbGLoVb134zDkyfdSrrDzX0ZSnX2qtv9tAEn4rU6+zC5lE3exIzbVwY6kmiNu2j6oWHHX+dOI4wdK2lpDii/VSYcBjZwwRn+fisB3FepslRP6UUaFILNv5S+xRdfy1OjPMXtE2+Jd/giBFZhzuCSEc2CTpneL9CQgV5T0SBGqwBTCyELb3SNVYsBSXvxbxgAQ3JM+woYwh4U/MbnR8Y5y770mkZjyXxK76VxIPyrWnbSTfdfVWn+v8CfdP4eZ12FEIfHaYQGCXJ6YPmXl3NWiRYZZx/HggbxHBPlug=
X-Microsoft-Exchange-Diagnostics:
1;CO1NAM03HT056;5:zZ2nKon1C76EzqmP/IexQrzJoO00Uh1I5DQvfCQrtxWtVXxH9pxUA2wAbM0wIPtw9lKUkTDH0SnnqIPuFBk+mq2xkILgXKgQuisxZ8a4YzwmfmnoNrwU8f4zjwDZmKcrVMeMXG8aXJEX7/CKggAp8Lp/8TDwwJ7m0vVDglWwOUE=;7:hIUUixZU/6+P7hk5uyNHWo2WZhm5wAjS/BWMWdApDUo/Qp/n3l0XxGk58BiIOxv9HS0QawASbJGOKbXLgXUCkUtTPFDitKZ1+ciShDulC1FtLGHnFYtGQAeD0kqy1AOCBEFHZVjZMgSFgOefZbuQhFFCNW1KQ6ocTXeYYa3zc5he9U0xnxLCIr+/XKwUOfsei6yNXeJ+wTfkhsE+RhRNMUryp/p2sEQ2JjuRAXrJqOp9Aq75CgQVsW8zrR7QVn2C
X-OriginatorOrg: outlook.com
X-MS-Exchange-CrossTenant-OriginalArrivalTime: 18 Oct 2018 13:08:50.4900
(UTC)
X-MS-Exchange-CrossTenant-Network-Message-Id: c3cc7c5a-7f35-4d22-0412-08d634fad945
X-MS-Exchange-CrossTenant-Id: 84df9e7f-e9f6-40af-b435-aaaaaaaaaaaa
X-MS-Exchange-CrossTenant-FromEntityHeader: Internet
X-MS-Exchange-CrossTenant-RMS-PersistedConsumerOrg:
24fd1209-d934-423e-a578-ee886993c07f
X-MS-Exchange-Transport-CrossTenantHeadersStamped: CO1NAM03HT056
X-MS-Exchange-Transport-EndToEndLatency: 00:00:01.7487984
X-MS-Exchange-Processed-By-BccFoldering: 15.20.1250.004

8 votes
Vote
Sign in
Check!
(thinking…)
Reset
or sign in with
  • sso
  • facebook
  • google
    Password icon
    Signed in as (Sign out)
    You have left! (?) (thinking…)
    thomas sheehan shared this idea  ·   ·  Flag idea as inappropriate…  ·  Admin →
    Completed  ·  AdminMicrosoft Outlook (Admin, Outlook.com) responded  · 

    Hey there!

    Thank you for using Outlook.com and reaching out to us regarding your recent experience.

    Currently, this channel is dedicated to feedback requests only, but we recently added in-app support to assist you with your questions and concerns.

    To contact in-app support please use the following steps:

    Sign into your email account on any web browser on a pc or Mac, www.outlook.com .

    Click the ? in the top menu bar to open the Help pane.

    Click on the Help link toward the bottom of the pane to open the Contact Support box.

    We look forward to assisting you there!

    All the best

    The Outlook Team

    PS: Please use the Help Section of the app for any questions, we are not able to see replies to this address.

    10 comments

    Sign in
    Check!
    (thinking…)
    Reset
    or sign in with
    • sso
    • facebook
    • google
      Password icon
      Signed in as (Sign out)
      Submitting...
      • thomas sheehan commented  ·   ·  Flag as inappropriate

        Failing filters, example 12, Last sample:

        Received: from SN1NAM01HT073.eop-nam01.prod.protection.outlook.com
        (2603:10b6:403:2::32) by BL0PR05MB5218.namprd05.prod.outlook.com with HTTPS
        via BN4PR12CA0022.NAMPRD12.PROD.OUTLOOK.COM; Fri, 5 Oct 2018 04:15:29 +0000
        Received: from SN1NAM01FT051.eop-nam01.prod.protection.outlook.com
        (10.152.64.58) by SN1NAM01HT073.eop-nam01.prod.protection.outlook.com
        (10.152.64.240) with Microsoft SMTP Server (version=TLS1_2,
        cipher=TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384) id 15.20.1185.13; Fri, 5 Oct
        2018 04:15:25 +0000
        Authentication-Results: spf=softfail (sender IP is 162.144.140.131)
        smtp.mailfrom=shorcan.com; hotmail.com; dkim=none (message not signed)
        header.d=none;hotmail.com; dmarc=none action=none header.from=shorcan.com;
        Received-SPF: SoftFail (protection.outlook.com: domain of transitioning
        shorcan.com discourages use of 162.144.140.131 as permitted sender)
        Received: from server.calasanzvirtual.com (162.144.140.131) by
        SN1NAM01FT051.mail.protection.outlook.com (10.152.64.150) with Microsoft SMTP
        Server id 15.20.1185.13 via Frontend Transport; Fri, 5 Oct 2018 04:15:25
        +0000
        X-IncomingTopHeaderMarker: OriginalChecksum:879BDE1FC1B608DBCF6E26C8BDFE0E245970980EC589ED356F4C2288DFCAC983;UpperCasedChecksum:8DC52D0BB39CA2C4082AD2EE5FBD45844FEB83B2AE6247838092C09CD12E9DF9;SizeAsReceived:976;Count:17
        X-LinkedIn-fbl: b172817d6744bb825ff1352de9d1e55aaa36f7378b6b2fa26a9baa
        X-LinkedIn-Id: b9fd96511cfbb8cbfe5fa959f7f22
        Content-Transfer-Encoding: 7bit
        X-LinkedIn-Class: EMAIL-DEFAULT
        Subject: You appeared in 5 search this week
        List-Unsubscribe: <https://www.linkedin.com/e/v2?e=aead39f13d75&t=lun&midToken=4d7754ce3b&ek=email_notification_single_search_appearance_05&li=7&m=unsub&ts=unsub&loid=46b347d6c2985e8c213a6e371c5b9741d9d29512642beb8d17e9952aac131b26>
        Message-ID: <a8728-7e692713138f@shorcan.com>
        X-LinkedIn-Template: email_notification_single_search_appearance_05
        To: Removed
        Feedback-ID: email_notification_single_search_appearance_05:linkedin
        Serif-Faults: universals
        From: LinkedIn <eludex0@shorcan.com>
        Content-Type: text/html; charset="UTF-8"
        Content-ID: html-body
        Require-Recipient-Valid-Since: peaktolg@hotmail.com; Fri, 5 Oct 2018 04:15:24 +0000
        Date: Fri, 5 Oct 2018 04:15:24 +0000
        X-IncomingHeaderCount: 17
        Return-Path: eludex0@shorcan.com
        X-MS-Exchange-Organization-ExpirationStartTime: 05 Oct 2018 04:15:25.5780
        (UTC)
        X-MS-Exchange-Organization-ExpirationStartTimeReason: Original Submit
        X-MS-Exchange-Organization-ExpirationInterval: 2:00:00:00.0000000
        X-MS-Exchange-Organization-ExpirationIntervalReason: Original Submit
        X-MS-Exchange-Organization-Network-Message-Id: 6faf4281-6461-495b-e07a-08d62a792d1c
        X-EOPAttributedMessage: 0
        X-EOPTenantAttributedMessage: 84df9e7f-e9f6-40af-b435-aaaaaaaaaaaa:0
        X-MS-Exchange-Organization-MessageDirectionality: Incoming
        X-Microsoft-Exchange-Diagnostics: 1;SN1NAM01FT051;1:Q+TxaTDV9XmnYz6j03VyB5xIHSUK9cga3+Ip2863u8Y+mJg66CWw+RQnyqHYsJxVcEGRlCyvqwRFICDUWmJrslMeAYxL1g+we7/SxiKjwZ0rxO2lS8RbUPSnczoqYGSP
        X-Forefront-Antispam-Report: EFV:NLI;
        X-MS-Exchange-Organization-AuthSource:
        SN1NAM01FT051.eop-nam01.prod.protection.outlook.com
        X-MS-Exchange-Organization-AuthAs: Anonymous
        X-MS-PublicTrafficType: Email
        X-MS-Office365-Filtering-Correlation-Id: 6faf4281-6461-495b-e07a-08d62a792d1c
        X-Microsoft-Antispam:
        BCL:0;PCL:0;RULEID:(5000110)(711020)(4605076)(610169)(630170)(8291501071);SRVR:SN1NAM01HT073;
        X-Microsoft-Exchange-Diagnostics:
        1;SN1NAM01HT073;3:vFGNhuQkWHOlHKuq9YGrvvTgQRYkvKoK2zk/PrUWqTgxV0CiPDpGdtN4seMHL2MHuS3Aw5InM5MXvG0yOf9PwJwd4cT7WrBfomFfRchXLrkUYXo1xe9y1Potwb9AsDcH6iI/kiWgCD9kz8YzlmGoI26lEw6HdAVXIdYkU4IupIu4LQnaTCZ+YI92biiBOTj3d1VQpt2GqpRWK5xDHsa+o2ZCDpoDJAQL7qUE+vxdmGVGU4c2MYmTMthypnA+McSjBXF+N+Ja/gvLeR2QZTCOkq5aMpJRyYqQqeVdipVlJWXVugAAVSG05cLB6WGug+jy;25:Nfnl+0NaSfIlXe6vP+KsSfoFBRC6eIrHYjQvW0cv8yvC4KDuOoX1f+VuOaQ8E1ev81gs4xGWQ9gNyWVqs7HIZGNRZsI1sPahl/vcCkUjIBWAnBhafcQP5d4jJzdyCg6BvJlKqMow/U+0TXnjBlvmLegOVyx5kch0mJHFeVbYseKMGhZEUsF0DRMJVEZeMMPGIO2hAErRusaK+LFapFTQezjEK4Lb8BOhD2PCJi2TY5U3UEPBs0OM5U6lbztYVFVYeLiPO+r4kUzfvrXrtTJXT35EmE9oFCDUiQ90OX7YNd+A1HcsABODK7dAYSYe04V8xJhMemkc+rCt5qFSNkl3JA==;31:4UAhXFnxhUVFUEJuzNWXWJjvMiEP4ivsroe4cpf3bBf/WSVMU94Fr8tZuJGQOZdWMZW4XEzZpN09BK8f7Xq419AezSB157N5yRrG1fG7DIA8y9fZ8Do9f0iL738+v8zNjSfTIbeUw3unc4Aj1AZ6ZsBbza+7Z2j5obzWOk5IRMqgVCChpKiq1dPwsLApl6r+8P0bVnB0swPw52zscmS0VKsWHpx7MjOc1bs9fc6EMQs=
        X-MS-TrafficTypeDiagnostic: SN1NAM01HT073:
        X-MS-Exchange-EOPDirect: true
        X-Sender-IP: 162.144.140.131
        X-SID-PRA: ELUDEX0@SHORCAN.COM
        X-SID-Result: FAIL
        X-MS-Exchange-Organization-PCL: 2
        X-Exchange-Antispam-Report-Test:
        UriScan:(194151415913766)(116415991822766)(190501279198761)(227612066756510)(240632212295403)(24487441151036);
        X-Exchange-Antispam-Report-CFA-Test:
        BCL:0;PCL:0;RULEID:(444111676)(2750499021)(52401380)(52601095)(52606095)(52605095)(52606095)(52605095)(52606095)(52605095)(52606095)(52605095)(52606095)(52605095)(52606095)(52605095)(52606095)(52605095)(52606095)(52605095)(52505095)(52504095)(5240

      • thomas sheehan commented  ·   ·  Flag as inappropriate

        Failing filters, example 11)

        Received: from SN1NAM01HT065.eop-nam01.prod.protection.outlook.com
        (2603:10b6:207:3d::42) by BL0PR05MB5218.namprd05.prod.outlook.com with HTTPS
        via BL0PR02CA0065.NAMPRD02.PROD.OUTLOOK.COM; Sat, 13 Oct 2018 18:40:56 +0000
        Received: from SN1NAM01FT027.eop-nam01.prod.protection.outlook.com
        (10.152.64.53) by SN1NAM01HT065.eop-nam01.prod.protection.outlook.com
        (10.152.64.177) with Microsoft SMTP Server (version=TLS1_2,
        cipher=TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384) id 15.20.1250.12; Sat, 13 Oct
        2018 18:40:55 +0000
        Authentication-Results: spf=fail (sender IP is 212.230.255.161)
        smtp.mailfrom=snolab.ca; hotmail.com; dkim=none (message not signed)
        header.d=none;hotmail.com; dmarc=none action=none header.from=snolab.ca;
        Received-SPF: Fail (protection.outlook.com: domain of snolab.ca does not
        designate 212.230.255.161 as permitted sender)
        receiver=protection.outlook.com; client-ip=212.230.255.161; helo=localhost;
        Received: from localhost (212.230.255.161) by
        SN1NAM01FT027.mail.protection.outlook.com (10.152.65.58) with Microsoft SMTP
        Server id 15.20.1250.12 via Frontend Transport; Sat, 13 Oct 2018 18:40:54
        +0000
        X-IncomingTopHeaderMarker: OriginalChecksum:CA52685198D7DF4E294E51800477C29F8527054C08D4685214B62417D51A3D9E;UpperCasedChecksum:272A472AC5304129C80ACA4FC5CED9EB98C818737EF8A49022AAD099E6387728;SizeAsReceived:569;Count:14
        From: Accounts <gshayer@snolab.ca>
        Sympathized-Longs: 84654
        Subject: Peaktolg, Critical security alert for your linked account ID 69718
        Message-ID: <89a2f8cab-2be749eb@snolab.ca>
        Contradistinction-Trapped-Corporal: fc197645b74b463
        Drove-Wheat: 8DB7E36CEB94927B
        Disowned-Timesharing-Gnawing: thanklessly
        Date: Sat, 13 Oct 2018 20:41:13 +0000
        To: Removed
        Content-Transfer-Encoding: 7bit
        Errors-To: upgqznbkjqm@snolab.ca
        Supposed-Inevitabilities-Arisings: 5
        Content-Type: text/html; charset="UTF-8"; format=flowed; delsp=yes
        X-IncomingHeaderCount: 14
        Return-Path: gshayer@snolab.ca
        X-MS-Exchange-Organization-ExpirationStartTime: 13 Oct 2018 18:40:54.9501
        (UTC)
        X-MS-Exchange-Organization-ExpirationStartTimeReason: OriginalSubmit
        X-MS-Exchange-Organization-ExpirationInterval: 2:00:00:00.0000000
        X-MS-Exchange-Organization-ExpirationIntervalReason: OriginalSubmit
        X-MS-Exchange-Organization-Network-Message-Id: 8c7e8bfc-5af7-4fff-3a93-08d6313b68bc
        X-EOPAttributedMessage: 0
        X-EOPTenantAttributedMessage: 84df9e7f-e9f6-40af-b435-aaaaaaaaaaaa:0
        X-MS-Exchange-Organization-MessageDirectionality: Incoming
        X-Microsoft-Exchange-Diagnostics: 1;SN1NAM01FT027;1:XDPq3HfAvdli/5ojBWmo7dyijcXCBLI3brcXmgB6tRUj6BpxDGbFmfRt9g7+Wx+rOXbOM2j9cLzV3PLx9sHHMWQTKEPiT+55Z02BuBOx0MQqf0EAclCaO/LnKQ3EpQMR
        X-Forefront-Antispam-Report: EFV:NLI;
        X-MS-Exchange-Organization-AuthSource:
        SN1NAM01FT027.eop-nam01.prod.protection.outlook.com
        X-MS-Exchange-Organization-AuthAs: Anonymous
        X-MS-PublicTrafficType: Email
        X-MS-Office365-Filtering-Correlation-Id: 8c7e8bfc-5af7-4fff-3a93-08d6313b68bc
        X-Microsoft-Antispam:
        BCL:0;PCL:0;RULEID:(5000110)(711020)(4605076)(610169)(630170)(8291501071);SRVR:SN1NAM01HT065;
        X-Microsoft-Exchange-Diagnostics:
        1;SN1NAM01HT065;3:bN586HRCA1SXLuSbJk4fwt6K1IlEfZ6VGzat6ZZKBdiR3nRcRZ1il1YrjLlZJnMVfonRL2pDX1sHvl1IOEGdJ74SK1I7rCOamJKphJeuJqzTwm4zLRWbyG5VBPfSlYf+ezE67+eQx9Vhyh3rWJrxYOqvdR0Kdls+be7lGRx4RpHQiVd6VQX65mkI0nwsJ4cd/iB8oAN+OHdluOCIn5DP7jL5GEcsMJnQgFLc2E9SA6JSCuClMP/f6BAeyF83nbYAP8pGDug7LyNqKcaFQi3IGwcw/qEB4EmjYl8WJn4RYIyYL2GzaPoy/VjgaepwSARKP9Z1DLfuc8aiU11bUgin/A==;25:l+l1dJZlUDCsvwjNDkH/x0AC0dhcqA788RhHKPEJpoFKUzGZPAnTdLik3AbfzNmhRO9/qbfRF6VJyf9A83xbZBSA2UwxM6MpnXMBqR04buCO32yqQyTqscjTgu9BK8bJ+E3L/boORh9NjZKtvrTAFXreEv5LFvdD/txrQR9l8skbtX4/JCugdKIP2qTjwtllzadTP4LIgd5iUpc3C/rysbi4mdjgt7forFBnAfovwLhwmd1EPyTDDWQ6F517Mt3LkETLKEIA/DBwXhJBc4V6dP3PDQg4xTYg4lGh8RGQz7YMgYZsXcLgbHahHSw+l4ElXfX/6+SzO6FbclzCSN5eJA==;31:s9XVBurHtc5kdrk7EVW2tLgFc9jtzCtuGiV65zzvWsspsN9M+4yl0LKURh0vfmmthJCBq3epb4FmV02eW0h8uHanJYp1FwkvmpWtujUO68oV31WxRRALfTu05Z7huMeF+TesV4Trui4CUJoTooujgkRjTpYIvF4Kchp4kL21M4cnVmnWhe4o6DHzmuM0tA4gK8CGp641FmFxF/OMXuxMLWVgVWbBOpfeUNH8oWBOGHc=
        X-MS-TrafficTypeDiagnostic: SN1NAM01HT065:
        X-MS-Exchange-EOPDirect: true
        X-Sender-IP: 212.230.255.161
        X-SID-PRA: GSHAYER@SNOLAB.CA
        X-SID-Result: FAIL
        X-MS-Exchange-Organization-PCL: 8
        X-Exchange-Antispam-Report-Test:
        UriScan:(192374486261705)(194151415913766)(71457273570760)(6911010853514)(140577242042927);
        X-Exchange-Antispam-Report-CFA-Test:
        BCL:0;PCL:8;RULEID:(444111676)(1160499021)(2220353)(52401380)(52601095)(52606095)(52602095)(52606095)(52602095)(52505095)(52406095)(52402095)(52303095)(52206095)(88862240)(88860193)(82015058);SRVR:SN1NAM01HT065;BCL:0;PCL:8;RULEID:;SRVR:SN1NAM01HT065;
        X-Microsoft-Exchange-Diagnostics:
        =?utf-8?B?MTtTTjFOQU0wMUhUMDY1OzQ6WnFoQm80V3lsaS95NlRCekNXNks1SU9iMTdX?=
        =?utf-8?B?TDZydkI4M1BaVXNBQllVSm5xWjNRcjB5b0xwbXBsLzhpUGxXWHJJM1Uvd1pE?=
        =?utf-8?B?d3cyTW53UXJpZnBueFVvM09jTHFFY1ZrcjJiZG5BdnlFSUJObVUzeERZN0dR?=
        =?utf-8?B?eGN5bmVZZWNDQWNtdm4vVUdJYWJ4QTRwRDloR2F6R0x5VFplZ3VaQ2x6WWlt?=
        =?utf-8?B?a2hBM3pmZ

      • thomas sheehan commented  ·   ·  Flag as inappropriate

        Failing filters, example 10)
        Received: from SN1NAM02HT253.eop-nam02.prod.protection.outlook.com
        (2603:10b6:207:18::43) by BL0PR05MB5218.namprd05.prod.outlook.com with HTTPS
        via BL0PR0102CA0030.PROD.EXCHANGELABS.COM; Mon, 15 Oct 2018 05:07:51 +0000
        Received: from SN1NAM02FT057.eop-nam02.prod.protection.outlook.com
        (10.152.72.57) by SN1NAM02HT253.eop-nam02.prod.protection.outlook.com
        (10.152.73.84) with Microsoft SMTP Server (version=TLS1_2,
        cipher=TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384) id 15.20.1250.11; Mon, 15 Oct
        2018 05:07:49 +0000
        Authentication-Results: spf=none (sender IP is 103.215.136.13)
        smtp.mailfrom=fogdata.se; hotmail.com; dkim=none (message not signed)
        header.d=none;hotmail.com; dmarc=none action=none header.from=fogdata.se;
        Received-SPF: None (protection.outlook.com: fogdata.se does not designate
        permitted sender hosts)
        Received: from web13.flexidomain.com (103.215.136.13) by
        SN1NAM02FT057.mail.protection.outlook.com (10.152.73.105) with Microsoft SMTP
        Server id 15.20.1250.11 via Frontend Transport; Mon, 15 Oct 2018 05:07:48
        +0000
        X-IncomingTopHeaderMarker: OriginalChecksum:58581C91849D620DA28B5D342F921CEE29E7B3FC81D52DA69A9DA728C4261757;UpperCasedChecksum:87B402633526F44A4E358832E851FF53102138897DC5E3E4A1ABDC4C8F4FCDD8;SizeAsReceived:530;Count:14
        Message-ID: <e215b_e8a9a_c45eefc@fogdata.se>
        X-PHP-Originating-Script: 1692:balancers.php
        Subject: Returned email message (Removed)
        Stationing-Revels: 98f9de14f5
        Ring-Corn: chassis
        Content-Transfer-Encoding: 7bit
        To: Removed
        Date: Mon, 15 Oct 2018 13:07:44 +0000
        Ailments-Multiplications-Woonsocket: 287
        From: GoogleSupport <fe28.vitamin90.jeca@fogdata.se>
        Unjustly-Ski-Bridged: 47
        Content-Type: text/html; charset="UTF-8"
        Errors-To: isfopedkelsbhfg@fogdata.se
        X-IncomingHeaderCount: 14
        Return-Path: fe28.vitamin90.jeca@fogdata.se
        X-MS-Exchange-Organization-ExpirationStartTime: 15 Oct 2018 05:07:49.6684
        (UTC)
        X-MS-Exchange-Organization-ExpirationStartTimeReason: OriginalSubmit
        X-MS-Exchange-Organization-ExpirationInterval: 2:00:00:00.0000000
        X-MS-Exchange-Organization-ExpirationIntervalReason: OriginalSubmit
        X-MS-Exchange-Organization-Network-Message-Id: bad9e879-ba6a-439a-7f2a-08d6325c2744
        X-EOPAttributedMessage: 0
        X-EOPTenantAttributedMessage: 84df9e7f-e9f6-40af-b435-aaaaaaaaaaaa:0
        X-MS-Exchange-Organization-MessageDirectionality: Incoming
        X-Microsoft-Exchange-Diagnostics: 1;SN1NAM02FT057;1:HKsO4zINQuEhwdFkhme0VusDfLV2/11PWGdtQz3jl6v7uaBeY4AqivBhBH0jIx29MBDT6pNzrFfarscaEVEUpNSpT+NEZW0DS25U8KiTd1+oF2SzUo6XPde4FYuh8J41
        X-Forefront-Antispam-Report: EFV:NLI;
        X-MS-Exchange-Organization-AuthSource:
        SN1NAM02FT057.eop-nam02.prod.protection.outlook.com
        X-MS-Exchange-Organization-AuthAs: Anonymous
        X-MS-PublicTrafficType: Email
        X-MS-Office365-Filtering-Correlation-Id: bad9e879-ba6a-439a-7f2a-08d6325c2744
        X-Microsoft-Antispam:
        BCL:0;PCL:0;RULEID:(5000110)(711020)(4605076)(610169)(8291501071);SRVR:SN1NAM02HT253;
        X-Microsoft-Exchange-Diagnostics:
        1;SN1NAM02HT253;3:wwEokiDzpNyt3dUS8GVF9uiL8YWgoukjBLkc7wzi9oFxTIY5bCRKWlWHkr3mjCZyv10NKmF9uRNVZJJ6YwHYl7sEwe4gHo7m5kiE/PtJb1AqKqxFcYVzgl5ikLzv4awPzE79DDNImu2EHGx8o+l0WRRpqi0OTVsVnQkfZcUs9Amh4Gv5Q6nA89ADM+KLtBi1AX0tbtmSw28ncGF6rQFriwELFyDBOSt0q7CW8OEhE678qmLWIBaqRgynOwOUhFAt5wa/i/OXQnyzgzuI7UMAIew6RL6tm2UYyO4h7Kxprx9SxOPYVfF2nPyTKCssHGP9cRLJOrex20q5Fi5PXQtUng==;25:4Ao9+/cQoK3OF0HWqUnTIkUqO49bY5ier+aM/AJj1Lz0pNxIGmn9zvdhChk8yofL+dP99ep5e0+46APAfHMts6tSz4AmvNG8ozreWYkpqm7E+4rqd58Yd5czcKDLILw1ZrNUXZ2CeEjeWFBgI5IG4OieENsiSDHm8k57KgmsyBudDAxxkKaodpUl7B7H0bkA0IWouRExykRoCBZ/XyL4gFhjOFSgwX27VfDCxEUIEo0CIVPzoJcfZ0sPcOEflyj/R6NnaLPlNSmDmL+Vgtbue5KqznrFm6KQAEDH5G89/ws7GYX+Xjs+Orvc5rONJTgCfvvRtvsJlfBo1Azmudt6Sw==;31:FDWdBTOOH3cI7HRIbsEVm38ps1CVCLHe65CHNvy/paLfnqeRdwwwRLPPXaPhUIXflS4sE7n7PoN3vMipglVf2WJhue6zY/7mD9tN1imgzgHpWyRslwjW+TlZ4kQMEE9vaMywEfzzkzbspyQBpJTsJh1GL81fV0Tl4sC3lgFafPtps6M3hSNQdkzXQYmNI65/jkT3eqqZe0TaxWfJhJdu/3Hj4hT9/1PGcghYsXyKshg=
        X-MS-TrafficTypeDiagnostic: SN1NAM02HT253:
        X-MS-Exchange-EOPDirect: true
        X-Sender-IP: 103.215.136.13
        X-SID-PRA: FE28.VITAMIN90.JECA@FOGDATA.SE
        X-SID-Result: NONE
        X-MS-Exchange-Organization-PCL: 8
        X-Exchange-Antispam-Report-Test: UriScan:(163750095850)(69424030613257);
        X-Exchange-Antispam-Report-CFA-Test:
        BCL:0;PCL:8;RULEID:(444111676)(2220353)(52401380)(52601095)(52606095)(52602095)(52606095)(52602095)(52606095)(52602095)(52505095)(52504095)(52406095)(52402095)(52305095)(52206095)(88862240)(88860193)(82015058);SRVR:SN1NAM02HT253;BCL:0;PCL:8;RULEID:;SRVR:SN1NAM02HT253;
        X-Microsoft-Exchange-Diagnostics:
        1;SN1NAM02HT253;4:AZH56ohqP9lcdZJ//CQbCA2mIGGY3uz/4Ufb6JrGa2afSAj+8tv0Q8kmhy5yReiAcmUCv7Og2T5Sdm4ah8mKtYxwxm9XTygE9XMWJYS16vtkCJB/Em8ki3Dj/HFcQJz9ScXOBtsFtZbYEhzZS57MQajIN/Wqq0mgE9wNusZxf3NTOD0wI53avU6IwE2RwdWoVqzyGabMYQWKu0/BP/Oi0+sgupH5q3Q16j7MqmHy18ajsTJ0j7GoF6N+Yhg0hl+1PCPXMlLIYVX9uGLYNjonRbd0lvx9pjIYNuxWxjHo6ibvZv+PyyLjGaNyJDH8MaBHc5NSnlE0YvQ2FJvOvbX9nMVVsQKR61L5D1ov19vBv0s=;6:85A21/Cym46IWVTmlGPuK+DMmBy7KghJFHton78sDG1T/IalJHV+IgKhQhaJpnQYUoQiz5liNA+3fUVyidUp7UpCHP5C/yM1Dte

      • thomas sheehan commented  ·   ·  Flag as inappropriate

        Failing filters, example 9)
        Received: from AM5EUR02HT047.eop-EUR02.prod.protection.outlook.com
        (2603:10b6:405:15::19) by BL0PR05MB5218.namprd05.prod.outlook.com with HTTPS
        via BN6PR1701CA0009.NAMPRD17.PROD.OUTLOOK.COM; Tue, 16 Oct 2018 09:59:50
        +0000
        Received: from AM5EUR02FT059.eop-EUR02.prod.protection.outlook.com
        (10.152.8.56) by AM5EUR02HT047.eop-EUR02.prod.protection.outlook.com
        (10.152.9.96) with Microsoft SMTP Server (version=TLS1_2,
        cipher=TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384) id 15.20.1228.17; Tue, 16 Oct
        2018 09:59:49 +0000
        Authentication-Results: spf=none (sender IP is 85.214.29.50)
        smtp.mailfrom=inoxmare.it; hotmail.com; dkim=none (message not signed)
        header.d=none;hotmail.com; dmarc=none action=none header.from=inoxmare.it;
        Received-SPF: None (protection.outlook.com: inoxmare.it does not designate
        permitted sender hosts)
        Received: from h2016842.stratoserver.net (85.214.29.50) by
        AM5EUR02FT059.mail.protection.outlook.com (10.152.9.204) with Microsoft SMTP
        Server id 15.20.1250.18 via Frontend Transport; Tue, 16 Oct 2018 09:59:49
        +0000
        X-IncomingTopHeaderMarker: OriginalChecksum:374FF0607A504827DFABD31FDDEA14A56D64EAC88527AA3094ED28CD30B2549A;UpperCasedChecksum:CD0556B099BF0C952356B18930BCAD0EB48D330D221E6C1594D2463D04F4CFDA;SizeAsReceived:366;Count:9
        Date: Tue, 16 Oct 2018 11:59:49 +0000
        Content-Type: text/html; charset="UTF-8"
        From: Chris Skaggs Support <alducci@inoxmare.it>
        Beguiles-Expansible-Malt: 7FFA9959F
        To: Removed
        Content-Transfer-Encoding: 7bit
        Message-ID: <d74dcd95.132c82b1.9625147147684@h2016842.stratoserver.net>
        Subject: You have private messages
        X-IncomingHeaderCount: 9
        Return-Path: alducci@inoxmare.it
        X-MS-Exchange-Organization-ExpirationStartTime: 16 Oct 2018 09:59:49.5333
        (UTC)
        X-MS-Exchange-Organization-ExpirationStartTimeReason: OriginalSubmit
        X-MS-Exchange-Organization-ExpirationInterval: 2:00:00:00.0000000
        X-MS-Exchange-Organization-ExpirationIntervalReason: OriginalSubmit
        X-MS-Exchange-Organization-Network-Message-Id: d912329c-70b5-4b43-7a08-08d6334e1c55
        X-EOPAttributedMessage: 0
        X-EOPTenantAttributedMessage: 84df9e7f-e9f6-40af-b435-aaaaaaaaaaaa:0
        X-MS-Exchange-Organization-MessageDirectionality: Incoming
        X-Microsoft-Exchange-Diagnostics: 1;AM5EUR02FT059;1:20vViReewPf5wkCkOzHfzQ41zb1RQ5PKxFAM8hkKTLATfRzg+yBM+jrEFc+Kr5fPpRr2U+bIbPJuxR2d1VEWpLy5a+R/Bd6jFcVk3RbGFtomyZ+G0kIy9Hmhakdd2WYF
        X-Forefront-Antispam-Report: EFV:NLI;
        X-MS-Exchange-Organization-AuthSource:
        AM5EUR02FT059.eop-EUR02.prod.protection.outlook.com
        X-MS-Exchange-Organization-AuthAs: Anonymous
        X-MS-PublicTrafficType: Email
        X-MS-Office365-Filtering-Correlation-Id: d912329c-70b5-4b43-7a08-08d6334e1c55
        X-Microsoft-Antispam:
        BCL:0;PCL:0;RULEID:(5000110)(711020)(4605076)(610169)(8291501071);SRVR:AM5EUR02HT047;
        X-Microsoft-Exchange-Diagnostics:
        1;AM5EUR02HT047;3:c1iDjOnPV6FcUOi6s6Jrnepq/squr3I+wgl80yQpXURvu2CMyavrXYUrLcqiOvxyhqIdKecYCzGP2wrdTxoHB9JzpV7mECuVCsNecRm3+8GP1ApnKKIHPs6WdjT/j38X3WXC15Jl5v6d3t0Xovxjcr4ZNkPcFHyQi1rF67MKkgXBbA0jHQz3dbqeOyeB8+c6TPYtssZfPWfPIO6xZBdPdghihv8uBAj/V0ICqCOxHzk0lLfqJWXhVvKk2GHJiDtM39/+VazJC9Btzzw1lpWbla3ZI1AuAjnaUSfMfntaU9BTA0cKF2mz20qZOK5dn/SwUvVyT3zzrvcXEwYSkNpAyA==;25:rlT9Ofhv290DK0kx67EO+f3ULw1dYCGa1+QmPCQ2t3d4pabsjg6+92NYH225hBxwCMuSAvy9eAkl8hAiHnE9vMJ/FydCtMdNyLWL3ikjYvzjkb8Qm2e6tXP9AVLTMduHdRuTij+ZlMS/UR//oa3e0DITzCkpZDf7nQPPyylqTDYPpeLki76qb+WwSDkTdyE2mwPK2AFrsWVWER1a8gS7won7PokNE+YegNUcExFEp3f9jL94o7FbTG8TlIvvTKeLSUEhrcomJdd38Ts2zf9SGAQnbj36zIJ4Vj24jKj7icu7Y0UV0lDU9vOrYP583PdTD7tHFjbWZJ8oanXCjdtE/Q==;31:egoDcj9S/p7AkzkYEg7219bfLzTsVBiSl7adgsOtRUaISwPIusFoV1UuTyfmEU+SqT21kJ0QhWX7MDmbQoT5nkpuvQxp+g2ZiwgGI5lfmvjVQ4GD/GUCk00jDj3v4e+tFT0AGXVUWtnPMAXEjstDXZIKVCXkkiigIRN+memaXupG2HbtwljqWlaMQhy+YeZY56KZ54B7ihc9epOmhqlk3obW0lS/6htM69Aj10UzSRs=
        X-MS-TrafficTypeDiagnostic: AM5EUR02HT047:
        X-MS-Exchange-EOPDirect: true
        X-Sender-IP: 85.214.29.50
        X-SID-PRA: ALDUCCI@INOXMARE.IT
        X-SID-Result: NONE
        X-MS-Exchange-Organization-PCL: 8
        X-Exchange-Antispam-Report-Test:
        UriScan:(194151415913766)(135811390041837)(38223240042209);
        X-Exchange-Antispam-Report-CFA-Test:
        BCL:0;PCL:8;RULEID:(444111676)(1160499021)(2220353)(52401380)(52601095)(52606095)(52606095)(52606095)(52606095)(52505095)(52406095)(52303095)(52206095)(88862240)(88860193)(82015058);SRVR:AM5EUR02HT047;BCL:0;PCL:8;RULEID:;SRVR:AM5EUR02HT047;
        X-Microsoft-Exchange-Diagnostics:
        1;AM5EUR02HT047;4:mX5+j6xzzcH+eM6qja+3Ntaqqhu8LmxW8LbE5uuX4OEp8ceobFxsC/NLO0jnLRkkaw1+WGQavn+hpbvARsI7TmY+MYF2QOakTOmoHZdNnBaxhVge35CmJ7Tn25SbcFolgZgcihCQnRK769M/wRvDbPedl2kUSzySviPeLHE/BV5BrvkJ1VbmH+8/XWBfJFnpYsVksFWdENOwFqX/itKbiGafcgBHjyTBAas0JrpwFy6mLzJ4/5zRdgJTX4vXBV16LSblilbiOCMAHfJ8OW9My0jIGeG/9YQ47hatSeG59UjDYGKhid6O4xNBEh3kBk1Fxy4lAGYfYjsmdund6Z/JaPBLbT7npJY/53dWVb9WlBuvzzBMZ0J2OYgY9SuobaO2;6:oHEPeCsVpkoOAo9Fn+Q1HUNFpCX1OGFQhHm3cL7SW22t4Pfp8+59pZhQzUmiDPJ20uSp3jjh2akqUbp/c7qn09ETc2tiVAEzNR2XKqcSW23IOR/yfTCVMunW6UFSuz0ZEW3BFDl0KihZVW6Rn6RNaG7OHV/Se3JfgXdd4mQy7JdBJTQ4bWQDT+e8t1fqLonh8VlHss+GXJ0HJ6gjVYnneZ+hAwThtH7DNF2TJlhoBrn1htUV6bF7MS8ohJt8/X

      • thomas sheehan commented  ·   ·  Flag as inappropriate

        Failing filters, example 8)

        Received: from AM5EUR03HT230.eop-EUR03.prod.protection.outlook.com
        (2603:10b6:404:b6::23) by BL0PR05MB5218.namprd05.prod.outlook.com with HTTPS
        via BN6PR08CA0085.NAMPRD08.PROD.OUTLOOK.COM; Tue, 16 Oct 2018 11:42:43 +0000
        Received: from AM5EUR03FT056.eop-EUR03.prod.protection.outlook.com
        (10.152.16.59) by AM5EUR03HT230.eop-EUR03.prod.protection.outlook.com
        (10.152.17.169) with Microsoft SMTP Server (version=TLS1_2,
        cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.1250.12; Tue, 16 Oct
        2018 11:42:42 +0000
        Authentication-Results: spf=softfail (sender IP is 217.160.235.20)
        smtp.mailfrom=cox.com; hotmail.com; dkim=none (message not signed)
        header.d=none;hotmail.com; dmarc=fail action=none header.from=cox.com;
        Received-SPF: SoftFail (protection.outlook.com: domain of transitioning
        cox.com discourages use of 217.160.235.20 as permitted sender)
        Received: from eduklab.com (217.160.235.20) by
        AM5EUR03FT056.mail.protection.outlook.com (10.152.17.224) with Microsoft SMTP
        Server id 15.20.1250.12 via Frontend Transport; Tue, 16 Oct 2018 11:42:42
        +0000
        X-IncomingTopHeaderMarker: OriginalChecksum:FA14197983D9F6C22F88F0FD54F7F6572506C7942C50409142AE00BF80D28849;UpperCasedChecksum:5758B9574B6FC63CB39C614C17B0131A740651F3D66107BE0F503DFA20CF2184;SizeAsReceived:478;Count:12
        To: Removed
        Subject: Cerys Keyes sent you a Private invite
        From: Cerys Keyes <jose.agosto@cox.com>
        Signature-Incompetents: enameling
        Content-Transfer-Encoding: 7bit
        Savagers-Contester-Booms: F6922F81985384
        Content-Type: text/html; charset="utf-8"
        Date: Tue, 16 Oct 2018 13:42:42 +0000
        Cometary-Intelsat-Baptists: 1bd62372d
        Message-ID: <20181016014242.F47A0B6D29@cox.com>
        Expressible-Critiquing: contrasted
        X-IncomingHeaderCount: 12
        Return-Path: jose.agosto@cox.com
        X-MS-Exchange-Organization-ExpirationStartTime: 16 Oct 2018 11:42:42.6698
        (UTC)
        X-MS-Exchange-Organization-ExpirationStartTimeReason: OriginalSubmit
        X-MS-Exchange-Organization-ExpirationInterval: 2:00:00:00.0000000
        X-MS-Exchange-Organization-ExpirationIntervalReason: OriginalSubmit
        X-MS-Exchange-Organization-Network-Message-Id: 4dbfa43f-1cec-4941-5ba6-08d6335c7bcf
        X-EOPAttributedMessage: 0
        X-EOPTenantAttributedMessage: 84df9e7f-e9f6-40af-b435-aaaaaaaaaaaa:0
        X-MS-Exchange-Organization-MessageDirectionality: Incoming
        X-Microsoft-Exchange-Diagnostics: 1;AM5EUR03FT056;1:YplGAqqf1Qpt7Iizvdb02ZhVMgrleNyYLH4hqccR5+75qkdQNPYjgvJNMHRhZ24J53HW1JQITHsKBC1L2ZUHVtK0oM1yhzBoJcg1CKnhSvEQyQ/RSeR2/OZIr6xI4N2B
        X-Forefront-Antispam-Report: EFV:NLI;
        X-MS-Exchange-Organization-AuthSource:
        AM5EUR03FT056.eop-EUR03.prod.protection.outlook.com
        X-MS-Exchange-Organization-AuthAs: Anonymous
        X-MS-PublicTrafficType: Email
        X-MS-Office365-Filtering-Correlation-Id: 4dbfa43f-1cec-4941-5ba6-08d6335c7bcf
        X-Microsoft-Antispam:
        BCL:0;PCL:0;RULEID:(5000110)(711020)(4605076)(610169)(630170)(8291501071);SRVR:AM5EUR03HT230;
        X-Microsoft-Exchange-Diagnostics:
        1;AM5EUR03HT230;3:6P+/xhLYlOol2zxxkiGhtlKAoNpC+aNe5RpKQfprpoC+DCk6+MqI9NF+3RpZuAH7Qd/j9L5pJW/6/pt9aUTnt66qBBZRGRoRJ5ZFblU57tKp5G1a2xoLoYsEQ1OwnjqV5NKPVORGopkxEDR35+opmlIM5HWWghxfHCjadTJZU38PqgocZtlUCE0WoMQ6mGrlDqklxVamgX/UxSZtGwO+lXIxsik2xc9O4PKR9lXPCsQYLO7oncdmMNhNJhuAGUIRRh4LrU/4tIyAFI7FkLJomIaQ/1IjSS0bV3Y7N8f3mQ4ZxQAe2molySd6k38KxX1YRzgjWQIESPBquizoQr7C8w==;25:hsmY9pMu3gvINkxQK4XMzFtFZ777ScgMoxfL0CTHCrKvA75gcBrRf5SnwRwIbWJ4J44AiRtbQBYdlVpjMb8yrVET7ThZT9STCJxvRMLeRwbReMzGrocRB3/IAPv0U2rF62tuLDp2+Vy2z5OlX/xlRiRNgLLARnr6lljqxRD07sM5k8I3iCtiAM9YgdI34T6T7hgT+UPc7wr+0O8Xjb9AJZgVnPsXiYkfTr8gyb5NcU5VT1JHOtvprBba4q9UE9bmR6ZxurOPIqb7fzDMjLPPzHfKt3UwMMqDLhndXMA6e4U2ujq8YaB0LO1bAMzX9+nEqCzo+UgtNIJlNSBUwdmwhA==;31:+HCGjfve1lblDfuC5fDOHIm0n1io80U9a++cWMwTsTHS8lzgBqBXvxjjy/xwfrj2N3vvixn7dLDR5IwZt+ozf7hUH/DtjUVVNtzTYYX1a2A3PX/XdtJEFIqbL4MXEH5quMvno9XUu5A1Vyiw7rpaNiWFCx+2n2ZkiaAxwjOUdTlXkaQ5i9HZygwrbNWKNprE+9ehF0bxFfPShXbifiG0QgDYlcvnmLTQ6f3qPtyOcXY=
        X-MS-TrafficTypeDiagnostic: AM5EUR03HT230:
        X-MS-Exchange-EOPDirect: true
        X-Sender-IP: 217.160.235.20
        X-SID-PRA: JOSE.AGOSTO@COX.COM
        X-SID-Result: FAIL
        X-MS-Exchange-Organization-PCL: 2
        X-Exchange-Antispam-Report-Test: UriScan:(107671067580682)(166494164430575);
        X-Exchange-Antispam-Report-CFA-Test:
        BCL:0;PCL:0;RULEID:(444111676)(2300196)(52401380)(52601095)(52606095)(52602095)(52606095)(52602095)(52505095)(52406095)(52301095)(52205095)(88862240)(88860193)(82015058);SRVR:AM5EUR03HT230;BCL:0;PCL:0;RULEID:;SRVR:AM5EUR03HT230;

      • thomas sheehan commented  ·   ·  Flag as inappropriate

        Failing filters, example 7)

        Received: from VE1EUR03HT200.eop-EUR03.prod.protection.outlook.com
        (2603:10b6:207:3c::38) by BL0PR05MB5218.namprd05.prod.outlook.com with HTTPS
        via BL0PR02CA0025.NAMPRD02.PROD.OUTLOOK.COM; Wed, 17 Oct 2018 16:45:13 +0000
        Received: from VE1EUR03FT031.eop-EUR03.prod.protection.outlook.com
        (10.152.18.51) by VE1EUR03HT200.eop-EUR03.prod.protection.outlook.com
        (10.152.18.191) with Microsoft SMTP Server (version=TLS1_2,
        cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.1250.12; Wed, 17 Oct
        2018 16:45:03 +0000
        Authentication-Results: spf=none (sender IP is 104.131.133.63)
        smtp.mailfrom=klehr.com; hotmail.com; dkim=none (message not signed)
        header.d=none;hotmail.com; dmarc=permerror action=none header.from=klehr.com;
        Received-SPF: None (protection.outlook.com: klehr.com does not designate
        permitted sender hosts)
        Received: from localhost (104.131.133.63) by
        VE1EUR03FT031.mail.protection.outlook.com (10.152.18.69) with Microsoft SMTP
        Server id 15.20.1250.12 via Frontend Transport; Wed, 17 Oct 2018 16:45:03
        +0000
        X-IncomingTopHeaderMarker: OriginalChecksum:97E894DC6E30EA1BAF5136F250A47F3A296974D52319C20E3F61FC076EB92198;UpperCasedChecksum:429C678991B757862A21544750B67D0650B57B6A82B1AD9869E76C43E22A9AF4;SizeAsReceived:461;Count:12
        To: Removed
        Date: Wed, 17 Oct 2018 16:45:03 +0000
        From: Joann Solarin Advisor <mcnsynthetic@klehr.com>
        Message-ID: <f87ba.6379e835.e13181e@klehr.com>
        Eligibility-Excuse-Reciprocate: 81C795A7ED1FCFFF
        Content-Transfer-Encoding: 7bit
        Edmonds-Impostor: EC92594E2
        Content-Type: text/html; charset="UTF-8"
        Deviants-Defaulted: d5a95d6e9
        Real-Encamping: 3
        Subject: New order Joann Solarin Advisor
        X-IncomingHeaderCount: 12
        Return-Path: mcnsynthetic@klehr.com
        X-MS-Exchange-Organization-ExpirationStartTime: 17 Oct 2018 16:45:03.8917
        (UTC)
        X-MS-Exchange-Organization-ExpirationStartTimeReason: OriginalSubmit
        X-MS-Exchange-Organization-ExpirationInterval: 2:00:00:00.0000000
        X-MS-Exchange-Organization-ExpirationIntervalReason: OriginalSubmit
        X-MS-Exchange-Organization-Network-Message-Id: 01068694-f2d7-496e-e347-08d6344fe33b
        X-EOPAttributedMessage: 0
        X-EOPTenantAttributedMessage: 84df9e7f-e9f6-40af-b435-aaaaaaaaaaaa:0
        X-MS-Exchange-Organization-MessageDirectionality: Incoming
        X-Microsoft-Exchange-Diagnostics: 1;VE1EUR03FT031;1:H9jQt8cnL2D/rSjd3mr+sq/tvhUInVKHzErFJXYRYaLjc6SYy70X2sAO0daip7S2cbjsBSSLN/hRLYVDzaLbu/ou3Nht+yefgtp51x0dGwl9rHNp4SikQgHBeXQRGoPM
        X-Forefront-Antispam-Report: EFV:NLI;
        X-MS-Exchange-Organization-AuthSource:
        VE1EUR03FT031.eop-EUR03.prod.protection.outlook.com
        X-MS-Exchange-Organization-AuthAs: Anonymous
        X-MS-PublicTrafficType: Email
        X-MS-Office365-Filtering-Correlation-Id: 01068694-f2d7-496e-e347-08d6344fe33b
        X-Microsoft-Antispam:
        BCL:0;PCL:0;RULEID:(5000110)(711020)(4605076)(610169)(8291501071);SRVR:VE1EUR03HT200;
        X-Microsoft-Exchange-Diagnostics:
        1;VE1EUR03HT200;3:J/DkxonZr7XWkBvkCHBOLaA65XDpY0MUDB/tnuLL6+n0BuiXVO4qI9MYgNjOsA/54cpAi4eWt5mb/ITVc1wyNWW/uQFLwutJB8sWChUjM0Vgd7WKrjwKZY7tTNnDdMjOhuzFfSlwTt6jsdCwbsQ7qlF0lXjI8pqtb8vZ01Vn5XEOYNNzwHLXjG0UMXR4+ohQ31O/eTaLEtONI9d2fM8gwN3kpCY3a4M64F1pb/E4Kfr2JoTrxfKzGmdBei5OBc54T9cfkpZLXD74DSo5BTohqwdrkZ/ieQbCo4gM9+OLienPqzHINBAzUU3czzTqssiCAbHO4mlXoJqyM05ajDMWGQ==;25:9GwMXuE0WFA5eUJcAef1ichNZz+PaQxauD+e8xUGXXyM2yC7we1cq7nlKKqM5QXixUs5y3GgmJTtDTWLuVH0pyvccIhj6UGDvayr/+XxrTAVi569qdZt1xNI5hh7DGqdmoEjPxepaBceY0FoJ6w/ihYdBKlxAMA3IqWlPJyHwZRksyU3XpzmJu7pq5teJY1rEqxnQzNvu5F9PwH6sHhokpZV4AoX9N3zF8g0mkDcvbrsa+n1E+SV9ofUAFn4VJIsaD6+RYGzEJlVErktqVP6XGA+kvthUJYGAcU8h3wupocLl60NzOk22b51hhXwWLR8Dk+s2tUvrCFGSHsglW7CVw==;31:Eup4MtAEKNBUpVkUOtrtdqm7lBP27xIR06J/A6h1/uxnFimtGJFPtFY+MEhNiiCAt1se06uKtvvPgs0LnlAcPBrxjbUpUTqD8IPfLBFyhXuSD+hm3ZYkdj/1ys5z+E48kCStW6W2Q67vTb/OH/gFGk6pAnJgL5zmdUKhbJlKM9f79VXZ0g/MuiKoManyVZuVXGpHKZ0BkF8EpwGGJnDkfj7eDoFkL56Vguzxxx1ZVgM=
        X-MS-TrafficTypeDiagnostic: VE1EUR03HT200:
        X-MS-Exchange-EOPDirect: true
        X-Sender-IP: 104.131.133.63
        X-SID-PRA: MCNSYNTHETIC@KLEHR.COM
        X-SID-Result: NONE
        X-MS-Exchange-Organization-PCL: 8
        X-Exchange-Antispam-Report-Test: UriScan:(196560044828405);
        X-Exchange-Antispam-Report-CFA-Test:
        BCL:0;PCL:8;RULEID:(444111676)(1160499021)(2220353)(52401380)(52601095)(52606095)(52603095)(52606095)(52603095)(52606095)(52603095)(52505095)(52406095)(52402095)(52305095)(52206095)(88862240)(88860193)(82015058);SRVR:VE1EUR03HT200;BCL:0;PCL:8;RULEID:;SRVR:VE1EUR03HT200;
        X-Microsoft-Exchange-Diagnostics:
        1;VE1EUR03HT200;4:NFXYPXOokJt4g0HglsH3HcyoZqlgeGu8M7ZK+Kg91iAw/fKFksOq5b0EMqARhyB3XZzF2uYcFhIG3UB1+/7uFW1QAa7V7xgz2uRemHCMvJ+lbuwTsqu5ptr9KHrKSNO698Y0kr/20kNNbcbBUpHlEbubQQ5lI5WXbo40ps6EPqHimzaHotpWR/6rMD+***/CWQMTph00yPpndLE+RhlL/QTw+JHibx3eOTohQcHpvMWGhaaaqSVYeRX/9or1KWVwfmsbSfZeXmRWAGC8nsX7crv2p17jcknjIOsh/UorPc7IOosaGmOjMU+BMfamA+L5;6:yJaWW7fBVt4Lwv01Nx5B5D7bUT4Qlkc17J+3nFRVZZC82byWcKzZJtau9AhlMj48fKpgavyvqjG4k152jW8op/DBOG+RV4qAEf+oHoMxU33lbvIcjVi9I5jYmWFdzuQJ64nMPPqLNllYqCGg9bJSOAqOy6jdpl6MHyVTRPoNcnXiANw2Q5ZxaZAffmG/Fv0seN2YqB0iG7S6+cgM0vw5xFc0egCoKIXDOP0uwXHJbPpvEGuyTVJfGGH/

      • thomas sheehan commented  ·   ·  Flag as inappropriate

        Failing filters, example 6)

        Received: from DB5EUR03HT132.eop-EUR03.prod.protection.outlook.com
        (10.172.112.156) by BL0PR05MB5218.namprd05.prod.outlook.com with HTTPS via
        BN6PR2001CA0018.NAMPRD20.PROD.OUTLOOK.COM; Thu, 18 Oct 2018 00:04:25 +0000
        Received: from DB5EUR03FT038.eop-EUR03.prod.protection.outlook.com
        (10.152.20.54) by DB5EUR03HT132.eop-EUR03.prod.protection.outlook.com
        (10.152.21.140) with Microsoft SMTP Server (version=TLS1_2,
        cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.1250.12; Thu, 18 Oct
        2018 00:04:23 +0000
        Authentication-Results: spf=none (sender IP is 46.101.118.37)
        smtp.mailfrom=fcmail.com; hotmail.com; dkim=none (message not signed)
        header.d=none;hotmail.com; dmarc=none action=none header.from=fcmail.com;
        Received-SPF: None (protection.outlook.com: fcmail.com does not designate
        permitted sender hosts)
        Received: from localhost (46.101.118.37) by
        DB5EUR03FT038.mail.protection.outlook.com (10.152.21.84) with Microsoft SMTP
        Server id 15.20.1250.12 via Frontend Transport; Thu, 18 Oct 2018 00:04:23
        +0000
        X-IncomingTopHeaderMarker: OriginalChecksum:BBAB35B07D985636928B8386057053A27DD8ED4D8BEBFD98B609804F8B14BAB4;UpperCasedChecksum:FC477A880879890C273898CE8691E94F22AFD6CEBD07462D24F440FC5AFD3D89;SizeAsReceived:534;Count:14
        Message-ID: <42a3de2e95691.b58e997@fcmail.com>
        To: Removed
        Content-Transfer-Encoding: 7bit
        Date: Thu, 18 Oct 2018 00:04:23 +0000
        From: Service <guns4@fcmail.com>
        List-Unsubscribe: <mailto:pqjwnahc@fcmail.com>
        Forcibly-Transient-Curls: 5
        Content-Type: text/html; charset="UTF-8"; format=flowed; delsp=yes
        Subject: Peaktolg, Critical alert for your account #73884
        X-Auto-Response-Suppress: None
        Czech-Contester-Compare: 82
        Errors-To: wxqbeedryh@fcmail.com
        Duplications-Catheters: 2f6df32b
        X-IncomingHeaderCount: 14
        Return-Path: guns4@fcmail.com
        X-MS-Exchange-Organization-ExpirationStartTime: 18 Oct 2018 00:04:23.8420
        (UTC)
        X-MS-Exchange-Organization-ExpirationStartTimeReason: OriginalSubmit
        X-MS-Exchange-Organization-ExpirationInterval: 2:00:00:00.0000000
        X-MS-Exchange-Organization-ExpirationIntervalReason: OriginalSubmit
        X-MS-Exchange-Organization-Network-Message-Id: 187b36a1-34ee-4e86-1a32-08d6348d42fd
        X-EOPAttributedMessage: 0
        X-EOPTenantAttributedMessage: 84df9e7f-e9f6-40af-b435-aaaaaaaaaaaa:0
        X-MS-Exchange-Organization-MessageDirectionality: Incoming
        X-Microsoft-Exchange-Diagnostics: 1;DB5EUR03FT038;1:FZVQYoAYkV+Ux0h4h3WAEqkGRX6xbonfzJ3CfnHbxmGjEnthUGUJAW9Y8TlE3r05hcS1ORAGZtI7p1VIbEuMlt2LR/RvSnrpxJ+oHos2kNlKifPoAFt01/HB57fhkSyd
        X-Forefront-Antispam-Report: EFV:NLI;
        X-MS-Exchange-Organization-AuthSource:
        DB5EUR03FT038.eop-EUR03.prod.protection.outlook.com
        X-MS-Exchange-Organization-AuthAs: Anonymous
        X-MS-PublicTrafficType: Email
        X-MS-Office365-Filtering-Correlation-Id: 187b36a1-34ee-4e86-1a32-08d6348d42fd
        X-Microsoft-Antispam:
        BCL:0;PCL:0;RULEID:(5000110)(711020)(4605076)(610169)(8291501071);SRVR:DB5EUR03HT132;
        X-Microsoft-Exchange-Diagnostics:
        1;DB5EUR03HT132;3:4sCYgkgonehBMaaVh69ogmHL6/CSwFZc8ZAS4pPYZB/d8wbEr0auuOUT7V+DuyClp4rc1TB6KFAKK1c74qQqu/jR4zyh2c0x8WY5nfVZXUPvCX3trl68W3VdZQbwv05iw1/zqjCIEx0b7GT0GPXlJo5OdFDZAzmC73fYEOH6XLNgexh2umjFW3WOY0aPI+xHO22kQtNWmqiRPm6j49ACBXhEvLpkwgcEw4xyIpWhIGgVc9yFgwGtazV0k3O/t6yz8TS6TZUWt3thuExmDSPCE8V6+6ozL7kSi5bDc2BGnLId/0HbWKnaxzUW0xIq8ES6Q6ULC+DNpBAptjar1gU5ww==;25:R4CDsTavVe7usvo3AuqwoMzxuCZw8MzpXQLl+ahCv9udkuaZAUPSyuIpWTgVdMiu/rJqvTXJ85Mv8Z81W/9naOOdNA86MHjRhxmg3qjGe5IeEd8gxklT+pijN0dYeGgt2ZoF5ilHkpuZmxkd9kcTt5M8qy6HgxOBqcaXutApJWL4F8KNjx0sJEHps+d5zmYf3DChYPHsieijgxNNwyNup77eyOh9xGIUcViw+Ljnf7TMlhIAUUjoC9MogBctBtZ+8RocsPHynm2j0kiajGXPTTvsRJRWTU4H72FTKMRN4k+A6QFDrIiz3HWXG+iBEfoDru617sx5zgA4f5tBdlrvNb3wbs2J8tnebMbrt84ibW0=
        X-MS-TrafficTypeDiagnostic: DB5EUR03HT132:
        X-MS-Exchange-EOPDirect: true
        X-Sender-IP: 46.101.118.37
        X-SID-PRA: GUNS4@FCMAIL.COM
        X-SID-Result: NONE
        X-MS-Exchange-Organization-PCL: 8
        X-Microsoft-Exchange-Diagnostics:
        1;DB5EUR03HT132;31:3/aGcnxRGR6i8c8N8MAan4AZr195GjfjDVf8xkWHEQtCMyWd9VgktAgA3vp24DLxYfpK+mwyQmuGT/5ujzfcA5Z8igSVfbDHZVOH3ER9KcBnCm1IdD2h+SRX8ePOVb8iq0VzwO/EtAOjJN+6GB03QMDP0o4qomqNe4RXc97H2IetZaiXtEUolwV3hhckR/vjlboHUrj1R2pZQBJLSpt8iD+3QQp0BESrsyuRPSvNkEk=;4:z5qcjDiuxdlJnL4BLFfy1rgH8/2nZI5LJBq5Btbxq3d88HHn007iqWoPcp03CP9V9/TRru6OA3cX+kQUs0VqsLJhuTKpAhlLhFtJQQjgjPgqvZVRhXc8Hry7MvCKB4QFIjVGXz5H95hlqdNXdICcj++yq1+DTTm3dm/v/ZA9ALJ7VzZNvoCtb4W3shAz1EZyeg8EzXDIGEcIk4yhIbjX55ioew0nWyCMGsUL8GDCCeDnjQ/iJzTzwZtOItSYHmzJgiTIDkkjKAQW15N+fkDDbC7l8dPiSrZP2e0AutG/HZqII6xsFzjspt3QorryXxQc24w9+I0HThrylDTEkdomH5Cgx+zfIbdCnO4n9qI/rIbfSZRf5DgILMQE6Meuou7yoNx7TR/Q1BiZ6BW5SRnGLFhn2W0ulnYSm7rCXL6+Ylsjg/dMLIU6LE96+2v3p4jK80a4ejBqZ4Lac7qVNMM4lnZgatMrNuiZ6lZ/F0qOcXc=
        X-Exchange-Antispam-Report-Test:
        UriScan:(78813514240607)(194151415913766)(71457273570760)(6911010853514)(120474695177632)(3908916348139);
        X-Exchange-Antispam-Report-CFA-Test:
        BCL:0;PCL:8;RULEID:(444111676)(2220353)(52401380)(52601095)(52606095)(52602095)(52606095)(52602095)(52505095)(52501095)(52406095)(52402095)(52303095)(52206095)(88862240)(8886

      • thomas sheehan commented  ·   ·  Flag as inappropriate

        Failing filters, example 5)

        Received: from SN1NAM01HT070.eop-nam01.prod.protection.outlook.com
        (2603:10b6:404:13f::17) by BL0PR05MB5218.namprd05.prod.outlook.com with HTTPS
        via BN6PR14CA0031.NAMPRD14.PROD.OUTLOOK.COM; Thu, 18 Oct 2018 03:54:37 +0000
        Received: from SN1NAM01FT020.eop-nam01.prod.protection.outlook.com
        (10.152.64.60) by SN1NAM01HT070.eop-nam01.prod.protection.outlook.com
        (10.152.65.253) with Microsoft SMTP Server (version=TLS1_2,
        cipher=TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384) id 15.20.1250.12; Thu, 18 Oct
        2018 03:54:36 +0000
        Authentication-Results: spf=none (sender IP is 178.62.64.240)
        smtp.mailfrom=freightliner.com; hotmail.com; dkim=none (message not signed)
        header.d=none;hotmail.com; dmarc=none action=none
        header.from=freightliner.com;
        Received-SPF: None (protection.outlook.com: freightliner.com does not
        designate permitted sender hosts)
        Received: from 87541-68311.cloudwaysapps.com (178.62.64.240) by
        SN1NAM01FT020.mail.protection.outlook.com (10.152.65.195) with Microsoft SMTP
        Server id 15.20.1250.12 via Frontend Transport; Thu, 18 Oct 2018 03:54:36
        +0000
        X-IncomingTopHeaderMarker: OriginalChecksum:68D345B02C3F68D946815D27E997D07C2B6F38F9747B7A4799A1BC394EA72FAC;UpperCasedChecksum:66F85858BBF09AF25CFE30ABAA317D5DA9AE370411ED64018EB34BB9B834AAC8;SizeAsReceived:513;Count:13
        Subject: Shipping charge
        Content-Transfer-Encoding: quoted-printable
        From: Sherman Dillard Chief <pranalysts@freightliner.com>
        Message-ID: <38d7f6282.925d65e8.6247968356963@87541-68311.cloudwaysapps.com>
        To: Removed
        Contrary-Rename: C46732947CAD778
        Stag-Hide: B8C197E65A1EFB
        Pretender-Reconstructs: 5EC792792A
        Impossibility-Returns: d53f2c92c886
        Content-Type: text/html; charset="UTF-8"
        Stillness-Aborts-Reassembly: 419b6cf2e213be5
        Date: Thu, 18 Oct 2018 03:54:36 -0700
        X-IncomingHeaderCount: 13
        Return-Path: pranalysts@freightliner.com
        X-MS-Exchange-Organization-ExpirationStartTime: 18 Oct 2018 03:54:36.4374
        (UTC)
        X-MS-Exchange-Organization-ExpirationStartTimeReason: OriginalSubmit
        X-MS-Exchange-Organization-ExpirationInterval: 2:00:00:00.0000000
        X-MS-Exchange-Organization-ExpirationIntervalReason: OriginalSubmit
        X-MS-Exchange-Organization-Network-Message-Id: 79526169-56c1-4856-e56b-08d634ad6bef
        X-EOPAttributedMessage: 0
        X-EOPTenantAttributedMessage: 84df9e7f-e9f6-40af-b435-aaaaaaaaaaaa:0
        X-MS-Exchange-Organization-MessageDirectionality: Incoming
        X-Microsoft-Exchange-Diagnostics: 1;SN1NAM01FT020;1:CPANLliVr3RH6Z7Mst89UqDfGAEUVGt2Kzgrt/aiJ911r9X0CxMho1NECmGLI9kDvxzInH+fjdPw24ENO7X2xTu8ckuMAq1pGmAPBWrqxbWWISiSGegbqJ+NPXewy9lf
        X-Forefront-Antispam-Report: EFV:NLI;
        X-MS-Exchange-Organization-AuthSource:
        SN1NAM01FT020.eop-nam01.prod.protection.outlook.com
        X-MS-Exchange-Organization-AuthAs: Anonymous
        X-MS-PublicTrafficType: Email
        X-MS-Office365-Filtering-Correlation-Id: 79526169-56c1-4856-e56b-08d634ad6bef
        X-Microsoft-Antispam:
        BCL:0;PCL:0;RULEID:(5000110)(711020)(4605076)(610169)(8291501071);SRVR:SN1NAM01HT070;
        X-Microsoft-Exchange-Diagnostics:
        1;SN1NAM01HT070;3:9qMKZWhvQL6fcPR8Sc5Hlq1d3W9LK22NHeokkSOQwOC1aC47Wot3IQEtY+gckheQ7Mi8+QE4xaA6Xo1SFuVdsUAW5ZRgMGYm0xSt9my5rC//bCTjyrdW3aQRh8i93XfsVhR7aohdebEQdQsNG/V5R1VfECD2k5p926SqTmO1s5dwxmLjb7Vi2mD9k1BY9MlzyEghQ7b3ZsGhueVV1QxFmFZoOQxhHcEq5OioLcVE/uni7KMnD+frKXZasZNWTTzFjtcdWarfzLJ7WsiSmNIMoUBpE/SFA/AFVTPJdS45F8/jkfUZCxMW23RWLuNyZ3uBJgZtdzYJQnOu2qwgOsieYw==;25:MkqMuyG35j/Cqch5aZ9T/eUzIQyNuYwAM5KRM+BZrzxmalP7xX9vL1Jqjcx+ZmVu5wrZizB84ivDB5LRHCFT6XDJmCt6Lj8gHLgN5FCQx9YfsLo5hdHLxYbmcVJPeN1G93eLoe+U6IbnwAISCyWbyEC1xjPZuEPQ5LD9fNX053TQ7VUy+M74ATDeTEF4HgWInag/jkRuYSIQ0qvoi7vMbNp2J6qi6adBmefdDnNuDh1a1Iq003vdIZ1cxFIU6qFnVSPQJkIAIaLKza7ZRPZ8jovJ5xCxas9TjnzqmqwdnslP9BIZ33NSlZHh2m24RzLOtwggL7Ml8CeLLFsjo/uXPw==;31:SxfWfdCpDZ8j+06DIcvuNpsrK42qPVgWaWFyTmNg2ruC4VL8Vqo4vME4opwGOG+7XhFjlHsmrK52t0I4Mi7jHERi7ngKAwDMri222vzqu2GAVI4vzTCmCrwBL3KMgps30KhpMcxoC506gEZgswl0pn5ZTvAMblX+B1uPCJnXmNgwzGrnoJXEXBnyzp7f2xkBG85ITPoUm7xHVf56JGPy7nTuLb8sGcfGD4xu1BYESLk=
        X-MS-TrafficTypeDiagnostic: SN1NAM01HT070:
        X-MS-Exchange-EOPDirect: true
        X-Sender-IP: 178.62.64.240
        X-SID-PRA: PRANALYSTS@FREIGHTLINER.COM
        X-SID-Result: NONE
        X-MS-Exchange-Organization-PCL: 2
        X-Exchange-Antispam-Report-Test: UriScan:(194151415913766)(166494164430575);
        X-Exchange-Antispam-Report-CFA-Test:
        BCL:0;PCL:0;RULEID:(444111676)(52401380)(52601095)(52606095)(52604095)(52606095)(52604095)(52606095)(52604095)(52606095)(52604095)(52505095)(52406095)(52303095)(52206095)(88862240)(88860193)(82015058);SRVR:SN1NAM01HT070;BCL:0;PCL:0;RULEID:;SRVR:SN1NAM01HT070;
        X-Microsoft-Exchange-Diagnostics:
        1;SN1NAM01HT070;4:/MC6h14hRX6e4mcq6czYQ/SvmCtWTDDQD1Cn6lfwd6z8tXr8hEmG/bV1S4l9L5Eaw7rEXsekKUUnD+ud0bGxgWgGFyIKKjIofG4hBRQauUhrcxDZWUUBuAVFuPzs46bRkwe5j/yol6TEeYZpwU/Tc47i7X5rJCmvNu4ROdUD88+/65dwSK73z/afzKSnUqWusKjXlg3rkcvdw5qLsPkrTYWX5a/eimgXjM7FlhhLwwJy+EYndN89q103f2HqouP0tcIvoaXeH+50D5r3+Ni0W6gHMUIZ/AHJsmME2pv4MUPeltwBSM8kyQW5Ln97BN2yUSKKJlHw+dS7oIa7RbOlH+bRW5PYU5wRrJZWabHKxig=;6:sHJVRkh3PejWlQDohlIGYRirU2wnDc9NmSRJSyvE+0/y0bhr4h2O0HUFjZoBeVyl7OvzfN87f

      • thomas sheehan commented  ·   ·  Flag as inappropriate

        Failing filters, example 3)

        Received: from BY2NAM05HT026.eop-nam05.prod.protection.outlook.com
        (2603:10b6:300:117::24) by BL0PR05MB5218.namprd05.prod.outlook.com with HTTPS
        via MWHPR03CA0014.NAMPRD03.PROD.OUTLOOK.COM; Thu, 18 Oct 2018 09:08:09 +0000
        Received: from BY2NAM05FT023.eop-nam05.prod.protection.outlook.com
        (10.152.100.58) by BY2NAM05HT026.eop-nam05.prod.protection.outlook.com
        (10.152.100.227) with Microsoft SMTP Server (version=TLS1_2,
        cipher=TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384) id 15.20.1250.2; Thu, 18 Oct
        2018 09:08:08 +0000
        Authentication-Results: spf=softfail (sender IP is 184.154.108.237)
        smtp.mailfrom=csiw.com; hotmail.com; dkim=none (message not signed)
        header.d=none;hotmail.com; dmarc=none action=none header.from=csiw.com;
        Received-SPF: SoftFail (protection.outlook.com: domain of transitioning
        csiw.com discourages use of 184.154.108.237 as permitted sender)
        Received: from us6.tmd.cloud (184.154.108.237) by
        BY2NAM05FT023.mail.protection.outlook.com (10.152.100.160) with Microsoft
        SMTP Server id 15.20.1250.2 via Frontend Transport; Thu, 18 Oct 2018 09:08:08
        +0000
        X-IncomingTopHeaderMarker: OriginalChecksum:7B11B1B97364460A89814A6658F8FDBFE13685708865493CC66E988A3A8E733A;UpperCasedChecksum:919C6E267EFC99EFABBDA513FEC906015FC8F31742D68E22662A11F7BD0368DC;SizeAsReceived:420;Count:12
        Content-Type: text/html; charset="UTF-8"
        From: Google Reminder <cs@csiw.com>
        To: Removed
        Content-Transfer-Encoding: 7bit
        Date: Thu, 18 Oct 2018 09:08:08 +0000
        Hurts-Variably: disrupts
        Subject: Undeliverable messages Peaktolg
        Gasping-Israeli-Malign: paula
        Message-ID: <4bf99_8c5e53_9ccc16@csiw.com>
        Auto-Submitted: no
        Errors-To: xfqiagqkjcixxo@csiw.com
        X-IncomingHeaderCount: 12
        Return-Path: cs@csiw.com
        X-MS-Exchange-Organization-ExpirationStartTime: 18 Oct 2018 09:08:08.5557
        (UTC)
        X-MS-Exchange-Organization-ExpirationStartTimeReason: OriginalSubmit
        X-MS-Exchange-Organization-ExpirationInterval: 2:00:00:00.0000000
        X-MS-Exchange-Organization-ExpirationIntervalReason: OriginalSubmit
        X-MS-Exchange-Organization-Network-Message-Id: 28fd40a5-23de-433f-5a85-08d634d938d5
        X-EOPAttributedMessage: 0
        X-EOPTenantAttributedMessage: 84df9e7f-e9f6-40af-b435-aaaaaaaaaaaa:0
        X-MS-Exchange-Organization-MessageDirectionality: Incoming
        X-Microsoft-Exchange-Diagnostics: 1;BY2NAM05FT023;1:aXwgtD+zDPRynOS3nSJGavXoWSckZcLRsZWl5h8FTkOXgj4QgOyUSVKx8u9wBY2/c2y+bsq4qV3Dof4RPY+syHHGlosidE6nmL0me/9QKSsLesvIfZ8d0UH0iggL/GQ8
        X-Forefront-Antispam-Report: EFV:NLI;
        X-MS-Exchange-Organization-AuthSource:
        BY2NAM05FT023.eop-nam05.prod.protection.outlook.com
        X-MS-Exchange-Organization-AuthAs: Anonymous
        X-MS-PublicTrafficType: Email
        X-MS-Office365-Filtering-Correlation-Id: 28fd40a5-23de-433f-5a85-08d634d938d5
        X-Microsoft-Antispam:
        BCL:0;PCL:0;RULEID:(5000110)(711020)(4605076)(610169)(630170)(8291501071);SRVR:BY2NAM05HT026;
        X-Microsoft-Exchange-Diagnostics:
        1;BY2NAM05HT026;3:pwD4H2Klb9SklPFNQ4C/A7fRfgPx+FIoEz6dGqwrEC6STLegzN967T+H4apgXWLlmv8o0aBd+ei7MvwXG+8djkxBTHCMZYgjEmjqt1XLtC3kqDw+ZmsK43YfRMQUSipydUbTEJwPNu5HuKbGo2k+/hNX9e5bZNdnflPOyLQI6+LlJCngJx5InsbySQxC6EcYiu1oQe8P4nSC5UT/e/4ct4QmKjUc3XeMUXcZVZjHYUIPMcWq39vZXbcYg9wqqVFec5YDSSNfVZH6hh7YeD1FwLa5UrdUscON5va78rDM58B1dupHcLw+c3fr8L+VMoJj/YQD+r978E/42qSQae9xiw==;25:4sbCTZjQjrvQmteI1DlLFnI1BKJzuAGB+zm6n9GGXbfBC6qSOt07GpZ1Ct4j2Nr0fLZG7ZvzE0KpEwXIwm3YI7xc6tgztFNAErMCa02AQrM1vVKfwtZMWjnZEew9a3c/5bQlqm76Nmz/LtIAbU8GtHd5J0uTx/qXhDLYZRcPk/x4Z/+CiErULDqMTF71MFy3JZWxc0xwtrp/rW0567ZrL0CZma0c0xGm6KLnuQHiuxcKTLUxPQMuFIjfWUgKnGm/9Vm5kiy/obCzPo6gzNaOC4o0pBfyQ88aydTQ4/HTAVbdNrCSS2EJF0FpbhcvaibtyUMUaeMZbTt/XQMwt/iCNw==;31:l8c2A4Qqs1oDJBKa/7socBJpoF/8WIkpwKrcBMpyNkzyG3ongO4Y7W7L3oHtuKte2gIVlDS8x0qvPfv3enWwUy2RAIxa6kbhTsz3k0TblUfMniC9fMvTOBs0rUr2nIQGZadnyQV8iVQbHoRzSSKFk+UFjR3WTRPYlqq7SIxvsgGU0H1uodapybzbgVoEQWovbmhx+h3IeEiDlXAmM21LVDhTnKy2c0OcYDUmaNmd+lA=
        X-MS-TrafficTypeDiagnostic: BY2NAM05HT026:
        X-MS-Exchange-EOPDirect: true
        X-Sender-IP: 184.154.108.237
        X-SID-PRA: CS@CSIW.COM
        X-SID-Result: FAIL
        X-MS-Exchange-Organization-PCL: 8
        X-Exchange-Antispam-Report-Test:
        UriScan:(163750095850)(25915859609805)(50302081469323);
        X-Exchange-Antispam-Report-CFA-Test:
        BCL:0;PCL:8;RULEID:(444111676)(2220353)(52401380)(52601095)(52606095)(52604095)(52606095)(52604095)(52606095)(52604095)(52505095)(52504095)(52406095)(52402095)(52304095)(52206095)(88862240)(88860193)(82015058);SRVR:BY2NAM05HT026;BCL:0;PCL:8;RULEID:;SRVR:BY2NAM05HT026;
        X-Microsoft-Exchange-Diagnostics:
        1;BY2NAM05HT026;4:ZCY57S98jki8vyQV+HNzIBimaBzJBauRDVmy1pw4cMvgcv3trTOC/NMe277iFK+4qjOlaVRB3Zz5K/qsr6j3qEHC/uVmFPXs5IPD9Wu1W4s7FAPnNIEQkykP8rx2CG4LFF0w08eKYGOMdXrFWY5sQ5BmxkZMEPlUP9Ro9ujfYtfeLUYGfWbQfcDO9gjuUlSx1BXPP9PdtdYVyZDTMTSMyL6Yifc9BPMZCICfjEdk3Sxt2lQdDAC3+xTW+V6Egv9icfs1U3/5GsvYQ7K96CFFfh/B8R7Icfl1iGr5ZV2ZZKn/FTOLOphF8vKJtvavC7pCbc83XTp+n1XbsHa5+MhfsMGigHy8wrQYl7RFU0SjSBGAKQhggKvYV9bz7CNq9fvQ;6:dfVFOeYapWl1cHfXV6VXi70rw3EbexoI/Vs5BH7xgTULWD+eKBoaxyeUnF7Cy/QV9vMVddfga89jh2xdMc24TNgCQ1y2kZrA7C45ZiQrrJjVB0yzORNl9863QYIyLsYZqoNw5FZstho1NdSgaP52nmlBXiIZf4pwBr

      • thomas sheehan commented  ·   ·  Flag as inappropriate

        Failing filters and blocked senders; example 2:
        Received: from BY2NAM05HT196.eop-nam05.prod.protection.outlook.com
        (2603:10b6:207:18::43) by BL0PR05MB5218.namprd05.prod.outlook.com with HTTPS
        via BL0PR0102CA0030.PROD.EXCHANGELABS.COM; Thu, 18 Oct 2018 10:32:25 +0000
        Received: from BY2NAM05FT058.eop-nam05.prod.protection.outlook.com
        (10.152.100.51) by BY2NAM05HT196.eop-nam05.prod.protection.outlook.com
        (10.152.101.141) with Microsoft SMTP Server (version=TLS1_2,
        cipher=TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384) id 15.20.1250.2; Thu, 18 Oct
        2018 10:32:24 +0000
        Authentication-Results: spf=none (sender IP is 193.169.178.191)
        smtp.mailfrom=wanadoo.fr; hotmail.com; dkim=none (message not signed)
        header.d=none;hotmail.com; dmarc=none action=none header.from=wanadoo.fr;
        Received-SPF: None (protection.outlook.com: wanadoo.fr does not designate
        permitted sender hosts)
        Received: from mail.rvs-holding.ru (193.169.178.191) by
        BY2NAM05FT058.mail.protection.outlook.com (10.152.100.195) with Microsoft
        SMTP Server id 15.20.1250.2 via Frontend Transport; Thu, 18 Oct 2018 10:32:23
        +0000
        X-IncomingTopHeaderMarker: OriginalChecksum:ECE4599409422122D56F6C58751AF4BA48A2C5C6DC59D14191042D25211FC740;UpperCasedChecksum:D049ADBD054180BD744C92218BD6E8AB1D12C6B9463C421A5E222B3DE5980F66;SizeAsReceived:393;Count:10
        Subject: Messenger new notification
        To: Removed
        Tensest-Typo-Nightmares: D95ABAC3B
        Reappear-Pabst: d63e942e3
        From: Savannah George Chief <jsp.montigny@wanadoo.fr>
        Message-ID: <629f19ef9.4e9bcc14.1811658761375@mail.rvs-holding.ru>
        Date: Thu, 18 Oct 2018 13:32:24 +0000
        Content-Transfer-Encoding: 7bit
        Content-Type: text/html; charset="UTF-8"
        X-IncomingHeaderCount: 10
        Return-Path: jsp.montigny@wanadoo.fr
        X-MS-Exchange-Organization-ExpirationStartTime: 18 Oct 2018 10:32:24.4831
        (UTC)
        X-MS-Exchange-Organization-ExpirationStartTimeReason: OriginalSubmit
        X-MS-Exchange-Organization-ExpirationInterval: 2:00:00:00.0000000
        X-MS-Exchange-Organization-ExpirationIntervalReason: OriginalSubmit
        X-MS-Exchange-Organization-Network-Message-Id: 8944d72e-bcd9-4108-a673-08d634e4fe66
        X-EOPAttributedMessage: 0
        X-EOPTenantAttributedMessage: 84df9e7f-e9f6-40af-b435-aaaaaaaaaaaa:0
        X-MS-Exchange-Organization-MessageDirectionality: Incoming
        X-Microsoft-Exchange-Diagnostics: 1;BY2NAM05FT058;1:714pudRSOyrIjTZc+RMaT0Q2ziKwkFWg1M5n3kFIaIBpQAgmEpJ3goRffESzztdBYNowHs7bC8muJzqAQMUEr7jIqCoOKRpJgLEhlxcEXQwpjqQ7ykB5//vO1oRNzvCF
        X-Forefront-Antispam-Report: EFV:NLI;
        X-MS-Exchange-Organization-AuthSource:
        BY2NAM05FT058.eop-nam05.prod.protection.outlook.com
        X-MS-Exchange-Organization-AuthAs: Anonymous
        X-MS-PublicTrafficType: Email
        X-MS-Office365-Filtering-Correlation-Id: 8944d72e-bcd9-4108-a673-08d634e4fe66
        X-Microsoft-Antispam:
        BCL:0;PCL:0;RULEID:(5000110)(711020)(4605076)(610169)(8291501071);SRVR:BY2NAM05HT196;
        X-Microsoft-Exchange-Diagnostics:
        1;BY2NAM05HT196;3:PiXpuLBA48duDrwu94lri+MjBPRcx7K3s6CP/WZWBOFJTYN+7ZCeke+uaw0KOuelhClpjy9DtRtM4yFkewW3/fK/FdlG88OGbSSSHijBfXEwjMGHiDX4uXeYxicQrs4su/MbzAlKaOhkVQs5d7o0/UuO+QkI3nJXiHwQvGnSzjiCqvLT1+BWOgd4XHGpN91a0lxfMzJg+NLEWeY0wkclfxY8DynV9oAcVRhZJPd23zC+7KGrPhfg5JiFCJ8So+l74r/EklzjNVxIqz1r6n++91KudlFs5OyinsX91msgrCkjJx4VrdFjF20r7P2FuVM4NXeqH+8veGPHVfmuqrLfrA==;25:CvLVlcFYKJLscgprqMAsVpImJDRYidDn44LFiGr/Hvvdf1mzvUMRb29diDkJXiD8wfh+yVbuo1wtDeuiH3DLsvYPTq3mzUBUwnUKK0LZatoBZg92oZGDkqA2fA06uaCC27GmAQyS9rdT1MRogH7xtTv8z9QqGq5/1jGj8A1cq1EEHcIhAxtMwohL6lw6CtkOHDl6VcjNaw/Pkv7P/JcnqHzGbDwaDhgmaxFNoBbSKKZYY8C3SN7rNovjScF71P9pTMgMb45DEKZhdP/n7GADyklQevULU6bDdYQPXEVUoMc3ept0YPDTsxpimBVqKaCduqGxsgmDMzYwfmeW0go2Imrw8TE67WRZtv3DGsFjUaU=
        X-MS-TrafficTypeDiagnostic: BY2NAM05HT196:
        X-MS-Exchange-EOPDirect: true
        X-Sender-IP: 193.169.178.191
        X-SID-PRA: JSP.MONTIGNY@WANADOO.FR
        X-SID-Result: NONE
        X-MS-Exchange-Organization-PCL: 2
        X-Microsoft-Exchange-Diagnostics:
        1;BY2NAM05HT196;31:Qm3wJFOZkcY/2cg5sIR4oL+KBqGlSKaqiY1pgLyneoGF/uwiop0H+72s2cQ87zzlE6ED7yelJ2Rbv482gMcdeK4JQFhqABlmuSsvlp6q0VR1uXtPwbmst03YcdrZnWy2wgXF6kU2LxOEhh90J0vigreFxAS6p59BVP5qKYMjJnAgIxBkkzxQW1Z4TH1n55h8TJCKFNte8MXTpw51D7Y4Oqz2x8iBry5ENE7ASTrcpik=;4:LESg14cYHDmTp+WTBnQJmNjlzrOPJUTR8Kzm+4y9FnUDmaa2Hrjjb+d0gMe4TK2Z12hAvk2YxLsJjbpDkXuzFnXaVAm13Wv82Psb6GZKBEEgHmZK/lTaLZVFbAtFytaPwwCg38ZF2OC0VgbvGwyaO16AE7As1sbTQvim5lF0Ziq6p4kXxh4KTRGFuaQJ7VegKWbMDRmqR1Z7pLobFFeNmsfBeYjz15nLwS2W/aNn93RlEP1kAemFOuepD8xw7kW9gXG20EURufjtIpxP8oHAQzZX4tmCYvXKq8Y2U/D0BLDwR7KXw77x5jlKRLib42cu
        X-Exchange-Antispam-Report-Test: UriScan:(194151415913766);
        X-Exchange-Antispam-Report-CFA-Test:
        BCL:0;PCL:0;RULEID:(444111676)(1160499021)(52401380)(52601095)(52606095)(52604095)(52606095)(52604095)(52606095)(52604095)(52505095)(52406095)(52404095)(52304095)(52206095)(88862240)(88860193)(82015058);SRVR:BY2NAM05HT196;BCL:0;PCL:0;RULEID:;SRVR:BY2NAM05HT196;
        X-Microsoft-Antispam-Message-Info:
        l/YKJigA7+MVUSS5yPNyEY7/peZg3oBtABcc8JINnbDXkcEvLmT7ak/bZ6lj1oWz/hkjuCb4QLqvgN60dPbyYowPubYXAlh6BrK5BZzZBQNGt+Ptc8e7cUaKg04afTYoLgswlI6jD7URIxvopsxoHIcAc1r3BcKDSAKaVeUHrCvywYoZCMeQtDGOgWMs/MxEMZ+kxNJjabS+KQ7p0iMcERHSOml9D

      Outlook.com

      Feedback and Knowledge Base