The spammer has followed up. New headers below.
On 2025-08-25 14:47, Michael Wise wrote:
That they are cryptic is by design.
and would Microsoft consider a nice plea to make them slightly less
cryptic? no wish to identify the culprit -- a Norwich Order would be a
better tool for succh purpose. All I need is to discern the flow of
spam from ham.
They identify the specific message so that we can trace other details of
it, not the least being the TenantId, which will show who the sender org
actually is, but in the case of traffic from outlook.com, it may end in
12 “a”s, so then we need the Network Message-Id to dig further.
You know Microsoft's internal better than me. Am I trying to filter by
TenantID? All I asked for is an efficient way to filter spam
originating from a singled-out Microsoft customer (TenantID?).
Preferably something that scale as easy as copy&paste a new ID into a
list of unwanted sources and that works instantly. Reporting to
Microsoft does not seem to be the way to go, this is what came in a few
hours ago:
Return-Path: <monica.techtre...@outlook.com>
Delivered-To: <ME>
Received: from MYSERVER
by MYSERVER (Dovecot) with LMTP id 4J4kKerTrWgEXwAAdV3MIg
for <ME>; Tue, 26 Aug 2025 11:34:02 -0400
Received-SPF: Pass (sender SPF authorized) identity=mailfrom;
client-ip=52.103.74.54;
helo=sevp216cu002.outbound.protection.outlook.com;
envelope-from=monica.techtre...@outlook.com; receiver=ME
Authentication-Results: MYSERVER; dkim=pass
reason="2048-bit key; unprotected key"
header.d=outlook.com header.i=@outlook.com header.b=cl5dJE9Q;
dkim-adsp=pass; dkim-atps=neutral
Received: from SEVP216CU002.outbound.protection.outlook.com
(mail-koreacentralazolkn19012054.outbound.protection.outlook.com
[52.103.74.54])
by MYSERVER (Postfix) with ESMTPS id 2F479C01B7
for <ME>; Tue, 26 Aug 2025 11:34:01 -0400 (EDT)
ARC-Seal: i=1; a=rsa-sha256; s=arcselector10001; d=microsoft.com; cv=none;
b=WXUszkHu5E7NibQ57wgF5yvv7LQm9/MvkLnmlRm+1/HJdl5y/a3fSydiPolqkJjSZG+sUQxMDVsa6Vb/Ny+KVtApbT/Q3MMdPhjHb8FNsYUs/Qwe4Fzg3UETaxXXm7kUZLZs1/eAYsNQTShhPRbwfN7GdVBaflpdViuc48W+Xqsyk8uvJstHz3uiuZjNiv3L6O2+j+URRGkR0iYlqwg6MsO6x7u/Eksx4/xMJD9bTXe2VJEbqmKGKRCVCQDWneh7JtjecRIUC251GB3dRFBUWM0E0ZQUyB+Uqcc+7n4RlAV1cVOUMtPofGQBWvaib1F0T0ThUJ8ee8JCMMfGz04VLA==
ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed;
d=microsoft.com;
s=arcselector10001;
h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1;
bh=f2Bw9e2S1XsgOZ+JBhYos7SVjHJAzTf+B8peVFE1bIU=;
b=G9vqsjL0hMqy8HRxaU5EnOFt+uvWNbPn3dGHw1xRwoLXyg6VWckjQi8s9UyaO6o0ZbXnlZaXNfBScCYzlMbC2JY86FfMX7DRNiJnUmmeiVAPA/9AnU+H0Wwd/jyqzVjiwdMvtdajYaV0FMUYK7xxB1Jc80N1JqrYSZKMRlr08vqzYAoq5usVGVaSt2/GEyqqwXcEjlfo3nWEn8HGwJjhCmDVN6Y1VxR2x5HXi46ESi/ktkAdtzJ85Ni5q41OIadF/Rxcjg8VUNuU+lsAqKHgWeaubPxGDo9bpMqCWhckg+4Q5rhGmtqmbv1XPArf8LjiC9+TODIZfRPdw65k/ahwvw==
ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=none; dmarc=none;
dkim=none; arc=none
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=outlook.com;
s=selector1;
h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck;
bh=f2Bw9e2S1XsgOZ+JBhYos7SVjHJAzTf+B8peVFE1bIU=;
b=cl5dJE9Q87YcdhKsYaYdyV7XjxDH4zN1tBxGTjR1UPeGxYMWJvKVq+XAiG4kJodArcWXEyD+10U21hFPziiH/4+zafA24KQVQDoGTJPg8N6O20F0KtEFyBdgsDVMnaUxX9dXzWVz0+aFbnfZ+iySfH9M/e/e4qKR0LAYu8PctFg6rkLZjpLF2jcusMEXwQTtMt4QNeAVy9vgd0H+Sm67LhkMWIM3BTwrgEwNVRf82F/9M8j+fn4C5P61KXEtzBgctKhuP/bxxuQ/sngvItu0FjLXakczSOzSnzGQXl3UsmvKKS6s+VI8g+ZSIyM8NEtSSWQ+Q/H0WxzLOwbsRHix0g==
Received: from SE1P216MB2057.KORP216.PROD.OUTLOOK.COM (2603:1096:101:159::6)
by SE2P216MB1442.KORP216.PROD.OUTLOOK.COM (2603:1096:101:2c::10) with
Microsoft SMTP Server (version=TLS1_2,
cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.9073.12; Tue,
26 Aug
2025 15:34:46 +0000
Received: from SE1P216MB2057.KORP216.PROD.OUTLOOK.COM
([fe80::cd68:19c:a5c3:a23b]) by SE1P216MB2057.KORP216.PROD.OUTLOOK.COM
([fe80::cd68:19c:a5c3:a23b%5]) with mapi id 15.20.9073.010; Tue, 26
Aug 2025
15:34:46 +0000
From: "Monica R. cooper" <monica.techtre...@outlook.com>
To: "ME" <ME>
Subject: RE: Verified Canadian Attorneys
Thread-Topic: Verified Canadian Attorneys
Thread-Index: AdwV6Vid0s3WXSgmQSi+C+LhGWo8/QAvkz4g
Disposition-Notification-To: "Monica R. cooper"
<monica.techtre...@outlook.com>
Return-Receipt-To: <monica.techtre...@outlook.com>
Date: Tue, 26 Aug 2025 15:34:46 +0000
Message-ID:
<se1p216mb2057eeacad5d0d4420159641f5...@se1p216mb2057.korp216.prod.outlook.com>
References:
<se1p216mb2057cf06ef1573a0ee83f05cf5...@se1p216mb2057.korp216.prod.outlook.com>
In-Reply-To:
<se1p216mb2057cf06ef1573a0ee83f05cf5...@se1p216mb2057.korp216.prod.outlook.com>
Accept-Language: en-US
Content-Language: en-US
X-MS-Has-Attach:
X-MS-TNEF-Correlator:
x-ms-exchange-messagesentrepresentingtype: 1
x-ms-publictraffictype: Email
x-ms-traffictypediagnostic: SE1P216MB2057:EE_|SE2P216MB1442:EE_
x-ms-office365-filtering-correlation-id:
beeba4db-1206-4450-46be-08dde4b61612
x-ms-exchange-slblob-mailprops:
Peh/bd4fmjJq/zavqk6GdX10ZNL8OFy7ZWLScRgdvZxf6n0wiP83LOmZoUQ0IKCe3A4ucrjA4IJNFLmW7tEkJDbOLWi40XQnDsjO7sQqp1s0frAFWXWSUUSUH7g78pvVoPcpcHBZfQF+GnZBdwF90CVZum+SSzPzNb4G0nile9LUl/zZD7OLSDsovSkiQdGhXEpx7QdCO1nDvPUuspTPrsvWeePlxXA0GpRiYgtbMVxMsmUZ/K6H6EJ02ckS42N2g+ogJec9MeiGjlKLPOfgXXmHi83kPrn47oQ5mCtX1lrWHHzRseJXV3Xkxp+k2L5bB9i+ELCvS3adgqz7sLlqcgchAvJxC1ZGKKbVmiSFxf6WrlOWCtsQV0oJ34uMjtkz5PNpKKdHcTms9emfsDFVyIxnRPhIh7ZINmdQw//vs0WCZw9IBDAYDdFAq3qEyTxrn51ZpfLNGcvZZ8t27J+7YNfZ/r5ZuMmwfxMDtPc640p7p2KFEravRAk2iVCPvFGJAqoez2FB2C2Spme6zZ7/n0+m1J3EtLvYBZHAjBeRmjtJi6uxHg9io4aQj/1nV9jVUsNEI7sYBS6KagpUQDU0dbL1CLN1NiwsUvqEYmKkQRSqVnoY+75UHKvCpXSxco9YawgKanS9x5zpIEym/rnqwbW1arScUmH4iSHEFP+uOMxWVkH2RQ8P5iQSb0coB3z1PJ8sIKKgxtY=
x-microsoft-antispam:
BCL:0;ARA:14566002|31061999003|461199028|15080799012|8062599012|8060799015|19110799012|13091999003|40105399003|3412199025|440099028|102099032;
x-microsoft-antispam-message-info:
=?us-ascii?Q?FFQZjcFPxBNpILAh0ZJgxZB4X0hX2pvpiOra5Trw/43cWG6ykeqq7H43VCxq?=
=?us-ascii?Q?gZ5bJKZRfsBusKeCs8LG/wyD+2Kz+LiFDFDnI8LZqvqexz+BzlmVGvVU4BS9?=
=?us-ascii?Q?T+HeTwiwwZSG+Mjoi8U7ZaEjbhLjpJz75v2ioipCDA8Ic6QVTSDBBYciU/bM?=
=?us-ascii?Q?bTiDOwoLu6E4fRgylE1fT71k3mzy5cBf4nHLcxNO/2vlSC6lWKFw3T+78mdv?=
=?us-ascii?Q?w7uEqrXOEcjJAO257kKPU2e8QJMvB/mN8Ne3Cv/dETCxPj+gIYosMjn/2fOJ?=
=?us-ascii?Q?J7ZvQCgwuhPocLjg6Ul1OpT1+B5v+jtd5V32OcJFI7xWVgk8Ep26jN78vuiW?=
=?us-ascii?Q?ODs5HKd5VLmgV+jCHRZJXFFwg6TD1Gtt3cVsak4bETEYHpfe/WbkCuK0aeu1?=
=?us-ascii?Q?Ym9Y+cLMG13qGB/a4H+DmoBk2h2ZsJILSq+Y84iUrKndoh3iZmgktt/gee6g?=
=?us-ascii?Q?Rt0UFqt+ylx0OZ8kFBQP83ws1QZ92HZo/vnOEw3vPg3/Ay/hgKHE2XuG79GZ?=
=?us-ascii?Q?uauEGugykwytUw5woLOF0V5difbVsHxtgxSl1E9fAxX9RVo5Psbx0sp3z6OL?=
=?us-ascii?Q?8FpeBdgQDUfyiq4kMVKVP5s7MwSVgYvUrIovasErfMOxVm6Lz3ww5ZF7Sqt/?=
=?us-ascii?Q?RcFM5vOrE1oOT48q9pb6bfXRfurRmLVb9WkpS1OGji4aFwQXy67YstjSE+Tm?=
=?us-ascii?Q?nVZXBn9DHyHQ2DNSC/UKZcl03Tn6v1VeOQ7UHJc9o1BzwauMLtOFGqeKKeIO?=
=?us-ascii?Q?6UJlUW8UfQ7xLvB7yKwtFiYwpyj2irDKCdJsXTUS7Pu1+H+duKGeywoFujPp?=
=?us-ascii?Q?4oxIten+LaN4Z8RYQkMY6Zzv/fz2mAR5sgyZVfNGwdM7qWIGQLLfvmYWcBSV?=
=?us-ascii?Q?hQ52s8l5oID9tdtinrPP3cPEE0wkrlBjmhvnoZLy1V5xGt7nlVNdPG1jh9IP?=
=?us-ascii?Q?I3A4v/7/YA6zIIidAEhBwEEQ9cxzmzPfVVHnhizAKylyOkEuJRW9tb/b+0J8?=
=?us-ascii?Q?N/rlLIBN4QFnQvrEM3tYT5AKXv1ZrP0+nhgep5XpU/48Krw56f3adco9zIzG?=
=?us-ascii?Q?WYNmg81EvDhex98lD7vofS7zmH4qZopO7V72FBa67SoCJVTfps+UZtFfjNTT?=
=?us-ascii?Q?cm23Farynv/m09U7D01p61IcfjkLyOAiy9bMTz4iOsjtxDHiYoGM/cBrmr7w?=
=?us-ascii?Q?/UBCveKBffbuQANW?=
x-ms-exchange-antispam-messagedata-chunkcount: 1
x-ms-exchange-antispam-messagedata-0:
=?us-ascii?Q?d69A1kyd9pEsRVypCkGyFhBsEgP3P2RJiO3LUBLixcFNQebBpMxWtsjjs4H4?=
=?us-ascii?Q?PdCpeIPLGZmBlIfElP93D2xzATx8yIZ5NlnE2EFawB3Ry/PY2FRBcz9YtsFs?=
=?us-ascii?Q?gMlGRkp+mEW5chAzVtTSwBcHOC1gTXLCiGLW3/ygWDxRU3N2es/a4kfO16Jw?=
=?us-ascii?Q?nCmbLQbqxjco0+d0QR4PYYWM0TwPxID8kk0JqcoyQmCaYlCX48qB4C9hatrF?=
=?us-ascii?Q?45VOGLhks3+eLd1A2yKx2ySWEbQClwNMgYRW3OFYZ9joHLighcGdAsAMispn?=
=?us-ascii?Q?bcDSHRbn7Bf5aMyDDPqQVx6cSpu86C68efU/FZeGW5ViITn4uq+Jw24+Yy/z?=
=?us-ascii?Q?O+zRTbewCTxHz/45UmMSxlvUUiIFI92A4Q94SYv7ei31Y2fBpfT7514SLVHd?=
=?us-ascii?Q?yZl79dYVlP1e15Wh66nKyvtuK1Hht7QpLN2P4JX8a17YCjV7L6eqmzvuTgvj?=
=?us-ascii?Q?KBZJxK0Qkizg2Z8XTBd8wwh99bE3Ey2fDnKduQoRlTc7ZSwxJusLUkOe2+Tk?=
=?us-ascii?Q?WWc37HeOg6WNpDsIJ9yp3RvPBK46XCpEB3hpS+u8yVnBu6RZ6rd0ll2oz0T4?=
=?us-ascii?Q?+gRTtq8sDYcu6n2dTrp0qBn/l5LCo/txJz8wk6LXjkjKYABcCvrrNIIqMM8f?=
=?us-ascii?Q?8v89ffzlm1xBMK20qoxq//ZIXshpbGK3Ou2yWo7tXu022RcOwhPwz2XaUG57?=
=?us-ascii?Q?klSrtV//RW8l4PNyaP0J882GJeIU8oEWNrVfjQcIyhZFz9SDaqIR9Xz1tn/M?=
=?us-ascii?Q?9WtQ98RmrASOc2BuT1zva3eLbXbF5JO+x38HOiiNOhCz0N1ooFjHXZcmxOzW?=
=?us-ascii?Q?qj0pxdNY6InZoMOdvjQcfzAuR0sMdzvDEtJ+CORlRQSxkvORymD2u7gsT6Sv?=
=?us-ascii?Q?MVKYyz3HH0o1WeXKyWkV4XmawxpvEqczoq0PZHUokOWXvKAV0SaQUdaQRZlA?=
=?us-ascii?Q?SpNtgLHskUTJUdPbotPrBA7XwW8XOz1mGdQ8UT2m6kstMd4MEDS26HUJWw3o?=
=?us-ascii?Q?2otptz8N2EvMBaCU17y5CeEjeW4n7urpZ/kWq9m02vp9z3sWgjheoOXtPp3S?=
=?us-ascii?Q?JxpcTrekR4KZm3eY7E687wPa8n4pf9My9/HnDfvAGHhGfRrRdd0yChtSPcGX?=
=?us-ascii?Q?RDHi42pk2z5EtKL+Jd5RzYYz+SbMT2lZam+XfPmvNjhqNYt8HPBLUFkT+M6V?=
=?us-ascii?Q?jZBicquvfAOy4xe3tIScjDY/wQ0q16GXW8pEateXlqk+VT5KTreFVPCy7ASN?=
=?us-ascii?Q?NkwTur6svRts9OeJjWdabOMaj5TLK72uysvyEEBAbJ0flIodW4joCxZCjd/p?=
=?us-ascii?Q?Bwo2XXT48Ty/L6qRmFQL24iE?=
Content-Type: multipart/alternative;
boundary="_000_SE1P216MB2057EEACAD5D0D4420159641F539ASE1P216MB2057KORP_"
MIME-Version: 1.0
X-OriginatorOrg: outlook.com
X-MS-Exchange-CrossTenant-AuthAs: Internal
X-MS-Exchange-CrossTenant-AuthSource: SE1P216MB2057.KORP216.PROD.OUTLOOK.COM
X-MS-Exchange-CrossTenant-RMS-PersistedConsumerOrg:
00000000-0000-0000-0000-000000000000
X-MS-Exchange-CrossTenant-Network-Message-Id:
beeba4db-1206-4450-46be-08dde4b61612
X-MS-Exchange-CrossTenant-originalarrivaltime: 26 Aug 2025 15:34:46.1787
(UTC)
X-MS-Exchange-CrossTenant-fromentityheader: Hosted
X-MS-Exchange-CrossTenant-id: 84df9e7f-e9f6-40af-b435-aaaaaaaaaaaa
X-MS-Exchange-CrossTenant-rms-persistedconsumerorg:
00000000-0000-0000-0000-000000000000
X-MS-Exchange-Transport-CrossTenantHeadersStamped: SE2P216MB1442
--_000_SE1P216MB2057EEACAD5D0D4420159641F539ASE1P216MB2057KORP_
Content-Type: text/plain; charset="us-ascii"
Content-Transfer-Encoding: quoted-printable
_______________________________________________
mailop mailing list
mailop@mailop.org
https://list.mailop.org/listinfo/mailop
