Home

Email Trace

%3CLINGO-SUB%20id%3D%22lingo-sub-363894%22%20slang%3D%22en-US%22%3EEmail%20Trace%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-363894%22%20slang%3D%22en-US%22%3E%3CP%20class%3D%22x-hidden-focus%22%3EI%20have%20Office365%20business%20and%20I've%20just%20been%20informed%20by%20one%20of%20our%20customer%20that%20in%20Nov%202018%20they%20got%20a%20email%20from%20us%20providing%20them%20with%20details%20of%20a%20new%20bank%20account%20that%20was%20to%20used%20for%20payment.%26nbsp%3B%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EThis%20has%20only%20recently%20come%20to%20light%20and%20as%20it%20was%20over%2090%20days%20ago%20I%20can't%20do%20any%20email%20traces%20from%20within%20Office365.%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EThe%20email%20header%20is%20below.%20The%20email%20looks%20like%20it%20has%20come%20from%20us.%20Is%20there%20anyway%20to%20check%20if%20this%20has%20come%20from%20a%20Outlook%20email%20account%20within%20our%20company%3F%20Or%20can%20we%20tell%20if%20it%20was%20sent%20from%20maybe%20a%20SMTP%20connected%20email%3F%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3Eemail%20header%20with%20email%20removed....%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EReceived%3A%20from%20BN6P154MB0033.NAMP154.PROD.OUTLOOK.COM%20(2603%3A10b6%3A903%3A77%3A%3A30)%3C%2FP%3E%3CP%3E%26nbsp%3Bby%20CY4P154MB0044.NAMP154.PROD.OUTLOOK.COM%20with%20HTTPS%20via%3C%2FP%3E%3CP%3E%26nbsp%3BCY4PR06CA0044.NAMPRD06.PROD.OUTLOOK.COM%3B%20Wed%2C%2017%20Oct%202018%2015%3A43%3A01%20%2B0000%3C%2FP%3E%3CP%3EReceived%3A%20from%20BN6P154CA0008.NAMP154.PROD.OUTLOOK.COM%20(2603%3A10b6%3A423%3A70%3A%3A18)%3C%2FP%3E%3CP%3E%26nbsp%3Bby%20BN6P154MB0033.NAMP154.PROD.OUTLOOK.COM%20(2603%3A10b6%3A423%3A70%3A%3A20)%20with%3C%2FP%3E%3CP%3E%26nbsp%3BMicrosoft%20SMTP%20Server%20(version%3DTLS1_2%2C%3C%2FP%3E%3CP%3E%26nbsp%3Bcipher%3DTLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384)%20id%2015.20.1228.27%3B%20Wed%2C%2017%20Oct%3C%2FP%3E%3CP%3E%26nbsp%3B2018%2015%3A42%3A59%20%2B0000%3C%2FP%3E%3CP%3EReceived%3A%20from%20AM5EUR03FT048.eop-EUR03.prod.protection.outlook.com%3C%2FP%3E%3CP%3E%26nbsp%3B(2a01%3A111%3Af400%3A7e08%3A%3A204)%20by%20BN6P154CA0008.outlook.office365.com%3C%2FP%3E%3CP%3E%26nbsp%3B(2603%3A10b6%3A423%3A70%3A%3A18)%20with%20Microsoft%20SMTP%20Server%20(version%3DTLS1_2%2C%3C%2FP%3E%3CP%3E%26nbsp%3Bcipher%3DTLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384)%20id%2015.20.1228.27%20via%20Frontend%3C%2FP%3E%3CP%3E%26nbsp%3BTransport%3B%20Wed%2C%2017%20Oct%202018%2015%3A42%3A59%20%2B0000%3C%2FP%3E%3CP%3EReceived%3A%20from%20mx0a-00240e01.pphosted.com%20(148.163.149.44)%20by%3C%2FP%3E%3CP%3E%26nbsp%3BAM5EUR03FT048.mail.protection.outlook.com%20(10.152.17.177)%20with%20Microsoft%20SMTP%3C%2FP%3E%3CP%3E%26nbsp%3BServer%20(version%3DTLS1_2%2C%20cipher%3DTLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384)%20id%3C%2FP%3E%3CP%3E%26nbsp%3B15.20.1250.12%20via%20Frontend%20Transport%3B%20Wed%2C%2017%20Oct%202018%2015%3A42%3A58%20%2B0000%3C%2FP%3E%3CP%3EReceived%3A%20from%20pps.filterd%20(m0114529.ppops.net%20%5B127.0.0.1%5D)%3C%2FP%3E%3CP%3Eby%20mx0a-00240e01.pphosted.com%20(8.16.0.22%2F8.16.0.22)%20with%20SMTP%20id%20w9HFdLpn027672%3C%2FP%3E%3CP%3Efor%20%3CREMOVED%3E%3B%20Wed%2C%2017%20Oct%202018%2011%3A42%3A56%20-0400%3C%2FREMOVED%3E%3C%2FP%3E%3CP%3EReceived%3A%20from%20pps.reinject%20(localhost%20%5B127.0.0.1%5D)%3C%2FP%3E%3CP%3Eby%20mx0a-00240e01.pphosted.com%20with%20ESMTP%20id%202n66b4rff6-1%3C%2FP%3E%3CP%3E(version%3DTLSv1.2%20cipher%3DECDHE-RSA-AES256-GCM-SHA384%20bits%3D256%20verify%3DNOT)%3C%2FP%3E%3CP%3Efor%20%3CREMOVED%3E%3B%20Wed%2C%2017%20Oct%202018%2011%3A42%3A56%20-0400%3C%2FREMOVED%3E%3C%2FP%3E%3CP%3EReceived%3A%20from%20pps.reinject%20(m0114529.ppops.net%20%5B127.0.0.1%5D)%3C%2FP%3E%3CP%3Eby%20pps.reinject%20(8.16.0.20%2F8.16.0.20)%20with%20SMTP%20id%20w9HFgRF6030296%3C%2FP%3E%3CP%3Efor%20%3CREMOVED%3E%3B%20Wed%2C%2017%20Oct%202018%2011%3A42%3A56%20-0400%3C%2FREMOVED%3E%3C%2FP%3E%3CP%3EReceived%3A%20from%20nam02-bl2-obe.outbound.protection.outlook.com%20(mail-bl2nam02on0120.outbound.protection.outlook.com%20%5B104.47.38.120%5D)%3C%2FP%3E%3CP%3Eby%20mx0a-00240e01.pphosted.com%20with%20ESMTP%20id%202n66b4rew9-1%3C%2FP%3E%3CP%3E(version%3DTLSv1.2%20cipher%3DECDHE-RSA-AES256-SHA384%20bits%3D256%20verify%3DNOT)%3C%2FP%3E%3CP%3Efor%20%3CREMOVED%3E%3B%20Wed%2C%2017%20Oct%202018%2011%3A39%3A10%20-0400%3C%2FREMOVED%3E%3C%2FP%3E%3CP%3EReceived%3A%20from%20DM5PR16MB0041.namprd16.prod.outlook.com%20(10.172.92.8)%20by%3C%2FP%3E%3CP%3E%26nbsp%3BDM5PR16MB0075.namprd16.prod.outlook.com%20(10.172.89.23)%20with%20Microsoft%20SMTP%3C%2FP%3E%3CP%3E%26nbsp%3BServer%20(version%3DTLS1_2%2C%20cipher%3DTLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384)%20id%3C%2FP%3E%3CP%3E%26nbsp%3B15.20.1228.24%3B%20Wed%2C%2017%20Oct%202018%2015%3A39%3A03%20%2B0000%3C%2FP%3E%3CP%3EReceived%3A%20from%20DM5PR16MB0041.namprd16.prod.outlook.com%3C%2FP%3E%3CP%3E%26nbsp%3B(%5Bfe80%3A%3Ad54e%3Aab92%3A4038%3Aaa30%5D)%20by%20DM5PR16MB0041.namprd16.prod.outlook.com%3C%2FP%3E%3CP%3E%26nbsp%3B(%5Bfe80%3A%3Ad54e%3Aab92%3A4038%3Aaa30%255%5D)%20with%20mapi%20id%2015.20.1228.032%3B%20Wed%2C%2017%20Oct%202018%3C%2FP%3E%3CP%3E%26nbsp%3B15%3A39%3A02%20%2B0000%3C%2FP%3E%3CP%3EFrom%3A%20%3CREMOVED%3E%3C%2FREMOVED%3E%3C%2FP%3E%3CP%3ETo%3A%20(removed)%40(removed)%26gt%3B%3C%2FP%3E%3CP%3ESubject%3A%20Re%3A%20Follow%20up%3C%2FP%3E%3CP%3EThread-Topic%3A%20Follow%20up%3C%2FP%3E%3CP%3EThread-Index%3A%20AQHUZisAhJsJdYlsJkqWcemRTH4yxqUjijqQgAAIOLM%3D%3C%2FP%3E%3CP%3EDate%3A%20Wed%2C%2017%20Oct%202018%2015%3A39%3A02%20%2B0000%3C%2FP%3E%3CP%3EMessage-ID%3A%3C%2FP%3E%3CP%3E%26nbsp%3B%3CDM5PR16MB00413508FA4ED1E2369E7C3EC7FF0%3E%3C%2FDM5PR16MB00413508FA4ED1E2369E7C3EC7FF0%3E%3C%2FP%3E%3CP%3EReferences%3A%3C%2FP%3E%3CP%3E%26nbsp%3B%3CDM5PR16MB0041C9F776365D3A102915CCC7FF0%3E%2C%3CCY4P154MB00448F9ACAEE27B6A3ED6B5EE5FF0%3E%3C%2FCY4P154MB00448F9ACAEE27B6A3ED6B5EE5FF0%3E%3C%2FDM5PR16MB0041C9F776365D3A102915CCC7FF0%3E%3C%2FP%3E%3CP%3EIn-Reply-To%3A%3C%2FP%3E%3CP%3E%26nbsp%3B%3CCY4P154MB00448F9ACAEE27B6A3ED6B5EE5FF0%3E%3C%2FCY4P154MB00448F9ACAEE27B6A3ED6B5EE5FF0%3E%3C%2FP%3E%3CP%3EAccept-Language%3A%20en-US%3C%2FP%3E%3CP%3EContent-Language%3A%20en-US%3C%2FP%3E%3CP%3EX-MS-Exchange-Organization-AuthSource%3A%3C%2FP%3E%3CP%3E%26nbsp%3BAM5EUR03FT048.eop-EUR03.prod.protection.outlook.com%3C%2FP%3E%3CP%3EX-MS-Has-Attach%3A%20yes%3C%2FP%3E%3CP%3EX-MS-Exchange-Organization-Network-Message-Id%3A%3C%2FP%3E%3CP%3E%26nbsp%3B661d3c6a-4782-486d-894f-08d6344736e1%3C%2FP%3E%3CP%3EX-MS-Exchange-Organization-SCL%3A%20-1%3C%2FP%3E%3CP%3EX-MS-TNEF-Correlator%3A%3C%2FP%3E%3CP%3Ex-originating-ip%3A%20%5B155.94.250.23%5D%3C%2FP%3E%3CP%3Ex-ms-publictraffictype%3A%20Email%3C%2FP%3E%3CP%3Ex-forefront-antispam-report%3A%3C%2FP%3E%3CP%3E%26nbsp%3BCIP%3A148.163.149.44%3BIPV%3ANLI%3BCTRY%3AUS%3BEFV%3ANLI%3BSFV%3ASFE%3BSFS%3A%3BDIR%3AINB%3BSFP%3A%3BSCL%3A-1%3BSRVR%3ABN6P154MB0033%3BH%3Amx0a-00240e01.pphosted.com%3BFPR%3A%3BSPF%3ANone%3BLANG%3Aen%3B%3C%2FP%3E%3CP%3Ereceived-spf%3A%20None%20(protection.outlook.com%3A%20removed.net%20does%20not%20designate%3C%2FP%3E%3CP%3E%26nbsp%3Bpermitted%20sender%20hosts)%3C%2FP%3E%3CP%3Edkim-signature%3A%20v%3D1%3B%20a%3Drsa-sha256%3B%20c%3Drelaxed%2Frelaxed%3B%3C%2FP%3E%3CP%3E%26nbsp%3Bd%3Dadvmetal.onmicrosoft.com%3B%20s%3Dselector1-removed-net%3B%3C%2FP%3E%3CP%3E%26nbsp%3Bh%3DFrom%3ADate%3ASubject%3AMessage-ID%3AContent-Type%3AMIME-Version%3AX-MS-Exchange-SenderADCheck%3B%3C%2FP%3E%3CP%3E%26nbsp%3Bbh%3Dg%2B0OMTrUoMg3lweT%2FrqWN8iyDgsSuYOfDVA8UDLjLFI%3D%3B%3C%2FP%3E%3CP%3E%26nbsp%3Bb%3Dgk%2FCCFpXDpaiQWDPIJjY98Qn6fh5s6lPTQ7tgnVQojmUW87fFXtl1iDJYgePW9AotPcuYWVe05nXSUawTILkEtq0JZoW3%2BevKObPNUiawXJ3H9nuCqK7x%2BKTCsoqq07d4mazxVXBxkgLduQwAtN%2BQtSHMvpcpuPD%2F7IBs8XweFg%3D%3C%2FP%3E%3CP%3Eauthentication-results%3A%20spf%3Dfail%20(sender%20IP%20is%20148.163.149.44)%3C%2FP%3E%3CP%3E%26nbsp%3Bsmtp.mailfrom%3Dremoved.net%3Bremoved.com%3B%20dkim%3Dpass%20(signature%20was%20verified)%3C%2FP%3E%3CP%3E%26nbsp%3Bheader.d%3Dadvmetal.onmicrosoft.com%3Bremoved.com%3B%20dmarc%3Dnone%20action%3Dnone%3C%2FP%3E%3CP%3E%26nbsp%3Bheader.from%3Dremoved.net%3Bcompauth%3Dpass%20reason%3D115%3C%2FP%3E%3CP%3Ex-proofpoint-virus-version%3A%20vendor%3Dfsecure%20engine%3D2.50.10434%3A%2C%2C%3C%2FP%3E%3CP%3E%26nbsp%3Bdefinitions%3D2018-10-16_14%3A%2C%2C%20signatures%3D0%3C%2FP%3E%3CP%3Eauthentication-results-original%3A%20ppops.net%3B%3CSPAN%3E%26nbsp%3B%3C%2FSPAN%3Espf%3Dpass%3C%2FP%3E%3CP%3E%26nbsp%3Bsmtp.mailfrom%3D(Removed)%40(removed)%3B%3CSPAN%3E%26nbsp%3B%3C%2FSPAN%3Edkim%3Dpass%20header.d%3Dadvmetal.onmicrosoft.com%3C%2FP%3E%3CP%3E%26nbsp%3Bheader.s%3Dselector1-removed-net%3B%3CSPAN%3E%26nbsp%3B%3C%2FSPAN%3Edmarc%3Dnone%3C%2FP%3E%3CP%3Ex-microsoft-exchange-diagnostics-untrusted%3A%3C%2FP%3E%3CP%3E%26nbsp%3B1%3BDM5PR16MB0075%3B6%3A8ErN2MVCHSD2D16Wl%2B4RlHFMDveElWSFotx9rIrQbQL91giJhvm7BEDdu1Udb6EepyjGuBzsxw%2B68p%2BBmh8KEaGXtKRQ7wSvkgBzxWtwEaL%2BssDWah8rzoLJbmI8JM6Nreh7LDGMXX2dzWNya7BQb%2Fdl1CA8GF6dvXafGrwuUL97O5GAqbyw6rsCjTT3aXq3kKrlw8ywriFMygqnV2393YFe5xH4KllHocI1xgsNW7eHn3trLrGgkwUjnue%2BeCz2GLAQPJlwuKscZ4HhKBt8xgrtLo6YFsibYXqFhYn2U8Xy48Ws4HOVlIodV6MjBk2m%2FuNHwTg6ubD92Tq1KPSMRYqTHON9GnBp2kCRRmxr4MCfQEP8NouC4pUOkBbdbrUkbA1FmXG1G9DUEsPrzzZHsgZo2NTfWVIuBoW10A3nZekglPpgcj37XJP2uhylxAHCr69mFHj%2BJtAcb60UgzfjpA%3D%3D%3B5%3Amza9ZMo%2BBRSVzaur5Q%2FHINgZ4R0B2xqeTHffKwyrPz7uVZJ2DwlMersOaYRRR0ANxjnR3N%2F0%2FzBxbdAZfccBJF1kZO7Jgz2Lpd%2FH%2BUTYUcNdLQf5ZFe4%2B2n8ZaxOG14Sh6bpmIXkW7cteDqOue8%2FeNY%2BoKrjLfV9HQ4XYUlexxk%3D%3B7%3A%2FQwgHHsxqrQvY4rNuf7%2FtpM9bOjqlvwwli4NLVLYE7ly%2FJwYJV7mA96uV%2F1xA3jxZj0YoV3gYEnZR4qOWlSvJqW%2F5ZNAe9lWSpiHjTXkyODJ76A6mw73wjz9vnpiABhdECrQJNk4piqGXLL5fFctJ1Xj1iA7QEZbhrIyNRHHIE7%2FFHpiUl4NA87z0YbJkJKYu1kRv4pzzkItld20H9LIFdiaz1X1TwfkXIxKV3niSPQa5BlNdXQ5mtMhNJDJ9%2FFr%3C%2FP%3E%3CP%3Ex-ms-office365-filtering-correlation-id%3A%20661d3c6a-4782-486d-894f-08d6344736e1%3C%2FP%3E%3CP%3Ex-microsoft-antispam-untrusted%3A%3C%2FP%3E%3CP%3E%26nbsp%3BBCL%3A0%3BPCL%3A0%3BRULEID%3A(7020095)(4652040)(7021145)(8989299)(5600074)(711020)(4534185)(7022145)(4603075)(4627221)(201702281549075)(8990200)(7048125)(7024125)(7027125)(7023125)(2017052603328)(7153060)(49563074)(7193020)%3BSRVR%3ADM5PR16MB0075%3B%3C%2FP%3E%3CP%3Ex-ms-traffictypediagnostic%3A%20DM5PR16MB0075%3A%7CBN6P154MB0033%3A%3C%2FP%3E%3CP%3Ex-microsoft-antispam-prvs%3A%3C%2FP%3E%3CP%3E%26nbsp%3B%3CDM5PR16MB0075A272BADB0F03323EDCBDC7FF0%3E%3C%2FDM5PR16MB0075A272BADB0F03323EDCBDC7FF0%3E%3C%2FP%3E%3CP%3Ex-exchange-antispam-report-test%3A%3C%2FP%3E%3CP%3E%26nbsp%3BUriScan%3A(50479424662132)(4376648964400)(229409888891308)%3BUriScan%3A(50479424662132)(4376648964400)(229409888891308)%3B%3C%2FP%3E%3CP%3Ex-ms-exchange-senderadcheck%3A%201%3C%2FP%3E%3CP%3Ex-exchange-antispam-report-cfa-test%3A%3C%2FP%3E%3CP%3E%26nbsp%3B%3D%3FWindows-1252%3FQ%3FBCL%3A0%3BPCL%3A0%3BRULEID%3A(102415395)(6040522)(2401047)(8121501%3F%3D%3C%2FP%3E%3CP%3E%26nbsp%3B%3D%3FWindows-1252%3FQ%3F046)(5005006)(3231355)(944501410)(4983020)(52105095)(300%3F%3D%3C%2FP%3E%3CP%3E%26nbsp%3B%3D%3FWindows-1252%3FQ%3F2001)(10201501046)(93006095)(93001095)(149066)(150057)(6%3F%3D%3C%2FP%3E%3CP%3E%26nbsp%3B%3D%3FWindows-1252%3FQ%3F041310)(20161123560045)(2016111802025)(20161123558120)(2%3F%3D%3C%2FP%3E%3CP%3E%26nbsp%3B%3D%3FWindows-1252%3FQ%3F0161123562045)(20161123564045)(6043046)(201708071742011)%3F%3D%3C%2FP%3E%3CP%3E%26nbsp%3B%3D%3FWindows-1252%3FQ%3F(7699051)(76991095)%3BSRVR%3ADM5PR16MB0075%3BBCL%3A0%3BPCL%3A0%3BRULEI%3F%3D%3C%2FP%3E%3CP%3E%26nbsp%3B%3D%3FWindows-1252%3FQ%3FD%3A%3BSRVR%3ADM5PR16MB0075%3BBCL%3A0%3BPCL%3A0%3BRULEID%3A(8211001083)(10%3F%3D%3C%2FP%3E%3CP%3E%26nbsp%3B%3D%3FWindows-1252%3FQ%3F2415395)(2018062399030)(2018011200283)(2401047)(7630418)%3F%3D%3C%2FP%3E%3CP%3E%26nbsp%3B%3D%3FWindows-1252%3FQ%3F(8121501046)(52410047)(2018011210174)(2018011211064)(201%3F%3D%3C%2FP%3E%3CP%3E%26nbsp%3B%3D%3FWindows-1252%3FQ%3F8011212028)(2018011213028)(2018011214028)(2018011215028)%3F%3D%3C%2FP%3E%3CP%3E%26nbsp%3B%3D%3FWindows-1252%3FQ%3F(2018011216028)(2018011217028)(2018011218028)(2018011219%3F%3D%3C%2FP%3E%3CP%3E%26nbsp%3B%3D%3FWindows-1252%3FQ%3F092)(2018011220252)(2018011221063)(2018011222027)(201801%3F%3D%3C%2FP%3E%3CP%3E%26nbsp%3B%3D%3FWindows-1252%3FQ%3F1223027)(2018011224027)(2018011225035)(2018011229035)(20%3F%3D%3C%2FP%3E%3CP%3E%26nbsp%3B%3D%3FWindows-1252%3FQ%3F18011232269)(2018011233052)(2018021202149)(98810176)(201%3F%3D%3C%2FP%3E%3CP%3E%26nbsp%3B%3D%3FWindows-1252%3FQ%3F8021203149)(98815176)(7631346)(7632307)(7633261)(1430482%3F%3D%3C%2FP%3E%3CP%3E%26nbsp%3B%3D%3FWindows-1252%3FQ%3F)(1431068)(1432130)(1440239)(823300264)(823350442)(82341%3F%3D%3C%2FP%3E%3CP%3E%26nbsp%3B%3D%3FWindows-1252%3FQ%3F1253)(9101536074)(93006095)(93001095)(10201501046)(30020%3F%3D%3C%2FP%3E%3CP%3E%26nbsp%3B%3D%3FWindows-1252%3FQ%3F01)(3231355)(901025)(902075)(913088)(7045084)(944500087)%3F%3D%3C%2FP%3E%3CP%3E%26nbsp%3B%3D%3FWindows-1252%3FQ%3F(944510158)(944921075)(946803086)(946901078)(9300000249)%3F%3D%3C%2FP%3E%3CP%3E%26nbsp%3B%3D%3FWindows-1252%3FQ%3F(9301004277)(4983020)(4982022)(52103095)(52105095)(52106%3F%3D%3C%2FP%3E%3CP%3E%26nbsp%3B%3D%3FWindows-1252%3FQ%3F170)(52408095)(98821027)(98822027)(52401380)(52601095)(5%3F%3D%3C%2FP%3E%3CP%3E%26nbsp%3B%3D%3FWindows-1252%3FQ%3F2606095)(52505095)(52406095)(52305095)(52206095)(8886224%3F%3D%3C%2FP%3E%3CP%3E%26nbsp%3B%3D%3FWindows-1252%3FQ%3F0)(88860193)(1102011)(1610001)(8301001075)(8301003183)(2%3F%3D%3C%2FP%3E%3CP%3E%26nbsp%3B%3D%3FWindows-1252%3FQ%3F01708071742011)(7699051)(76991095)%3BSRVR%3ABN6P154MB0033%3BBC%3F%3D%3C%2FP%3E%3CP%3E%26nbsp%3B%3D%3FWindows-1252%3FQ%3FL%3A0%3BPCL%3A0%3BRULEID%3A%3BSRVR%3ABN6P154MB0033%3B%3F%3D%3C%2FP%3E%3CP%3Ex-forefront-prvs%3A%2008286A0BE2%3C%2FP%3E%3CP%3Ex-forefront-antispam-report-untrusted%3A%3C%2FP%3E%3CP%3E%26nbsp%3BSFV%3ANSPM%3BSFS%3A(10019020)(346002)(376002)(39840400004)(136003)(366004)(396003)(199004)(189003)(6116002)(3846002)(99286004)(19627235002)(6606003)(6916009)(316002)(71200400001)(71190400001)(68736007)(5024004)(2900100001)(74316002)(221733001)(256004)(14444005)(25786009)(66066001)(86362001)(6506007)(53546011)(2906002)(76176011)(7696005)(7736002)(229853002)(102836004)(105586002)(33656002)(6436002)(8936002)(99936001)(97736004)(106356001)(19627405001)(19273905006)(11346002)(446003)(81156014)(3480700004)(81166006)(508600001)(476003)(14454004)(53936002)(486006)(5250100002)(186003)(55016002)(8676002)(6246003)(5660300001)(26005)(7116003)(236005)(9686003)(6306002)(54896002)(606006)(362424003)%3BDIR%3AOUT%3BSFP%3A1102%3BSCL%3A1%3BSRVR%3ADM5PR16MB0075%3BH%3ADM5PR16MB0041.namprd16.prod.outlook.com%3BFPR%3A%3BSPF%3ANone%3BLANG%3Aen%3BPTR%3AInfoNoRecords%3BA%3A0%3BMX%3A1%3B%3C%2FP%3E%3CP%3Ex-microsoft-antispam-message-info-original%3A%3C%2FP%3E%3CP%3E%26nbsp%3BRwyzSoIxcGCQBXq5kK5X03BoLs797sLnSAIwHigUDjwFZzmUDPx2RwwpUvt4I4pozfhFxG8Xbjj%2FCEVBYECGpmSP%2Bifxa4cu2sv9Q%2FBgvUIkvWGuC2D8FGQ9p6puQaYxBsCD9OAbmdFJd0cN2ZjJtgwIhs3BVy5ItKrcifQHUomKpYxcI70DBwLJNPUytqlDClVuf%2F18Gd2hL4LUHFpwyFp1LBlThpfYHe%2BEtGNvdUL7r3Db%2FYByxVTtZEFkhGK4sOfJZS%2BDldPwtMS%2B9ydJlzlcND2WAX3Sjeyri3VWEvfbAP5PR2NRNY0IGpPO7arr%2FJwc71V8putBQ3hQPvrDNunvJdrFRXNlmOaNwdvyOaY%3D%3C%2FP%3E%3CP%3Espamdiagnosticoutput%3A%201%3A3%3C%2FP%3E%3CP%3Ex-ms-exchange-transport-crosstenantheadersstamped%3A%20BN6P154MB0033%3C%2FP%3E%3CP%3Ex-clx-shades%3A%20MLX%3C%2FP%3E%3CP%3Ex-clx-response%3A%201TFkXGxMbEQpMehcbGBwRCllNF2dmchEKWUkXGnEaEBp3BhsdG3EfGhAadwY%3C%2FP%3E%3CP%3E%26nbsp%3BYGgYaEQpZXhdoY3kRCklGF0NETU9YWUVGRnVCRVleT04RCkNOF356ZH8ZB0J9SU1SWHVGa09Mb1%3C%2FP%3E%3CP%3E%26nbsp%3B5HElx1a2FgZR5tSUlEEQpYXBcfBBoEGx8bB0gaSBwTSUwfBRsaBBsaGgQeEgQbEBseGh8aEQpeW%3C%2FP%3E%3CP%3E%26nbsp%3BRd5BXoaSBEKTVwXGBgdEQpMWhdpa11rEQpNThdpaxEKTEYXb2tra2xraxEKQ1oXGxoeBB4dBBkS%3C%2FP%3E%3CP%3E%26nbsp%3BBBsYGhEKQl4XGxEKQlwXGhEKQkUXYR5FTRNQa1ITUHIRCkJOF2t4X2VMT1phckdMEQpCTBdkSRk%3C%2FP%3E%3CP%3E%26nbsp%3BeTmhCHUtlTxEKQmwXbmNhfWBsHE1zEm8RCkJAF2UBeERHHWgda2EbEQpCWBdgQG5gBXwfHxxmfB%3C%2FP%3E%3CP%3E%26nbsp%3BEKTV4XGxEKWlgXHREKcGcXbGB4E0ZYTgVveH8QGRoRCnBoF2seaVtPeXJ5UEVoEBkaEQpwaBdve%3C%2FP%3E%3CP%3E%26nbsp%3BB8YU155ZEVfExAZGhEKcGgXa0d7G3lmZ04TQGUQGRoRCnBoF2JaR2wee2wfWXBLEBkaEQpwaBdt%3C%2FP%3E%3CP%3E%26nbsp%3BRVxfGXpeQUVzaxAZGhEKcGcXZ2toemRnZUZGem8QGRoRCnB%2FF2JyRk5tUGd4XGIdEBsZGhEKcF8%3C%2FP%3E%3CP%3E%26nbsp%3BXbEhBQnNZU1xSQ00QGxMbEQpwfRdgYR1sX1xcUFMfYRAbHR4RCnB9F2BhHWxfXFxQUx9hEBsdHh%3C%2FP%3E%3CP%3E%26nbsp%3BEKcGsXbB8YYRhIbkRrZkAQGRoRCnBLF3p4bkJjGU5FBRtQEBkaEQpwbBdrexlDeBtoc314WBASH%3C%2FP%3E%3CP%3E%26nbsp%3BxEKcEwXa0NpRUJGQH5eTVsQGRoRCm1%2BFxsRClhNF0sRIA%3D%3D%3C%2FP%3E%3CP%3Ex-proofpoint-spam-reason%3A%20safe%3C%2FP%3E%3CP%3Ex-eopattributedmessage%3A%200%3C%2FP%3E%3CP%3Ex-eoptenantattributedmessage%3A%20abf9983b-ca77-4f20-9633-ca9c5a847041%3A0%3C%2FP%3E%3CP%3Ex-ms-exchange-transport-crosstenantheadersstripped%3A%3C%2FP%3E%3CP%3E%26nbsp%3BAM5EUR03FT048.eop-EUR03.prod.protection.outlook.com%3C%2FP%3E%3CP%3Ex-ms-office365-filtering-ht%3A%20Tenant%3C%2FP%3E%3CP%3Ex-microsoft-exchange-diagnostics%3A%3C%2FP%3E%3CP%3E%26nbsp%3B1%3BBN6P154MB0033%3B6%3ARDs09mBtkh%2FejavSbq1Qy7mfaIi8OTWq%2BujX0AzskXaJW4eG%2BRNKpEDLtxar2LNkd4Hjt5c4cGvBcW7Gm3on0Pr%2FahfMJjo%2FXM64Y%2B3O0fjpyR%2B%2FRvmFFSOAukkZSRw1779xp1Oev%2BFuZvZBSOuJi2TciCnkylFh3s51vSoB%2Bn%2B0jNdD%2BWEzBurI3%2Br3Ol0ebOvSDiviDjxQfDl%2F6krarypFvjE8Vysn6HuNnXXm%2BoI9ZyDWyfKK9jPEWbHoOzkVuQRTpWRTtlpo%2BZCC5000Srp0nVzOqLiy1P9ogxlpt16gpJybvNE5%2F%2FhTpEA0qAiSY5og1l%2BVvToq1TzKCneJRz0WSAapHe8lGAiW9cZTDjZwM4UnJOj63HgzRv%2BI1lDeByl8Z7yCLb7AkhHm9wYMFmuTLxWANXqgaAJx%2FSQhRnPtPrvaEmJcsWP%2F4jBY9q95t1GuXgWJa%2FgBXgO7qBwaQA%3D%3D%3B5%3ASRDbJFCjdw3lOPrj9iMJy6yRvUt1DanQas3brJBlQdfxGPR%2B5xaX5sFz5ajoW8MOnZqG%2FzkSbNLTQF7%2BrBHYFAEVDbfXz5DhZBEwFaAjPk5r6HNMcLbslClQVNP5bAUJ5MO8mb0d%2Fhf6KZSy8kzyMyloBdcak5E0p6B7PuBvESg%3D%3B7%3Aj%2FrOzuNAxcQTn%2F%2BL2LrNifG%2BxVqedbJPdEKHzt7h3XZnW6bKagcHph2EPo9K%2F89ihQzJlXTxVfJ1lgl9sKVqiMu3ikZ73cCgLwrX6jQWMujQn68uNnAqcOE1gCfMeGC06u0pvnwXl2FASnNUKTfBIKfgrhmnY5s8aYysDGnGSr%2FFY5AjCyK3tbTsFutS5NimgaewDweDtPbngm%2BuViNkQVkmQQhr%2BUTXvhBmlxG2dnOuBJMy%2FvIOsCtXHMqIpXkD%3C%2FP%3E%3CP%3Ex-ms-office365-filtering-correlation-id-prvs%3A%3C%2FP%3E%3CP%3E%26nbsp%3B0aa51a29-66e7-44b6-d714-08d63446aa4a%3C%2FP%3E%3CP%3Ex-microsoft-antispam%3A%3C%2FP%3E%3CP%3E%26nbsp%3BBCL%3A0%3BPCL%3A0%3BRULEID%3A(7020095)(4652040)(5600074)(710020)(711020)(4605076)(49563074)(1401270)(8001031)(1420028)(1417108)(71702078)(7193020)%3BSRVR%3ABN6P154MB0033%3B%3C%2FP%3E%3CP%3Ex-microsoft-antispam-message-info%3A%3C%2FP%3E%3CP%3E%26nbsp%3B%3D%3FWindows-1252%3FQ%3FPNwHdragiz5NOUdiLKx4m4mZ8Rh%2FKxfAZ7wtfszjLK32DVZ6jOgpxxiJ%3F%3D%3C%2FP%3E%3CP%3E%26nbsp%3B%3D%3FWindows-1252%3FQ%3F7tYligHpOFK34Y21hNfHNtuqMI7%2FwkLaW2Poh3umcWqGASvMl%2BsDFzik%3F%3D%3C%2FP%3E%3CP%3E%26nbsp%3B%3D%3FWindows-1252%3FQ%3FdaJUgWJCt7nwV2zh9fYEkzCzZEJUM9T1Dx4ceqIfOH3rid5cKlbuXHVY%3F%3D%3C%2FP%3E%3CP%3E%26nbsp%3B%3D%3FWindows-1252%3FQ%3FPQ19gYNHjAh8PLs8llyAbMDe9ueqas%2BcRjvL2PLwvRpJrl9gjzbLVp5F%3F%3D%3C%2FP%3E%3CP%3E%26nbsp%3B%3D%3FWindows-1252%3FQ%3FoDrZ8Zp9oeFWXhZA1KEgNVliVh5G7cZa98Wsd9BKppTBZiuDC4pXs3Eg%3F%3D%3C%2FP%3E%3CP%3E%26nbsp%3B%3D%3FWindows-1252%3FQ%3F%2FE7djx%2BAI3FmMbIuY3GREVIwGd73iA7TrvENRqbxQg1qyQaOghL5XhjU%3F%3D%3C%2FP%3E%3CP%3E%26nbsp%3B%3D%3FWindows-1252%3FQ%3F8I33QVXjazB4q9tXWmMsOtnLBsBJbUHLzlyAayiKOtUEuWSPdvvwVDey%3F%3D%3C%2FP%3E%3CP%3E%26nbsp%3B%3D%3FWindows-1252%3FQ%3Fa%2BtE89hIIqgIWg0iuz3%2BtuvNeiehMztb3MZ2wrxg7IDAAlgEVt8IQ6Bx%3F%3D%3C%2FP%3E%3CP%3E%26nbsp%3B%3D%3FWindows-1252%3FQ%3F82sYTnIMnNMpiRha40%2B5Tbc2GlyB9V9czkTzH%2FHnbUzXOoMON5scPtSs%3F%3D%3C%2FP%3E%3CP%3E%26nbsp%3B%3D%3FWindows-1252%3FQ%3FPl0JSRmSHV9qljct6lOZakEVRyglpN8mVxdjVqn%2FovFdBACPr%2BPui3P%2F%3F%3D%3C%2FP%3E%3CP%3E%26nbsp%3B%3D%3FWindows-1252%3FQ%3F3x3ZHs%2BkgQwAbvrGlDhCn8k3cjCezJBmw8fCbPg22f2debDfg72eZ3bM%3F%3D%3C%2FP%3E%3CP%3E%26nbsp%3B%3D%3FWindows-1252%3FQ%3FXsAqkj70ElBCUbVTXdWKmEVNQfXTPMTAVAmXtNBl4QdiHFi7xkzeSJ9y%3F%3D%3C%2FP%3E%3CP%3E%26nbsp%3B%3D%3FWindows-1252%3FQ%3FOch0bHXE3KQ49vWr5hTMk74lbGlpx5LC0gmQF4eNWOYAgtN3QoV0R84J%3F%3D%3C%2FP%3E%3CP%3E%26nbsp%3B%3D%3FWindows-1252%3FQ%3FdjCcvCqlqkp87aJYDeE6058iEEEuMNwToyct1XtDibaNzaYb7rQf60%2Bc%3F%3D%3C%2FP%3E%3CP%3E%26nbsp%3B%3D%3FWindows-1252%3FQ%3Fl3hnrhZNvG1dc7H3KrgLVgwOGQNTvmghd7TIt2VTp9cVxBc5qXBBBf95%3F%3D%3C%2FP%3E%3CP%3E%26nbsp%3B%3D%3FWindows-1252%3FQ%3FZuhfX%2BZQ%2BYfrevpJtNOL6RKqnGXN91zwB4gX5A%2BVBP4oSZQp47sFcnj0%3F%3D%3C%2FP%3E%3CP%3E%26nbsp%3B%3D%3FWindows-1252%3FQ%3F47zU97wxKffxyluOoZAr%2BzAOZcdshD83Z0xsM5FDrbp3QmDbTr40hxxg%3F%3D%3C%2FP%3E%3CP%3E%26nbsp%3B%3D%3FWindows-1252%3FQ%3FGG1zDUZ6WiwLmfJr2RusN5E01YvMKwYSJol2APsI4mCywLuKcaRbBKw9%3F%3D%3C%2FP%3E%3CP%3E%26nbsp%3B%3D%3FWindows-1252%3FQ%3FMQJP70Z3oKdg%2Bgh9w4oofEZVFi7xc9Z0QR7wFw%3D3D%3D3D%3F%3D%3C%2FP%3E%3CP%3Ex-ms-exchange-crosstenant-originalarrivaltime%3A%2017%20Oct%202018%2015%3A42%3A58.0857%20(UTC)%3C%2FP%3E%3CP%3Ex-ms-exchange-crosstenant-network-message-id%3A%3C%2FP%3E%3CP%3E%26nbsp%3B661d3c6a-4782-486d-894f-08d6344736e1%3C%2FP%3E%3CP%3Ex-ms-exchange-crosstenant-id%3A%20abf9983b-ca77-4f20-9633-ca9c5a847041%3C%2FP%3E%3CP%3Ex-ms-exchange-crosstenant-fromentityheader%3A%20Internet%3C%2FP%3E%3CP%3Ex-ms-exchange-transport-endtoendlatency%3A%2000%3A00%3A03.0640563%3C%2FP%3E%3CP%3Ex-ms-exchange-processed-by-bccfoldering%3A%2015.20.1228.020%3C%2FP%3E%3CP%3EX-Microsoft-Exchange-Diagnostics%3A%3C%2FP%3E%3CP%3E%26nbsp%3B1%3BCY4P154MB0044%3B27%3AuAbRBJDG5UBLUuYg26lAXqA3d9EQkD2ZPkxX2eqvWJTGE5r0QRFdVNaIZIyJhrZQqcltd0%2BEY0zPYxQuJcQ1gn%2FrB5GwirymL3dpR9ld%2BlTjTmaITE269UNm72RN8a9ghvAr%2BdjikntZkN23ilPp4cqqy8egTxzkkvcRS1D80RjlahPrhs1GzN9%2BgfKy%2FQYeo2Mt%2BnMjuePzm%2FRKKt6uORbmZZCEVdqOtqXhDR3gC%2B%2BunPdLcTPi74iYj7vAPdnenPoW78cM%2B9u1tP%2Fuo%2F2G2R9EJt9GBqKf05M3rSGEkB5s%2FBMLwZkh2cCdtRZopI81vHyHsdlefwks8AmKNnIfgflyXwTqvPVr8n8IPjXcgzJywx2L3FGLB%2Bhc77bjzXfAYHVQGaKJROhF3cKomYNGIKpx5xVUInCLucE24%2BmLziP4EwPAwNmVNA26YCS7it5H%3C%2FP%3E%3CP%3EX-Microsoft-Antispam-Mailbox-Delivery%3A%3C%2FP%3E%3CP%3E%26nbsp%3Babwl%3A1%3Bucf%3A0%3Bjmr%3A0%3Bex%3A0%3Bauth%3A0%3Bdest%3AI%3BENG%3A(750119)(520011016)(520006050)(702028)(944506303)(944626516)%3B%3C%2FP%3E%3CP%3EX-Microsoft-Antispam-Message-Info%3A%3C%2FP%3E%3CP%3E%26nbsp%3B%3D%3FWindows-1252%3FQ%3FlzORpj9qkJEQRcSjzLw657GvlWfgRMjYC4Aoo9EP7Lt2zcncmgCdayKJ%3F%3D%3C%2FP%3E%3CP%3E%26nbsp%3B%3D%3FWindows-1252%3FQ%3Fxl4hcwnIEOlLoJVUQcDOAKnYsANqoZMWD0vCSe0hQO1VcUd8BNFenry7%3F%3D%3C%2FP%3E%3CP%3E%26nbsp%3B%3D%3FWindows-1252%3FQ%3F196pDATUqQyZvm10w2qDG6kKSsWW3KDTDA3SkzwYsRG6z5663kXGv2kr%3F%3D%3C%2FP%3E%3CP%3E%26nbsp%3B%3D%3FWindows-1252%3FQ%3FL7oemyk%2BzEHn4GRxUqyN80KbiDiwzk%2Fjiq4BuycHcPt%2FCSNi1c4r3ak3%3F%3D%3C%2FP%3E%3CP%3E%26nbsp%3B%3D%3FWindows-1252%3FQ%3FzKOwy6FSELEG7flTX2N6ppyuqGvVMqOsbq0OsU0jBr1uAlMv%2FmyP8P4O%3F%3D%3C%2FP%3E%3CP%3E%26nbsp%3B%3D%3FWindows-1252%3FQ%3FJDOP5FiZJ5ZbxQrUfW7u%2FtTLZf0TCT2LZONKOTlBbdMghcMHyvQ%2BYgPz%3F%3D%3C%2FP%3E%3CP%3E%26nbsp%3B%3D%3FWindows-1252%3FQ%3FJwXcpCiHPKAaCaztwmjbq3sIMEjsY8PSV1gE0y0%2Fbux%2BFu8MzBJr%2FwA3%3F%3D%3C%2FP%3E%3CP%3E%26nbsp%3B%3D%3FWindows-1252%3FQ%3FxlbpNCFaIIwa%2BCyPmRW3JEl8UkvNayFYrIn5wizAYdLQhi%2FruYPj4tQz%3F%3D%3C%2FP%3E%3CP%3E%26nbsp%3B%3D%3FWindows-1252%3FQ%3FTO%2FtcmdDG6OFgghy84CjmlF9%2FYg%2BQemOZ6WgzH3wPEX9Hir7fgRXJ2MY%3F%3D%3C%2FP%3E%3CP%3E%26nbsp%3B%3D%3FWindows-1252%3FQ%3FnEfLrAo6Li5NznhIRQY4hXcwIB6KTooBLNknKA3E%2F%2FrqAiG8G7YF2wj2%3F%3D%3C%2FP%3E%3CP%3E%26nbsp%3B%3D%3FWindows-1252%3FQ%3F0ZKBZm6Fm5pTNpNtdenu%2Ffb9Gkapjb1XXjtAoIT25mxtOV8mZwP13NcH%3F%3D%3C%2FP%3E%3CP%3E%26nbsp%3B%3D%3FWindows-1252%3FQ%3F1BSNX%2BdDXJ3VXH19mRtxF3if3C5vA%2FCuiRz6K8uKylsx68rffOTi7gJs%3F%3D%3C%2FP%3E%3CP%3E%26nbsp%3B%3D%3FWindows-1252%3FQ%3FSCoTPqa%2FNHpmMPk7Pcfas0JGWMhAwmRHjNx%2BKSlMCi8w8fO3uXIaapVZ%3F%3D%3C%2FP%3E%3CP%3E%26nbsp%3B%3D%3FWindows-1252%3FQ%3FeVdIPDhYNFo%2FCQTwEHj%2BVHtJpMTFpksKgy2IvAgu9ocSgXdVJZmuH6lZ%3F%3D%3C%2FP%3E%3CP%3E%26nbsp%3B%3D%3FWindows-1252%3FQ%3F0Myu%2F6Nrp%2B0AAt06K7DR%2F1p6h0x4ihBwfxCdzWQL3faXcvmVQT6gIrQc%3F%3D%3C%2FP%3E%3CP%3E%26nbsp%3B%3D%3FWindows-1252%3FQ%3F0r8idmtyGf06RPPVPxXcCbqZDp3vxxQS8SAE3zvQIYrNoIV2KQzCpD7Z%3F%3D%3C%2FP%3E%3CP%3E%26nbsp%3B%3D%3FWindows-1252%3FQ%3Fjw4mdcdFgNbXAlylAEe92%2BrZ1wqtN56iUzkMbkqPpjP7%2BVOEMhd7ZqmU%3F%3D%3C%2FP%3E%3CP%3E%26nbsp%3B%3D%3FWindows-1252%3FQ%3FNQm7uW2nxq%2BiE9ee9IV4iC4gx6xwwsPGi2sKOgO0Ex%2FrcK6TAJTMLahp%3F%3D%3C%2FP%3E%3CP%3E%26nbsp%3B%3D%3FWindows-1252%3FQ%3FLN2HH33xI9M0wAffcjJ0cW3NDjEmfKXcCSJXmeAoF51e0folA9uOXBGG%3F%3D%3C%2FP%3E%3CP%3E%26nbsp%3B%3D%3FWindows-1252%3FQ%3FhLvKraZq7OWe18wLTt7oFKfebNuvtc%2FKJKvblMuv%2BVyC4Q%3D3D%3D3D%3F%3D%3C%2FP%3E%3CP%3EContent-Type%3A%20multipart%2Fmixed%3B%3C%2FP%3E%3CP%20class%3D%22x-hidden-focus%22%3Eboundary%3D%22_004_DM5PR16MB00413508FA4ED1E2369E7C3EC7FF0DM5PR16MB0041namp_%22%3C%2FP%3E%3CP%3EMIME-Version%3A%201.0%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-LABS%20id%3D%22lingo-labs-363894%22%20slang%3D%22en-US%22%3E%3CLINGO-LABEL%3EExchange%3C%2FLINGO-LABEL%3E%3CLINGO-LABEL%3EOffice%20365%3C%2FLINGO-LABEL%3E%3CLINGO-LABEL%3ESecurity%3C%2FLINGO-LABEL%3E%3C%2FLINGO-LABS%3E%3CLINGO-SUB%20id%3D%22lingo-sub-364786%22%20slang%3D%22en-US%22%3ERe%3A%20Email%20Trace%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-364786%22%20slang%3D%22en-US%22%3EYou%20may%20not%20be%20able%20to%20do%20a%20trace%20route%2C%20but%20you%20should%20be%20able%20to%20find%20the%20e-mail%20in%20security%20and%20compliance%20search%20for%20the%20user%20that%20sent%20it%20mailbox.%20If%20it's%20there%20it's%20most%20likely%20a%20phishing%20scheme%20that%20your%20user%20was%20compromised%20and%20they%20used%20the%20account%20via%20webmail%20to%20send%20out%20targeted%20messages.%20Seen%20it%20before.%3C%2FLINGO-BODY%3E
Highlighted
Pn1995
Contributor

I have Office365 business and I've just been informed by one of our customer that in Nov 2018 they got a email from us providing them with details of a new bank account that was to used for payment. 

 

This has only recently come to light and as it was over 90 days ago I can't do any email traces from within Office365.

 

The email header is below. The email looks like it has come from us. Is there anyway to check if this has come from a Outlook email account within our company? Or can we tell if it was sent from maybe a SMTP connected email?

 

email header with email removed....

 

Received: from BN6P154MB0033.NAMP154.PROD.OUTLOOK.COM (2603:10b6:903:77::30)

 by CY4P154MB0044.NAMP154.PROD.OUTLOOK.COM with HTTPS via

 CY4PR06CA0044.NAMPRD06.PROD.OUTLOOK.COM; Wed, 17 Oct 2018 15:43:01 +0000

Received: from BN6P154CA0008.NAMP154.PROD.OUTLOOK.COM (2603:10b6:423:70::18)

 by BN6P154MB0033.NAMP154.PROD.OUTLOOK.COM (2603:10b6:423:70::20) with

 Microsoft SMTP Server (version=TLS1_2,

 cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.1228.27; Wed, 17 Oct

 2018 15:42:59 +0000

Received: from AM5EUR03FT048.eop-EUR03.prod.protection.outlook.com

 (2a01:111:f400:7e08::204) by BN6P154CA0008.outlook.office365.com

 (2603:10b6:423:70::18) with Microsoft SMTP Server (version=TLS1_2,

 cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.1228.27 via Frontend

 Transport; Wed, 17 Oct 2018 15:42:59 +0000

Received: from mx0a-00240e01.pphosted.com (148.163.149.44) by

 AM5EUR03FT048.mail.protection.outlook.com (10.152.17.177) with Microsoft SMTP

 Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id

 15.20.1250.12 via Frontend Transport; Wed, 17 Oct 2018 15:42:58 +0000

Received: from pps.filterd (m0114529.ppops.net [127.0.0.1])

by mx0a-00240e01.pphosted.com (8.16.0.22/8.16.0.22) with SMTP id w9HFdLpn027672

for <removed@removed>; Wed, 17 Oct 2018 11:42:56 -0400

Received: from pps.reinject (localhost [127.0.0.1])

by mx0a-00240e01.pphosted.com with ESMTP id 2n66b4rff6-1

(version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT)

for <removed@removed>; Wed, 17 Oct 2018 11:42:56 -0400

Received: from pps.reinject (m0114529.ppops.net [127.0.0.1])

by pps.reinject (8.16.0.20/8.16.0.20) with SMTP id w9HFgRF6030296

for <removed@removed>; Wed, 17 Oct 2018 11:42:56 -0400

Received: from nam02-bl2-obe.outbound.protection.outlook.com (mail-bl2nam02on0120.outbound.protection.outlook.com [104.47.38.120])

by mx0a-00240e01.pphosted.com with ESMTP id 2n66b4rew9-1

(version=TLSv1.2 cipher=ECDHE-RSA-AES256-SHA384 bits=256 verify=NOT)

for <removed@removed>; Wed, 17 Oct 2018 11:39:10 -0400

Received: from DM5PR16MB0041.namprd16.prod.outlook.com (10.172.92.8) by

 DM5PR16MB0075.namprd16.prod.outlook.com (10.172.89.23) with Microsoft SMTP

 Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id

 15.20.1228.24; Wed, 17 Oct 2018 15:39:03 +0000

Received: from DM5PR16MB0041.namprd16.prod.outlook.com

 ([fe80::d54e:ab92:4038:aa30]) by DM5PR16MB0041.namprd16.prod.outlook.com

 ([fe80::d54e:ab92:4038:aa30%5]) with mapi id 15.20.1228.032; Wed, 17 Oct 2018

 15:39:02 +0000

From: <removed@removed>

To: (removed)@(removed)>

Subject: Re: Follow up

Thread-Topic: Follow up

Thread-Index: AQHUZisAhJsJdYlsJkqWcemRTH4yxqUjijqQgAAIOLM=

Date: Wed, 17 Oct 2018 15:39:02 +0000

Message-ID:

 <DM5PR16MB00413508FA4ED1E2369E7C3EC7FF0@DM5PR16MB0041.namprd16.prod.outlook.com>

References:

 <DM5PR16MB0041C9F776365D3A102915CCC7FF0@DM5PR16MB0041.namprd16.prod.outlook.com>,<CY4P154MB00448F9ACAEE27B6A3ED6B5EE5FF0@CY4P154MB0044.NAMP154.PROD.OUTLOOK.COM>

In-Reply-To:

 <CY4P154MB00448F9ACAEE27B6A3ED6B5EE5FF0@CY4P154MB0044.NAMP154.PROD.OUTLOOK.COM>

Accept-Language: en-US

Content-Language: en-US

X-MS-Exchange-Organization-AuthSource:

 AM5EUR03FT048.eop-EUR03.prod.protection.outlook.com

X-MS-Has-Attach: yes

X-MS-Exchange-Organization-Network-Message-Id:

 661d3c6a-4782-486d-894f-08d6344736e1

X-MS-Exchange-Organization-SCL: -1

X-MS-TNEF-Correlator:

x-originating-ip: [155.94.250.23]

x-ms-publictraffictype: Email

x-forefront-antispam-report:

 CIP:148.163.149.44;IPV:NLI;CTRY:US;EFV:NLI;SFV:SFE;SFS:;DIR:INB;SFP:;SCL:-1;SRVR:BN6P154MB0033;H:mx0a-00240e01.pphosted.com;FPR:;SPF:None;LANG:en;

received-spf: None (protection.outlook.com: removed.net does not designate

 permitted sender hosts)

dkim-signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

 d=advmetal.onmicrosoft.com; s=selector1-removed-net;

 h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck;

 bh=g+0OMTrUoMg3lweT/rqWN8iyDgsSuYOfDVA8UDLjLFI=;

 b=gk/CCFpXDpaiQWDPIJjY98Qn6fh5s6lPTQ7tgnVQojmUW87fFXtl1iDJYgePW9AotPcuYWVe05nXSUawTILkEtq0JZoW3+evKObPNUiawXJ3H9nuCqK7x+KTCsoqq07d4mazxVXBxkgLduQwAtN+QtSHMvpcpuPD/7IBs8XweFg=

authentication-results: spf=fail (sender IP is 148.163.149.44)

 smtp.mailfrom=removed.net;removed.com; dkim=pass (signature was verified)

 header.d=advmetal.onmicrosoft.com;removed.com; dmarc=none action=none

 header.from=removed.net;compauth=pass reason=115

x-proofpoint-virus-version: vendor=fsecure engine=2.50.10434:,,

 definitions=2018-10-16_14:,, signatures=0

authentication-results-original: ppops.net; spf=pass

 smtp.mailfrom=(Removed)@(removed); dkim=pass header.d=advmetal.onmicrosoft.com

 header.s=selector1-removed-net; dmarc=none

x-microsoft-exchange-diagnostics-untrusted:

 1;DM5PR16MB0075;6:8ErN2MVCHSD2D16Wl+4RlHFMDveElWSFotx9rIrQbQL91giJhvm7BEDdu1Udb6EepyjGuBzsxw+68p+Bmh8KEaGXtKRQ7wSvkgBzxWtwEaL+ssDWah8rzoLJbmI8JM6Nreh7LDGMXX2dzWNya7BQb/dl1CA8GF6dvXafGrwuUL97O5GAqbyw6rsCjTT3aXq3kKrlw8ywriFMygqnV2393YFe5xH4KllHocI1xgsNW7eHn3trLrGgkwUjnue+eCz2GLAQPJlwuKscZ4HhKBt8xgrtLo6YFsibYXqFhYn2U8Xy48Ws4HOVlIodV6MjBk2m/uNHwTg6ubD92Tq1KPSMRYqTHON9GnBp2kCRRmxr4MCfQEP8NouC4pUOkBbdbrUkbA1FmXG1G9DUEsPrzzZHsgZo2NTfWVIuBoW10A3nZekglPpgcj37XJP2uhylxAHCr69mFHj+JtAcb60UgzfjpA==;5:mza9ZMo+BRSVzaur5Q/HINgZ4R0B2xqeTHffKwyrPz7uVZJ2DwlMersOaYRRR0ANxjnR3N/0/zBxbdAZfccBJF1kZO7Jgz2Lpd/H+UTYUcNdLQf5ZFe4+2n8ZaxOG14Sh6bpmIXkW7cteDqOue8/eNY+oKrjLfV9HQ4XYUlexxk=;7:/QwgHHsxqrQvY4rNuf7/tpM9bOjqlvwwli4NLVLYE7ly/JwYJV7mA96uV/1xA3jxZj0YoV3gYEnZR4qOWlSvJqW/5ZNAe9lWSpiHjTXkyODJ76A6mw73wjz9vnpiABhdECrQJNk4piqGXLL5fFctJ1Xj1iA7QEZbhrIyNRHHIE7/FHpiUl4NA87z0YbJkJKYu1kRv4pzzkItld20H9LIFdiaz1X1TwfkXIxKV3niSPQa5BlNdXQ5mtMhNJDJ9/Fr

x-ms-office365-filtering-correlation-id: 661d3c6a-4782-486d-894f-08d6344736e1

x-microsoft-antispam-untrusted:

 BCL:0;PCL:0;RULEID:(7020095)(4652040)(7021145)(8989299)(5600074)(711020)(4534185)(7022145)(4603075)(4627221)(201702281549075)(8990200)(7048125)(7024125)(7027125)(7023125)(2017052603328)(7153060)(49563074)(7193020);SRVR:DM5PR16MB0075;

x-ms-traffictypediagnostic: DM5PR16MB0075:|BN6P154MB0033:

x-microsoft-antispam-prvs:

 <DM5PR16MB0075A272BADB0F03323EDCBDC7FF0@DM5PR16MB0075.namprd16.prod.outlook.com>

x-exchange-antispam-report-test:

 UriScan:(50479424662132)(4376648964400)(229409888891308);UriScan:(50479424662132)(4376648964400)(229409888891308);

x-ms-exchange-senderadcheck: 1

x-exchange-antispam-report-cfa-test:

 =?Windows-1252?Q?BCL:0;PCL:0;RULEID:(102415395)(6040522)(2401047)(8121501?=

 =?Windows-1252?Q?046)(5005006)(3231355)(944501410)(4983020)(52105095)(300?=

 =?Windows-1252?Q?2001)(10201501046)(93006095)(93001095)(149066)(150057)(6?=

 =?Windows-1252?Q?041310)(20161123560045)(2016111802025)(20161123558120)(2?=

 =?Windows-1252?Q?0161123562045)(20161123564045)(6043046)(201708071742011)?=

 =?Windows-1252?Q?(7699051)(76991095);SRVR:DM5PR16MB0075;BCL:0;PCL:0;RULEI?=

 =?Windows-1252?Q?D:;SRVR:DM5PR16MB0075;BCL:0;PCL:0;RULEID:(8211001083)(10?=

 =?Windows-1252?Q?2415395)(2018062399030)(2018011200283)(2401047)(7630418)?=

 =?Windows-1252?Q?(8121501046)(52410047)(2018011210174)(2018011211064)(201?=

 =?Windows-1252?Q?8011212028)(2018011213028)(2018011214028)(2018011215028)?=

 =?Windows-1252?Q?(2018011216028)(2018011217028)(2018011218028)(2018011219?=

 =?Windows-1252?Q?092)(2018011220252)(2018011221063)(2018011222027)(201801?=

 =?Windows-1252?Q?1223027)(2018011224027)(2018011225035)(2018011229035)(20?=

 =?Windows-1252?Q?18011232269)(2018011233052)(2018021202149)(98810176)(201?=

 =?Windows-1252?Q?8021203149)(98815176)(7631346)(7632307)(7633261)(1430482?=

 =?Windows-1252?Q?)(1431068)(1432130)(1440239)(823300264)(823350442)(82341?=

 =?Windows-1252?Q?1253)(9101536074)(93006095)(93001095)(10201501046)(30020?=

 =?Windows-1252?Q?01)(3231355)(901025)(902075)(913088)(7045084)(944500087)?=

 =?Windows-1252?Q?(944510158)(944921075)(946803086)(946901078)(9300000249)?=

 =?Windows-1252?Q?(9301004277)(4983020)(4982022)(52103095)(52105095)(52106?=

 =?Windows-1252?Q?170)(52408095)(98821027)(98822027)(52401380)(52601095)(5?=

 =?Windows-1252?Q?2606095)(52505095)(52406095)(52305095)(52206095)(8886224?=

 =?Windows-1252?Q?0)(88860193)(1102011)(1610001)(8301001075)(8301003183)(2?=

 =?Windows-1252?Q?01708071742011)(7699051)(76991095);SRVR:BN6P154MB0033;BC?=

 =?Windows-1252?Q?L:0;PCL:0;RULEID:;SRVR:BN6P154MB0033;?=

x-forefront-prvs: 08286A0BE2

x-forefront-antispam-report-untrusted:

 SFV:NSPM;SFS:(10019020)(346002)(376002)(39840400004)(136003)(366004)(396003)(199004)(189003)(6116002)(3846002)(99286004)(19627235002)(6606003)(6916009)(316002)(71200400001)(71190400001)(68736007)(5024004)(2900100001)(74316002)(221733001)(256004)(14444005)(25786009)(66066001)(86362001)(6506007)(53546011)(2906002)(76176011)(7696005)(7736002)(229853002)(102836004)(105586002)(33656002)(6436002)(8936002)(99936001)(97736004)(106356001)(19627405001)(19273905006)(11346002)(446003)(81156014)(3480700004)(81166006)(508600001)(476003)(14454004)(53936002)(486006)(5250100002)(186003)(55016002)(8676002)(6246003)(5660300001)(26005)(7116003)(236005)(9686003)(6306002)(54896002)(606006)(362424003);DIR:OUT;SFP:1102;SCL:1;SRVR:DM5PR16MB0075;H:DM5PR16MB0041.namprd16.prod.outlook.com;FPR:;SPF:None;LANG:en;PTR:InfoNoRecords;A:0;MX:1;

x-microsoft-antispam-message-info-original:

 RwyzSoIxcGCQBXq5kK5X03BoLs797sLnSAIwHigUDjwFZzmUDPx2RwwpUvt4I4pozfhFxG8Xbjj/CEVBYECGpmSP+ifxa4cu2sv9Q/BgvUIkvWGuC2D8FGQ9p6puQaYxBsCD9OAbmdFJd0cN2ZjJtgwIhs3BVy5ItKrcifQHUomKpYxcI70DBwLJNPUytqlDClVuf/18Gd2hL4LUHFpwyFp1LBlThpfYHe+EtGNvdUL7r3Db/YByxVTtZEFkhGK4sOfJZS+DldPwtMS+9ydJlzlcND2WAX3Sjeyri3VWEvfbAP5PR2NRNY0IGpPO7arr/Jwc71V8putBQ3hQPvrDNunvJdrFRXNlmOaNwdvyOaY=

spamdiagnosticoutput: 1:3

x-ms-exchange-transport-crosstenantheadersstamped: BN6P154MB0033

x-clx-shades: MLX

x-clx-response: 1TFkXGxMbEQpMehcbGBwRCllNF2dmchEKWUkXGnEaEBp3BhsdG3EfGhAadwY

 YGgYaEQpZXhdoY3kRCklGF0NETU9YWUVGRnVCRVleT04RCkNOF356ZH8ZB0J9SU1SWHVGa09Mb1

 5HElx1a2FgZR5tSUlEEQpYXBcfBBoEGx8bB0gaSBwTSUwfBRsaBBsaGgQeEgQbEBseGh8aEQpeW

 Rd5BXoaSBEKTVwXGBgdEQpMWhdpa11rEQpNThdpaxEKTEYXb2tra2xraxEKQ1oXGxoeBB4dBBkS

 BBsYGhEKQl4XGxEKQlwXGhEKQkUXYR5FTRNQa1ITUHIRCkJOF2t4X2VMT1phckdMEQpCTBdkSRk

 eTmhCHUtlTxEKQmwXbmNhfWBsHE1zEm8RCkJAF2UBeERHHWgda2EbEQpCWBdgQG5gBXwfHxxmfB

 EKTV4XGxEKWlgXHREKcGcXbGB4E0ZYTgVveH8QGRoRCnBoF2seaVtPeXJ5UEVoEBkaEQpwaBdve

 B8YU155ZEVfExAZGhEKcGgXa0d7G3lmZ04TQGUQGRoRCnBoF2JaR2wee2wfWXBLEBkaEQpwaBdt

 RVxfGXpeQUVzaxAZGhEKcGcXZ2toemRnZUZGem8QGRoRCnB/F2JyRk5tUGd4XGIdEBsZGhEKcF8

 XbEhBQnNZU1xSQ00QGxMbEQpwfRdgYR1sX1xcUFMfYRAbHR4RCnB9F2BhHWxfXFxQUx9hEBsdHh

 EKcGsXbB8YYRhIbkRrZkAQGRoRCnBLF3p4bkJjGU5FBRtQEBkaEQpwbBdrexlDeBtoc314WBASH

 xEKcEwXa0NpRUJGQH5eTVsQGRoRCm1+FxsRClhNF0sRIA==

x-proofpoint-spam-reason: safe

x-eopattributedmessage: 0

x-eoptenantattributedmessage: abf9983b-ca77-4f20-9633-ca9c5a847041:0

x-ms-exchange-transport-crosstenantheadersstripped:

 AM5EUR03FT048.eop-EUR03.prod.protection.outlook.com

x-ms-office365-filtering-ht: Tenant

x-microsoft-exchange-diagnostics:

 1;BN6P154MB0033;6:RDs09mBtkh/ejavSbq1Qy7mfaIi8OTWq+ujX0AzskXaJW4eG+RNKpEDLtxar2LNkd4Hjt5c4cGvBcW7Gm3on0Pr/ahfMJjo/XM64Y+3O0fjpyR+/RvmFFSOAukkZSRw1779xp1Oev+FuZvZBSOuJi2TciCnkylFh3s51vSoB+n+0jNdD+WEzBurI3+r3Ol0ebOvSDiviDjxQfDl/6krarypFvjE8Vysn6HuNnXXm+oI9ZyDWyfKK9jPEWbHoOzkVuQRTpWRTtlpo+ZCC5000Srp0nVzOqLiy1P9ogxlpt16gpJybvNE5//hTpEA0qAiSY5og1l+VvToq1TzKCneJRz0WSAapHe8lGAiW9cZTDjZwM4UnJOj63HgzRv+I1lDeByl8Z7yCLb7AkhHm9wYMFmuTLxWANXqgaAJx/SQhRnPtPrvaEmJcsWP/4jBY9q95t1GuXgWJa/gBXgO7qBwaQA==;5:SRDbJFCjdw3lOPrj9iMJy6yRvUt1DanQas3brJBlQdfxGPR+5xaX5sFz5ajoW8MOnZqG/zkSbNLTQF7+rBHYFAEVDbfXz5DhZBEwFaAjPk5r6HNMcLbslClQVNP5bAUJ5MO8mb0d/hf6KZSy8kzyMyloBdcak5E0p6B7PuBvESg=;7:j/rOzuNAxcQTn/+L2LrNifG+xVqedbJPdEKHzt7h3XZnW6bKagcHph2EPo9K/89ihQzJlXTxVfJ1lgl9sKVqiMu3ikZ73cCgLwrX6jQWMujQn68uNnAqcOE1gCfMeGC06u0pvnwXl2FASnNUKTfBIKfgrhmnY5s8aYysDGnGSr/FY5AjCyK3tbTsFutS5NimgaewDweDtPbngm+uViNkQVkmQQhr+UTXvhBmlxG2dnOuBJMy/vIOsCtXHMqIpXkD

x-ms-office365-filtering-correlation-id-prvs:

 0aa51a29-66e7-44b6-d714-08d63446aa4a

x-microsoft-antispam:

 BCL:0;PCL:0;RULEID:(7020095)(4652040)(5600074)(710020)(711020)(4605076)(49563074)(1401270)(8001031)(1420028)(1417108)(71702078)(7193020);SRVR:BN6P154MB0033;

x-microsoft-antispam-message-info:

 =?Windows-1252?Q?PNwHdragiz5NOUdiLKx4m4mZ8Rh/KxfAZ7wtfszjLK32DVZ6jOgpxxiJ?=

 =?Windows-1252?Q?7tYligHpOFK34Y21hNfHNtuqMI7/wkLaW2Poh3umcWqGASvMl+sDFzik?=

 =?Windows-1252?Q?daJUgWJCt7nwV2zh9fYEkzCzZEJUM9T1Dx4ceqIfOH3rid5cKlbuXHVY?=

 =?Windows-1252?Q?PQ19gYNHjAh8PLs8llyAbMDe9ueqas+cRjvL2PLwvRpJrl9gjzbLVp5F?=

 =?Windows-1252?Q?oDrZ8Zp9oeFWXhZA1KEgNVliVh5G7cZa98Wsd9BKppTBZiuDC4pXs3Eg?=

 =?Windows-1252?Q?/E7djx+AI3FmMbIuY3GREVIwGd73iA7TrvENRqbxQg1qyQaOghL5XhjU?=

 =?Windows-1252?Q?8I33QVXjazB4q9tXWmMsOtnLBsBJbUHLzlyAayiKOtUEuWSPdvvwVDey?=

 =?Windows-1252?Q?a+tE89hIIqgIWg0iuz3+tuvNeiehMztb3MZ2wrxg7IDAAlgEVt8IQ6Bx?=

 =?Windows-1252?Q?82sYTnIMnNMpiRha40+5Tbc2GlyB9V9czkTzH/HnbUzXOoMON5scPtSs?=

 =?Windows-1252?Q?Pl0JSRmSHV9qljct6lOZakEVRyglpN8mVxdjVqn/ovFdBACPr+Pui3P/?=

 =?Windows-1252?Q?3x3ZHs+kgQwAbvrGlDhCn8k3cjCezJBmw8fCbPg22f2debDfg72eZ3bM?=

 =?Windows-1252?Q?XsAqkj70ElBCUbVTXdWKmEVNQfXTPMTAVAmXtNBl4QdiHFi7xkzeSJ9y?=

 =?Windows-1252?Q?Och0bHXE3KQ49vWr5hTMk74lbGlpx5LC0gmQF4eNWOYAgtN3QoV0R84J?=

 =?Windows-1252?Q?djCcvCqlqkp87aJYDeE6058iEEEuMNwToyct1XtDibaNzaYb7rQf60+c?=

 =?Windows-1252?Q?l3hnrhZNvG1dc7H3KrgLVgwOGQNTvmghd7TIt2VTp9cVxBc5qXBBBf95?=

 =?Windows-1252?Q?ZuhfX+ZQ+YfrevpJtNOL6RKqnGXN91zwB4gX5A+VBP4oSZQp47sFcnj0?=

 =?Windows-1252?Q?47zU97wxKffxyluOoZAr+zAOZcdshD83Z0xsM5FDrbp3QmDbTr40hxxg?=

 =?Windows-1252?Q?GG1zDUZ6WiwLmfJr2RusN5E01YvMKwYSJol2APsI4mCywLuKcaRbBKw9?=

 =?Windows-1252?Q?MQJP70Z3oKdg+gh9w4oofEZVFi7xc9Z0QR7wFw=3D=3D?=

x-ms-exchange-crosstenant-originalarrivaltime: 17 Oct 2018 15:42:58.0857 (UTC)

x-ms-exchange-crosstenant-network-message-id:

 661d3c6a-4782-486d-894f-08d6344736e1

x-ms-exchange-crosstenant-id: abf9983b-ca77-4f20-9633-ca9c5a847041

x-ms-exchange-crosstenant-fromentityheader: Internet

x-ms-exchange-transport-endtoendlatency: 00:00:03.0640563

x-ms-exchange-processed-by-bccfoldering: 15.20.1228.020

X-Microsoft-Exchange-Diagnostics:

 1;CY4P154MB0044;27:uAbRBJDG5UBLUuYg26lAXqA3d9EQkD2ZPkxX2eqvWJTGE5r0QRFdVNaIZIyJhrZQqcltd0+EY0zPYxQuJcQ1gn/rB5GwirymL3dpR9ld+lTjTmaITE269UNm72RN8a9ghvAr+djikntZkN23ilPp4cqqy8egTxzkkvcRS1D80RjlahPrhs1GzN9+gfKy/QYeo2Mt+nMjuePzm/RKKt6uORbmZZCEVdqOtqXhDR3gC++unPdLcTPi74iYj7vAPdnenPoW78cM+9u1tP/uo/2G2R9EJt9GBqKf05M3rSGEkB5s/BMLwZkh2cCdtRZopI81vHyHsdlefwks8AmKNnIfgflyXwTqvPVr8n8IPjXcgzJywx2L3FGLB+hc77bjzXfAYHVQGaKJROhF3cKomYNGIKpx5xVUInCLucE24+mLziP4EwPAwNmVNA26YCS7it5H

X-Microsoft-Antispam-Mailbox-Delivery:

 abwl:1;ucf:0;jmr:0;ex:0;auth:0;dest:I;ENG:(750119)(520011016)(520006050)(702028)(944506303)(944626516);

X-Microsoft-Antispam-Message-Info:

 =?Windows-1252?Q?lzORpj9qkJEQRcSjzLw657GvlWfgRMjYC4Aoo9EP7Lt2zcncmgCdayKJ?=

 =?Windows-1252?Q?xl4hcwnIEOlLoJVUQcDOAKnYsANqoZMWD0vCSe0hQO1VcUd8BNFenry7?=

 =?Windows-1252?Q?196pDATUqQyZvm10w2qDG6kKSsWW3KDTDA3SkzwYsRG6z5663kXGv2kr?=

 =?Windows-1252?Q?L7oemyk+zEHn4GRxUqyN80KbiDiwzk/jiq4BuycHcPt/CSNi1c4r3ak3?=

 =?Windows-1252?Q?zKOwy6FSELEG7flTX2N6ppyuqGvVMqOsbq0OsU0jBr1uAlMv/myP8P4O?=

 =?Windows-1252?Q?JDOP5FiZJ5ZbxQrUfW7u/tTLZf0TCT2LZONKOTlBbdMghcMHyvQ+YgPz?=

 =?Windows-1252?Q?JwXcpCiHPKAaCaztwmjbq3sIMEjsY8PSV1gE0y0/bux+Fu8MzBJr/wA3?=

 =?Windows-1252?Q?xlbpNCFaIIwa+CyPmRW3JEl8UkvNayFYrIn5wizAYdLQhi/ruYPj4tQz?=

 =?Windows-1252?Q?TO/tcmdDG6OFgghy84CjmlF9/Yg+QemOZ6WgzH3wPEX9Hir7fgRXJ2MY?=

 =?Windows-1252?Q?nEfLrAo6Li5NznhIRQY4hXcwIB6KTooBLNknKA3E//rqAiG8G7YF2wj2?=

 =?Windows-1252?Q?0ZKBZm6Fm5pTNpNtdenu/fb9Gkapjb1XXjtAoIT25mxtOV8mZwP13NcH?=

 =?Windows-1252?Q?1BSNX+dDXJ3VXH19mRtxF3if3C5vA/CuiRz6K8uKylsx68rffOTi7gJs?=

 =?Windows-1252?Q?SCoTPqa/NHpmMPk7Pcfas0JGWMhAwmRHjNx+KSlMCi8w8fO3uXIaapVZ?=

 =?Windows-1252?Q?eVdIPDhYNFo/CQTwEHj+VHtJpMTFpksKgy2IvAgu9ocSgXdVJZmuH6lZ?=

 =?Windows-1252?Q?0Myu/6Nrp+0AAt06K7DR/1p6h0x4ihBwfxCdzWQL3faXcvmVQT6gIrQc?=

 =?Windows-1252?Q?0r8idmtyGf06RPPVPxXcCbqZDp3vxxQS8SAE3zvQIYrNoIV2KQzCpD7Z?=

 =?Windows-1252?Q?jw4mdcdFgNbXAlylAEe92+rZ1wqtN56iUzkMbkqPpjP7+VOEMhd7ZqmU?=

 =?Windows-1252?Q?NQm7uW2nxq+iE9ee9IV4iC4gx6xwwsPGi2sKOgO0Ex/rcK6TAJTMLahp?=

 =?Windows-1252?Q?LN2HH33xI9M0wAffcjJ0cW3NDjEmfKXcCSJXmeAoF51e0folA9uOXBGG?=

 =?Windows-1252?Q?hLvKraZq7OWe18wLTt7oFKfebNuvtc/KJKvblMuv+VyC4Q=3D=3D?=

Content-Type: multipart/mixed;

boundary="_004_DM5PR16MB00413508FA4ED1E2369E7C3EC7FF0DM5PR16MB0041namp_"

MIME-Version: 1.0

1 Reply
You may not be able to do a trace route, but you should be able to find the e-mail in security and compliance search for the user that sent it mailbox. If it's there it's most likely a phishing scheme that your user was compromised and they used the account via webmail to send out targeted messages. Seen it before.
Related Conversations
Tabs and Dark Mode
cjc2112 in Discussions on
46 Replies
flashing a white screen while open new tab
Deleted in Discussions on
14 Replies
Stable version of Edge insider browser
HotCakeX in Discussions on
35 Replies
Security Community Webinars
Valon_Kolica in Security, Privacy & Compliance on
13 Replies
How to Prevent Teams from Auto-Launch
chenrylee in Microsoft Teams on
29 Replies