It's fascinating. Also Microsoft simply doesn't care. I get SO MUCH spam that comes direct from MS and for awhile I was reporting it, but they'd look at headers like this and claim it did not come from them. I love being gaslit! Including a bunch of the internal MS headers just so you can see how much info they have to identify the customer...
Charles From [email protected] Tue Apr 14 21:29:22 2026 Return-Path: <[email protected]> Delivered-To: ME@MYDOMAIN X-Spam-Status: No, score=1.7 required=4.0 tests=BAYES_50,HTML_MESSAGE, MIME_HTML_MOSTLY,MPART_ALT_DIFF,RCVD_IN_DNSWL_NONE,RCVD_IN_MSPIKE_H2, RCVD_IN_VALIDITY_SAFE_BLOCKED,SPF_HELO_NONE,T_KAM_HTML_FONT_INVALID autolearn=disabled version=3.4.2 X-Spam-Scores: test-scores=BAYES_50=0.8,HTML_MESSAGE=0.001, MIME_HTML_MOSTLY=0.1,MPART_ALT_DIFF=0.79,RCVD_IN_DNSWL_NONE=-0.0001, RCVD_IN_MSPIKE_H2=0.001,RCVD_IN_VALIDITY_SAFE_BLOCKED=0.001, SPF_HELO_NONE=0.001,T_KAM_HTML_FONT_INVALID=0.01 X-Spam-Bayes-Toks: Tokens: new, 97; hammy, 14; neutral, 56; spammy, 6. Received: (qmail 74388 invoked by uid 89); 14 Apr 2026 17:29:21 -0400 Delivered-To: ME@MYDOMAIN Received: (qmail 74378 invoked by uid 0); 14 Apr 2026 17:29:21 -0400 Received: from vmmail.bway.net (HELO mx1.bway.net) (216.220.96.19) by mx1.bway.net with SMTP; 14 Apr 2026 17:29:21 -0400 Received: from MRWPR03CU001.outbound.protection.outlook.com (mail-francesouthazon11021122.outbound.protection.outlook.com [40.107.130.122]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mx1.bway.net (Postfix) with ESMTPS id D6CD21C327EB for <ME@MYDDOMAIN>; Tue, 14 Apr 2026 17:29:21 -0400 (EDT) ARC-Seal: i=1; a=rsa-sha256; s=arcselector10001; d=microsoft.com; cv=none; b=ysc/+SS106eQfOQgFOXPLdgVCzIzLmjHhZCBrb7mR/voSpO/mubqDJCJ57ZvWfXEFRHDFQx8GqK+7OY2C6hC95pAOTpQkt7llax/liTj496yq8nXM+/05akJeMb5IXbYvc1V8cjuQY2D2bKQnE+oxSwhVfrNR05eCMrgnmXXLge2MTazNdAPmbFeGeodQlJGRr5FmRvWqN9GKmVoKT41NKT/mzZ/D2I1GrQI33Y47jKnHc4zXUO8XI76urPs1aw5/ojN4ofQ4ae7yfLo0y9fXq9EPJb1xm/X68NIEtfIxQp7MxQSSCBzgiOF1GaC2LuvJzrJx92V+JKkEvNWvrLnSA== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector10001; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1; bh=OSh3C0bo7G3Cqf5QZFBCMRhiAf3j8xrC5gWoHNQ4kgM=; b=hH3cgvWCBrjc60ryYZeKDD6EVpFAQuAJzm7PDBXVv3cLgCfVGwfQ9GN5TQzcNb69SPX8fsDrhhXENwnR0ZFMfPbYqDLaGDk5F0OMH4FyW8Ol2OQYtFa7Vn00tg+d52/JU2zZA65DmS7CNVui3kZT8b2vtcIRiLDRev+sIXJuruP1Q4blYmKRtr+5VGJSHcFVZNPZzpe/1UUuNTkxNtciuNZjyQWBoJilBS/90fLlvwhxz+q4CqLG0hOYwFu5UAHuV3/U+Mj33WAc3Ly1rQSODbRCJU6872YBaqSEpPjrzS7DETlm8T4Num+W+5i8ZFF1gKGWoIQJLI517UiY8bkb2g== ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=fail (sender ip is 170.168.15.15) smtp.rcpttodomain=bway.net smtp.mailfrom=adamoselom.uno; dmarc=fail (p=quarantine sp=quarantine pct=100) action=quarantine header.from=adamoselom.uno; dkim=none (message not signed); arc=none (0) Received: from DU7PR01CA0020.eurprd01.prod.exchangelabs.com (2603:10a6:10:50f::25) by PR3P250MB0275.EURP250.PROD.OUTLOOK.COM (2603:10a6:102:17e::7) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.9769.48; Tue, 14 Apr 2026 21:13:45 +0000 Received: from DB5PEPF00014B8F.eurprd02.prod.outlook.com (2603:10a6:10:50f:cafe::c9) by DU7PR01CA0020.outlook.office365.com (2603:10a6:10:50f::25) with Microsoft SMTP Server (version=TLS1_3, cipher=TLS_AES_256_GCM_SHA384) id 15.20.9769.49 via Frontend Transport; Tue, 14 Apr 2026 21:13:45 +0000 X-MS-Exchange-Authentication-Results: spf=fail (sender IP is 170.168.15.15) smtp.mailfrom=adamoselom.uno; dkim=none (message not signed) header.d=none;dmarc=fail action=quarantine header.from=adamoselom.uno; Received-SPF: Fail (protection.outlook.com: domain of adamoselom.uno does not designate 170.168.15.15 as permitted sender) receiver=protection.outlook.com; client-ip=170.168.15.15; helo=adamoselom.uno; Received: from adamoselom.uno (170.168.15.15) by DB5PEPF00014B8F.mail.protection.outlook.com (10.167.8.203) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.9769.17 via Frontend Transport; Tue, 14 Apr 2026 21:13:43 +0000 Received: by adamoselom.uno for <ME@MYDOMAIN>; Tue, 14 Apr 2026 23:13:42 +0200 (envelope-from <[email protected]>) Subject: =?UTF-8?Q?Resto?= =?UTF-8?Q?re_co?= =?UTF-8?Q?mfort?= =?UTF-8?Q?_to_e?= =?UTF-8?Q?very_?= =?UTF-8?Q?step_?= =?UTF-8?Q?you_t?= =?UTF-8?Q?ake__?= From: =?UTF-8?Q?Circulati?= =?UTF-8?Q?on_Suppor?= =?UTF-8?Q?t_?= <[email protected]> To: ME@MYDOMAIN Reply-To: <[email protected]> Date: Tue, 14 Apr 2026 23:13:42 +0200 MIME-Version: 1.0 Content-Type: multipart/alternative; boundary="----=_Part_OpJE2QK0jGc6CfbPu5Toq9kZnaNvXd1h" Message-ID: <1191bcf1-8189-4d84-8c1b-96ec0d990...@db5pepf00014b8f.eurprd02.prod.outlook.com> X-EOPAttributedMessage: 0 X-MS-PublicTrafficType: Email X-MS-TrafficTypeDiagnostic: DB5PEPF00014B8F:EE_|PR3P250MB0275:EE_ X-MS-Office365-Filtering-Correlation-Id: 95701b31-6ea1-4da0-ed1a-08de9a6ab562 X-MS-Exchange-SenderADCheck: 1 X-MS-Exchange-AntiSpam-Relay: 0 X-Microsoft-Antispam: BCL:0;ARA:13230040|61400799027|82310400026|3109299003|7049299003|36860700016|376014|13003099007|16102099003|56012099003|18002099003|8096899003; X-Microsoft-Antispam-Message-Info: JgfxnqVzLL6Y7ADfdjWJyyJbKLxCQBIMDQ6OTQHTQYiEPZm9PhhsbmV5GAzJrtSr8UnSlLOi2dVh6wgK+kmFTrrTmgArm907F//ww0HPMC9v7VB1qFDMKpd+xPW3IhVKRCbeo+5IEVuO1/xqE/f+EwkSwc/rTi2W1/Tpk9l5B2Psqc3/7tjvoFqTpFNOCNOJP9/SnTgiroWT4HZDExbKRsj5Jcq4nOqe+oTpoi1cJO13fBPpTR5hQvvovI9q/6Sp2vURViEssHl6fQHgoI1o233UH1ULIStgmA67OLD4LJxNzX3YcZtuPuLkvUtpugDzt6TqiafHQXNhYqPn6l6f1UQh5UGSAGnSYQZR216E946Z5KzqbVJTltTnLesjYZf9lTy+irYOB0zBYhxbAEq23BmjIeCh6owQMClzAeKRlKwsubUJoRDM/LxkGCxRdXwUWf6SL9FC8hehy9KB07Z5pTOkUkRJ4KkKN/S+YH2sna51HqX+qK5PRE0Vnc8T0bwRADu4t2BdFv9ZRBoNQ/Io4/c8Ph4/NSXD0fKmQuKqRZlvyhr+zJ5+r05kbMs9nIAwu3Hpn2ejgey1zDmO31uziumo3ZwRoHJQpa99odbAZiHgIohWXVINOrAGhtqrnq2758wM8Ziw17v/fNnI2LLHzsGMpB7EAON5EAYDiCOacwyvzv08zaYfssUGyG329TOpenhJ37LRz9SYLHuAXsrlCg== X-Forefront-Antispam-Report: CIP:170.168.15.15;CTRY:RU;LANG:en;SCL:1;SRV:;IPV:NLI;SFV:NSPM;H:adamoselom.uno;PTR:InfoDomainNonexistent;CAT:NONE;SFS:(13230040)(61400799027)(82310400026)(3109299003)(7049299003)(36860700016)(376014)(13003099007)(16102099003)(56012099003)(18002099003)(8096899003);DIR:OUT;SFP:1102; X-MS-Exchange-AntiSpam-MessageData-ChunkCount: 1 X-MS-Exchange-AntiSpam-MessageData-0: es1FUafvEwGZ9KUJVnVSvOcBcxMryfwrZvjn299MCdHGEQeASp2yVF011y3lK+hCpqUGODlBojofyTOptyy7yIUBAWtWwNbCFISAjccXMs6pkrQ9ua+3wVAIzj+T9fggGYbKUV15qS0UDOQcvB5Zku5fyn5dznAXWHtH4ukSTpvyiQlc/r//QDl7F4OQbJ2vHCRlQo+ThSagMK6E8fEc9xhlRRp8RP73s2xFNwKrD6s9B8bjwuGnbuiMm/eVej83uA11hOuJ6F3YHWnL8gsjfmFsjCl+CVCUoqM0CPDhTuwhIfuuyKJBxpOIhFsdLdueZCYI6TrCgM+rTvVqfVDYO0w0pw+5jk9fRirhISARBYLRmg1UQLdvYFdqo/S4GddRC/eycoj5klZ3zIuhfVZIZXNTi5rVRnFkaYNluSZ/NxJa/fRRgVvk4JYFX4e17MZw X-OriginatorOrg: adamoselom.uno X-MS-Exchange-CrossTenant-OriginalArrivalTime: 14 Apr 2026 21:13:43.1323 (UTC) X-MS-Exchange-CrossTenant-Network-Message-Id: 95701b31-6ea1-4da0-ed1a-08de9a6ab562 X-MS-Exchange-CrossTenant-Id: aa16e786-1e32-42c9-aecf-726a78277d46 X-MS-Exchange-CrossTenant-OriginalAttributedTenantConnectingIp: TenantId=aa16e786-1e32-42c9-aecf-726a78277d46;Ip=[170.168.15.15];Helo=[adamoselom.uno] X-MS-Exchange-CrossTenant-AuthSource: DB5PEPF00014B8F.eurprd02.prod.outlook.com X-MS-Exchange-CrossTenant-AuthAs: Anonymous X-MS-Exchange-CrossTenant-FromEntityHeader: HybridOnPrem X-MS-Exchange-Transport-CrossTenantHeadersStamped: PR3P250MB0275 > On May 13, 2026, at 5:52 PM, David B Funk <[email protected]> > wrote: > > > Darn, I've been seeing those intermittently for a few months now, I was > wondering how they did it. > > On Wed, 13 May 2026, Mark London wrote: > >> Is anybody else getting the fake emails described in the following web page? >> Just curious. We are getting them. >> >> https://abnormal.ai/blog/system-notification-abuse-microsoft-phishing >> >> - Mark >> >> >> > > -- > Dave Funk University of Iowa > <dbfunk (at) engineering.uiowa.edu> College of Engineering > 319/335-5751 FAX: 319/384-0549 1256 Seamans Center, 103 S Capitol St. > Sys_admin/Postmaster/cell_admin Iowa City, IA 52242-1527 > #include <std_disclaimer.h> > Better is not better, 'standard' is better. B{
