Hey everyone, I have an issue where I receive random emails that the body become symbols... The emails come from different domains and it only happens once and a while but I would love to figure this out. The body ends up looking like this when it happens no matter the message.
��z{Sʗ��� �:^�v�x j��X�*'���
+)�ȭ���X�y��zv�x j��X�*'���N����� w(v)�m� � 0E^�Ȩ�] 1��z� 0Kh�[9�nĞح˞67===
Here is the source of the message and as you can see even though when looking at the email from a client you see the symbols when checking the source you can see the original message was Content preview: Oh right!!! Let me check. Don' give it away.
I hope I can get some help on this.
From - Thu Feb 14 10:45:33 2019
X-Account-Key: account1
X-UIDL: 1550158514.30119.vmsme
X-Mozilla-Status: 0011
X-Mozilla-Status2: 00000000
X-Mozilla-Keys:
Return-Path: <SRS0=GKaw9Q=QV=falklandtrucking.com=anita@everypoint.ca>
Delivered-To: 107b@vmsme.epls.ca
Received: (qmail 30083 invoked by alias); 14 Feb 2019 15:35:11 -0000
Delivered-To: alias-localdelivery-107b@epls.ca
Received: (qmail 30048 invoked by uid 453); 14 Feb 2019 15:35:08 -0000
X-Virus-Checked: by ClamAV 0.100.2 on epls.ca
X-Virus-Found: No
X-HELO: vmsme.epls.ca
Authentication-Results: epls.ca; auth=none
Received: from Unknown (HELO vmsme.epls.ca) (127.0.0.200)
by epls.ca (qpsmtpd/0.96) with ESMTP ; Thu, 14 Feb 2019 10:35:08 -0500
Delivered-To: mbox@epls.ca
Received: from mail.epls.ca
by vmsme.epls.ca with POP3 (fetchmail-6.3.17)
for <christine.richlich@everypoint.ca> (multi-drop); Thu, 14 Feb 2019 10:35:08 -0500 (EST)
Received: from s029.panelboxmanager.com
by s029.panelboxmanager.com with LMTP id 4IkjCT2KZVxM6RIATBtR6w
for <mbox@epls.ca>; Thu, 14 Feb 2019 10:33:17 -0500
Return-path: <SRS0=GKaw9Q=QV=falklandtrucking.com=anita@everypoint.ca>
Envelope-to: christine.richlich@everypoint.ca
Delivery-date: Thu, 14 Feb 2019 10:33:17 -0500
Received: from mail-eopbgr660139.outbound.protection.outlook.com ([40.107.66.139]:2825 helo=CAN01-QB1-obe.outbound.protection.outlook.com)
by s029.panelboxmanager.com with esmtps (TLSv1.2:ECDHE-RSA-AES256-SHA384:256)
(Exim 4.91)
(envelope-from <anita@falklandtrucking.com>)
id 1guJ0m-005CnQ-A8
for christine.richlich@everypoint.ca; Thu, 14 Feb 2019 10:33:17 -0500
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
d=falkland.onmicrosoft.com; s=selector1-falklandtrucking-com;
h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck;
bh=hhiL94LH81ndaBJLZLkeT6ddVAFIVisNUz+Jqufpe3E=;
b=V3bbE+E3cBSO0ZPEzlI6ZRZZ0xwpLVcco3hFe/qQEPyNYKBw+6K9cWHsxOs+cKp8s7C6/F5l7uEY4iHYKAMUKLDpEP6zApDDMg+qlJtcDBZ/Ne/FY9FY/JrnlKzkEeByoOdP94HxyNV0tlITuYkuqpX2A93nOA3BG4MUZYmVsK8=
Received: from YTXPR0101MB1869.CANPRD01.PROD.OUTLOOK.COM (52.132.38.25) by
YTXPR0101MB1981.CANPRD01.PROD.OUTLOOK.COM (52.132.40.30) with Microsoft SMTP
Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id
15.20.1622.18; Thu, 14 Feb 2019 15:33:14 +0000
Received: from YTXPR0101MB1869.CANPRD01.PROD.OUTLOOK.COM
([fe80::89bc:1023:1741:ddc7]) by YTXPR0101MB1869.CANPRD01.PROD.OUTLOOK.COM
([fe80::89bc:1023:1741:ddc7%4]) with mapi id 15.20.1622.016; Thu, 14 Feb 2019
15:33:14 +0000
From: Anita Falk <anita@falklandtrucking.com>
To: Christine Richlich <christine.richlich@everypoint.ca>
Subject: RE: so so so
Thread-Topic: so so so
Thread-Index: AQHUxHWG4aOuiwDG1kOfmcELWS3Au6XfaoGggAABaID////QgA==
Date: Thu, 14 Feb 2019 15:33:14 +0000
Message-ID:
<YTXPR0101MB18698D5E432009E7A604B292DA670@YTXPR0101MB1869.CANPRD01.PROD.OUTLOOK.COM>
References: <aec2f804-a9b7-75db-f40e-64b8fdfbd59a@everypoint.ca>
<YTXPR0101MB18698E6BDA53E2AE41D155FDDA670@YTXPR0101MB1869.CANPRD01.PROD.OUTLOOK.COM>
<6212733b-1667-1581-7dd5-652664bba451@everypoint.ca>
In-Reply-To: <6212733b-1667-1581-7dd5-652664bba451@everypoint.ca>
Accept-Language: en-US
Content-Language: en-US
X-MS-Has-Attach:
x-originating-ip: [208.92.136.169]
x-ms-publictraffictype: Email
x-ms-office365-filtering-correlation-id: 779d68ed-63c3-46cd-6591-08d69291bc31
x-microsoft-antispam:
BCL:0;PCL:0;RULEID:(2390118)(7020095)(4652040)(7021145)(8989299)(4534185)(7022145)(4603075)(4627221)(201702281549075)(8990200)(7048125)(7024125)(7027125)(7023125)(5600110)(711020)(4605077)(2017052603328)(7153060)(7193020);SRVR:YTXPR0101MB1981;
x-ms-traffictypediagnostic: YTXPR0101MB1981:
x-microsoft-antispam-prvs:
<YTXPR0101MB198126B301BEF6CD3DCAE704DA670@YTXPR0101MB1981.CANPRD01.PROD.OUTLOOK.COM>
x-forefront-prvs: 09480768F8
x-forefront-antispam-report:
SFV:NSPM;SFS:(10019020)(396003)(366004)(136003)(346002)(39840400004)(376002)(13464003)(199004)(189003)(6116002)(97736004)(3480700005)(256004)(68736007)(25786009)(6436002)(53936002)(6246003)(106356001)(105586002)(55016002)(9686003)(26005)(3846002)(229853002)(186003)(8936002)(53546011)(76176011)(99286004)(8676002)(81156014)(81166006)(486006)(508600001)(74316002)(7696005)(6506007)(305945005)(7736002)(2906002)(33656002)(11346002)(316002)(6916009)(14454004)(71190400001)(71200400001)(66066001)(102836004)(4744005)(7116003)(446003)(86362001)(476003);DIR:OUT;SFP:1102;SCL:1;SRVR:YTXPR0101MB1981;H:YTXPR0101MB1869.CANPRD01.PROD.OUTLOOK.COM;FPR:;SPF:None;LANG:en;PTR:InfoNoRecords;A:1;MX:1;
received-spf: None (protection.outlook.com: falklandtrucking.com does not
designate permitted sender hosts)
x-microsoft-exchange-diagnostics:
=?utf-8?B?MTtZVFhQUjAxMDFNQjE5ODE7MjM6YlMvcEtMekEyUEcrcjZrbnhZcm10anJH?=
=?utf-8?B?ckVJamNFUG9Eand2M1o3ZkV5SWxQbFZGOVZKRzJtOFVxMlRIWFY2T3lEYmI0?=
=?utf-8?B?WUJHekowNFQwTnFoQXB2RFQxTkdMeVd5NHBvYnY1Uk9FY0REbm5LOVdwUU9R?=
=?utf-8?B?QkE2V05LaWZhQk5sMFZ2aGppSXh0S09HZlFhRHBITDVpZ2RmLzRqVDVHSHA0?=
=?utf-8?B?elhnTWJNS3dwKzV0alV1WW5oTFdTcCt2M0txNVlyVXhGWmI0bS9nbzA4bXlk?=
=?utf-8?B?dm1kMUl2WDYrRGNPSk9NT1ZTYUZacTZ6bEo1aVhiamNXSVozbDhuUy9CTGpl?=
=?utf-8?B?OWV1ekczYnVOZ24wRzZaYUFveHFDTXhsb2RqVWt5dTRqUmt2WjdCRmtRamxk?=
=?utf-8?B?cFF4amxVY2pncTZmdUg4cEZmcEpTdGsxNUdtaEgwL0s0MDBES2ZDY2N4NzJR?=
=?utf-8?B?cUxDNDlIT3N3ZXF4eEhyZ2lYZTVKZlpXeVkvZzdZMzNDZm5EWmcrRVM1ejgx?=
=?utf-8?B?YXdXVkZkNkFabE1tMFUxY3JsdUpwNjdHMzBTK3F4TXZPbVZUOTlPRnVQNkIx?=
=?utf-8?B?U3F0R2hGZXVpTktPa0N6djBqSEd3TW9HWDl2YmZEcTgwZ29udStRdXZQbEc2?=
=?utf-8?B?QU1FV3JMU2xFcEUzQlR4WE5rMzJrU2RPM0hLNGw5OTVIS1lrTnRza1loamxq?=
=?utf-8?B?cGg3U21WMUtDbEFKeG44OEhnYVIrRnVxRHIrYmUzRFByQVFZNGYrR3UzcEEr?=
=?utf-8?B?RnBrajBERkNhZDdkMDhtbnJDQUY5anQvazc2aGREamJVWSsvTVZJaWxLY0da?=
=?utf-8?B?QkZLMVAwRFI0V3lGUzhpOGRuNWtjSTIzWU5kdTNySTVJV3NsRkdWZ24rbVpt?=
=?utf-8?B?Q29aUExpckM1WklYKzlOejRsR2VoR0tzQzNPckY4dklLbHZiNUxHYzJXQzZl?=
=?utf-8?B?Rm5OenFxUjJqZ011dUZPUDZCQnpIUmRNL25aMkkyeHc0aXlwWUZiNTFETkVX?=
=?utf-8?B?S2d0VDQ5dGZVS2FlRDd0NUtBNC8zRmg3aHlzekhVcUdwT3FtemRpYzd1R0FM?=
=?utf-8?B?Q0ZPVmkxOE5MbGdQZDhBUWdXbm85a0k5WHg1czdHVyt2ZkhFR3pUUjQ5TTZq?=
=?utf-8?B?TkRwQ0JOVElaWm9wTE9NT2dubjlDK0E1YnQwWGVGdlhKbHp2Z3FMejRQQnJH?=
=?utf-8?B?djZmSmlJTkw1UW1aajRheHhabVZkK2ovZTR2RU9kU1N1dDF0aUpXdXZGK24r?=
=?utf-8?B?UVhvcktzNWYySEZvSUpxbjkzZEJLZVo1Tm1YOVBQbmJDYU5PSjB4RXdpd3Nr?=
=?utf-8?B?S25XTTIyNmIyYmNTaHVtbWVwTG5INGxYTHNKT0ZsbmFOUXMzMTdqYlU5YWdv?=
=?utf-8?B?cm9OeC8wZTd3a3hBWTgveEwxQ3prZTJ3Z1pBUmthS1d6Y25NVHZtRHZxd3FX?=
=?utf-8?B?MFpxbHhWZDl5cXVydm1YT0F6dW4wRGlsSkR1aSszSFoxcjI0MjhaYkkwQTRq?=
=?utf-8?B?b2RKbnoxVjg3VlhrU1p5cGVNMzdhdjh6VGMrTi95NnBENnRuVGVZNW84UE9Z?=
=?utf-8?B?VVA2M0dxbG5zME9kM3ErQVo4TTlnNWRRdVlOakswLzJnaW1ybU5EbkZvajNy?=
=?utf-8?B?RWR2ZmQxRlNSeG9WaWR4aThweEt4UXBXTlJ0THArcG1ERmp5M1NxWGlOOHc9?=
=?utf-8?Q?=3D?=
x-ms-exchange-senderadcheck: 1
x-microsoft-antispam-message-info:
UJ1Y7XLQ0D62o85C8gxsJlkPeIG4aN4Zo2kx//iSc1+xyX8Wg2Fdl/wl7IAhp3sFxm8uOGj9BQ1YXuTVH/WTMTYt6fT74HhzKGB4Xzn2ofW7d2yTW47JHeXLz4A51KBzNcRGByeovsXOcdjKST0A6WG71Y3D723cMgN81+VVfOyl/cEBNr6d1qhZsdpLsMiKCbMtE6AbNmlQ29gCKlFFEnyePP3a6onKEmlpFZovUfonom3z82PIGiXgAQTn5NDLeeRW4K2LP4QqkswLiA5ALYg6jRhscsi4oQIv8yEKRRTD4X5vUdCRkWd7q5XnCiGzS1XkMvqDXYuqe1liXU98I300neP13IUS7M3EO7NVdjnIbz9xDmfEI4xpn+8Sxsc3XzNjesZUt4pZmHbuATDNdPDJnHU/D1O8q9f2DS8hohc=
Content-Type: text/plain; charset="utf-8"
Content-Transfer-Encoding: base64
MIME-Version: 1.0
X-OriginatorOrg: falklandtrucking.com
X-MS-Exchange-CrossTenant-Network-Message-Id: 779d68ed-63c3-46cd-6591-08d69291bc31
X-MS-Exchange-CrossTenant-originalarrivaltime: 14 Feb 2019 15:33:14.3620
(UTC)
X-MS-Exchange-CrossTenant-fromentityheader: Hosted
X-MS-Exchange-CrossTenant-id: c1af1e1a-203e-460b-85aa-719d6bb7ced9
X-MS-Exchange-CrossTenant-mailboxtype: HOSTED
X-MS-Exchange-Transport-CrossTenantHeadersStamped: YTXPR0101MB1981
X-Spam-Status: No, score=-1.9
X-Spam-Score: -18
X-Spam-Bar: -
X-Ham-Report: Spam detection software, running on the system "s029.panelboxmanager.com",
has NOT identified this incoming email as spam. The original
message has been attached to this so you can view it or label
similar future email. If you have any questions, see
root\@localhost for details.
Content preview: Oh right!!! Let me check. Don' give it away.
Content analysis details: (-1.9 points, 10.0 required)
pts rule name description
---- ---------------------- --------------------------------------------------
0.0 URIBL_BLOCKED ADMINISTRATOR NOTICE: The query to URIBL was blocked.
See
http://wiki.apache.org/spamassassin/DnsBlocklists#dnsbl-block
for more information.
[URIs: falkland.onmicrosoft.com]
-1.9 BAYES_00 BODY: Bayes spam probability is 0 to 1%
[score: 0.0000]
-0.0 SPF_PASS SPF: sender matches SPF record
-0.0 SPF_HELO_PASS SPF: HELO matches SPF record
-0.1 DKIM_VALID Message has at least one valid DKIM or DK signature
0.1 DKIM_SIGNED Message has a DKIM or DK signature, not necessarily valid
X-Spam-Flag: NO
Original-Authentication-Results: spf=none (sender IP is )
smtp.mailfrom=anita@falklandtrucking.com;
X-TNEF2MIME-Plugin: MS-TNEF -> MIME
Content-Type: image/jpeg; name="image001.jpg"
Content-Disposition: inline; filename="image001.jpg"
Content-Transfer-Encoding: base64
MIME-Version: 1.0
X-Mailer: MIME-tools 5.427 (Entity 5.427)
I have other examples of this from other domains and other messages. This is just one example.