Koozali.org: home of the SME Server

Messages as Symbols!

Offline brainamess

  • *
  • 39
  • +0/-0
Messages as Symbols!
« on: February 20, 2019, 07:12:03 PM »
Hey everyone, I have an issue where I receive random emails that the body become symbols... The emails come from different domains and it only happens once and a while but I would love to figure this out. The body ends up looking like this when it happens no matter the message.

��z{Sʗ��� �:^�v�x j��X�*'���
+)�ȭ���X�y��zv�x j��X�*'���N����� w(v)�m� � 0E^�Ȩ�] 1��z� 0Kh�[9�nĞح˞67===


Here is the source of the message and as you can see even though when looking at the email from a client you see the symbols when checking the source you can see the original message was Content preview:  Oh right!!! Let me check. Don' give it away.

I hope I can get some help on this.


Code: [Select]
From - Thu Feb 14 10:45:33 2019
X-Account-Key: account1
X-UIDL: 1550158514.30119.vmsme
X-Mozilla-Status: 0011
X-Mozilla-Status2: 00000000
X-Mozilla-Keys:                                                                                 
Return-Path: <SRS0=GKaw9Q=QV=falklandtrucking.com=anita@everypoint.ca>
Delivered-To: 107b@vmsme.epls.ca
Received: (qmail 30083 invoked by alias); 14 Feb 2019 15:35:11 -0000
Delivered-To: alias-localdelivery-107b@epls.ca
Received: (qmail 30048 invoked by uid 453); 14 Feb 2019 15:35:08 -0000
X-Virus-Checked: by ClamAV 0.100.2 on epls.ca
X-Virus-Found: No
X-HELO: vmsme.epls.ca
Authentication-Results: epls.ca; auth=none
Received: from Unknown (HELO vmsme.epls.ca) (127.0.0.200)
 by epls.ca (qpsmtpd/0.96) with ESMTP ; Thu, 14 Feb 2019 10:35:08 -0500
Delivered-To: mbox@epls.ca
Received: from mail.epls.ca
by vmsme.epls.ca with POP3 (fetchmail-6.3.17)
for <christine.richlich@everypoint.ca> (multi-drop); Thu, 14 Feb 2019 10:35:08 -0500 (EST)
Received: from s029.panelboxmanager.com
by s029.panelboxmanager.com with LMTP id 4IkjCT2KZVxM6RIATBtR6w
for <mbox@epls.ca>; Thu, 14 Feb 2019 10:33:17 -0500
Return-path: <SRS0=GKaw9Q=QV=falklandtrucking.com=anita@everypoint.ca>
Envelope-to: christine.richlich@everypoint.ca
Delivery-date: Thu, 14 Feb 2019 10:33:17 -0500
Received: from mail-eopbgr660139.outbound.protection.outlook.com ([40.107.66.139]:2825 helo=CAN01-QB1-obe.outbound.protection.outlook.com)
by s029.panelboxmanager.com with esmtps (TLSv1.2:ECDHE-RSA-AES256-SHA384:256)
(Exim 4.91)
(envelope-from <anita@falklandtrucking.com>)
id 1guJ0m-005CnQ-A8
for christine.richlich@everypoint.ca; Thu, 14 Feb 2019 10:33:17 -0500
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
 d=falkland.onmicrosoft.com; s=selector1-falklandtrucking-com;
 h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck;
 bh=hhiL94LH81ndaBJLZLkeT6ddVAFIVisNUz+Jqufpe3E=;
 b=V3bbE+E3cBSO0ZPEzlI6ZRZZ0xwpLVcco3hFe/qQEPyNYKBw+6K9cWHsxOs+cKp8s7C6/F5l7uEY4iHYKAMUKLDpEP6zApDDMg+qlJtcDBZ/Ne/FY9FY/JrnlKzkEeByoOdP94HxyNV0tlITuYkuqpX2A93nOA3BG4MUZYmVsK8=
Received: from YTXPR0101MB1869.CANPRD01.PROD.OUTLOOK.COM (52.132.38.25) by
 YTXPR0101MB1981.CANPRD01.PROD.OUTLOOK.COM (52.132.40.30) with Microsoft SMTP
 Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id
 15.20.1622.18; Thu, 14 Feb 2019 15:33:14 +0000
Received: from YTXPR0101MB1869.CANPRD01.PROD.OUTLOOK.COM
 ([fe80::89bc:1023:1741:ddc7]) by YTXPR0101MB1869.CANPRD01.PROD.OUTLOOK.COM
 ([fe80::89bc:1023:1741:ddc7%4]) with mapi id 15.20.1622.016; Thu, 14 Feb 2019
 15:33:14 +0000
From: Anita Falk <anita@falklandtrucking.com>
To: Christine Richlich <christine.richlich@everypoint.ca>
Subject: RE: so so so
Thread-Topic: so so so
Thread-Index: AQHUxHWG4aOuiwDG1kOfmcELWS3Au6XfaoGggAABaID////QgA==
Date: Thu, 14 Feb 2019 15:33:14 +0000
Message-ID:
 <YTXPR0101MB18698D5E432009E7A604B292DA670@YTXPR0101MB1869.CANPRD01.PROD.OUTLOOK.COM>
References: <aec2f804-a9b7-75db-f40e-64b8fdfbd59a@everypoint.ca>
 <YTXPR0101MB18698E6BDA53E2AE41D155FDDA670@YTXPR0101MB1869.CANPRD01.PROD.OUTLOOK.COM>
 <6212733b-1667-1581-7dd5-652664bba451@everypoint.ca>
In-Reply-To: <6212733b-1667-1581-7dd5-652664bba451@everypoint.ca>
Accept-Language: en-US
Content-Language: en-US
X-MS-Has-Attach:
x-originating-ip: [208.92.136.169]
x-ms-publictraffictype: Email
x-ms-office365-filtering-correlation-id: 779d68ed-63c3-46cd-6591-08d69291bc31
x-microsoft-antispam:
 BCL:0;PCL:0;RULEID:(2390118)(7020095)(4652040)(7021145)(8989299)(4534185)(7022145)(4603075)(4627221)(201702281549075)(8990200)(7048125)(7024125)(7027125)(7023125)(5600110)(711020)(4605077)(2017052603328)(7153060)(7193020);SRVR:YTXPR0101MB1981;
x-ms-traffictypediagnostic: YTXPR0101MB1981:
x-microsoft-antispam-prvs:
 <YTXPR0101MB198126B301BEF6CD3DCAE704DA670@YTXPR0101MB1981.CANPRD01.PROD.OUTLOOK.COM>
x-forefront-prvs: 09480768F8
x-forefront-antispam-report:
 SFV:NSPM;SFS:(10019020)(396003)(366004)(136003)(346002)(39840400004)(376002)(13464003)(199004)(189003)(6116002)(97736004)(3480700005)(256004)(68736007)(25786009)(6436002)(53936002)(6246003)(106356001)(105586002)(55016002)(9686003)(26005)(3846002)(229853002)(186003)(8936002)(53546011)(76176011)(99286004)(8676002)(81156014)(81166006)(486006)(508600001)(74316002)(7696005)(6506007)(305945005)(7736002)(2906002)(33656002)(11346002)(316002)(6916009)(14454004)(71190400001)(71200400001)(66066001)(102836004)(4744005)(7116003)(446003)(86362001)(476003);DIR:OUT;SFP:1102;SCL:1;SRVR:YTXPR0101MB1981;H:YTXPR0101MB1869.CANPRD01.PROD.OUTLOOK.COM;FPR:;SPF:None;LANG:en;PTR:InfoNoRecords;A:1;MX:1;
received-spf: None (protection.outlook.com: falklandtrucking.com does not
 designate permitted sender hosts)
x-microsoft-exchange-diagnostics:
 =?utf-8?B?MTtZVFhQUjAxMDFNQjE5ODE7MjM6YlMvcEtMekEyUEcrcjZrbnhZcm10anJH?=
 =?utf-8?B?ckVJamNFUG9Eand2M1o3ZkV5SWxQbFZGOVZKRzJtOFVxMlRIWFY2T3lEYmI0?=
 =?utf-8?B?WUJHekowNFQwTnFoQXB2RFQxTkdMeVd5NHBvYnY1Uk9FY0REbm5LOVdwUU9R?=
 =?utf-8?B?QkE2V05LaWZhQk5sMFZ2aGppSXh0S09HZlFhRHBITDVpZ2RmLzRqVDVHSHA0?=
 =?utf-8?B?elhnTWJNS3dwKzV0alV1WW5oTFdTcCt2M0txNVlyVXhGWmI0bS9nbzA4bXlk?=
 =?utf-8?B?dm1kMUl2WDYrRGNPSk9NT1ZTYUZacTZ6bEo1aVhiamNXSVozbDhuUy9CTGpl?=
 =?utf-8?B?OWV1ekczYnVOZ24wRzZaYUFveHFDTXhsb2RqVWt5dTRqUmt2WjdCRmtRamxk?=
 =?utf-8?B?cFF4amxVY2pncTZmdUg4cEZmcEpTdGsxNUdtaEgwL0s0MDBES2ZDY2N4NzJR?=
 =?utf-8?B?cUxDNDlIT3N3ZXF4eEhyZ2lYZTVKZlpXeVkvZzdZMzNDZm5EWmcrRVM1ejgx?=
 =?utf-8?B?YXdXVkZkNkFabE1tMFUxY3JsdUpwNjdHMzBTK3F4TXZPbVZUOTlPRnVQNkIx?=
 =?utf-8?B?U3F0R2hGZXVpTktPa0N6djBqSEd3TW9HWDl2YmZEcTgwZ29udStRdXZQbEc2?=
 =?utf-8?B?QU1FV3JMU2xFcEUzQlR4WE5rMzJrU2RPM0hLNGw5OTVIS1lrTnRza1loamxq?=
 =?utf-8?B?cGg3U21WMUtDbEFKeG44OEhnYVIrRnVxRHIrYmUzRFByQVFZNGYrR3UzcEEr?=
 =?utf-8?B?RnBrajBERkNhZDdkMDhtbnJDQUY5anQvazc2aGREamJVWSsvTVZJaWxLY0da?=
 =?utf-8?B?QkZLMVAwRFI0V3lGUzhpOGRuNWtjSTIzWU5kdTNySTVJV3NsRkdWZ24rbVpt?=
 =?utf-8?B?Q29aUExpckM1WklYKzlOejRsR2VoR0tzQzNPckY4dklLbHZiNUxHYzJXQzZl?=
 =?utf-8?B?Rm5OenFxUjJqZ011dUZPUDZCQnpIUmRNL25aMkkyeHc0aXlwWUZiNTFETkVX?=
 =?utf-8?B?S2d0VDQ5dGZVS2FlRDd0NUtBNC8zRmg3aHlzekhVcUdwT3FtemRpYzd1R0FM?=
 =?utf-8?B?Q0ZPVmkxOE5MbGdQZDhBUWdXbm85a0k5WHg1czdHVyt2ZkhFR3pUUjQ5TTZq?=
 =?utf-8?B?TkRwQ0JOVElaWm9wTE9NT2dubjlDK0E1YnQwWGVGdlhKbHp2Z3FMejRQQnJH?=
 =?utf-8?B?djZmSmlJTkw1UW1aajRheHhabVZkK2ovZTR2RU9kU1N1dDF0aUpXdXZGK24r?=
 =?utf-8?B?UVhvcktzNWYySEZvSUpxbjkzZEJLZVo1Tm1YOVBQbmJDYU5PSjB4RXdpd3Nr?=
 =?utf-8?B?S25XTTIyNmIyYmNTaHVtbWVwTG5INGxYTHNKT0ZsbmFOUXMzMTdqYlU5YWdv?=
 =?utf-8?B?cm9OeC8wZTd3a3hBWTgveEwxQ3prZTJ3Z1pBUmthS1d6Y25NVHZtRHZxd3FX?=
 =?utf-8?B?MFpxbHhWZDl5cXVydm1YT0F6dW4wRGlsSkR1aSszSFoxcjI0MjhaYkkwQTRq?=
 =?utf-8?B?b2RKbnoxVjg3VlhrU1p5cGVNMzdhdjh6VGMrTi95NnBENnRuVGVZNW84UE9Z?=
 =?utf-8?B?VVA2M0dxbG5zME9kM3ErQVo4TTlnNWRRdVlOakswLzJnaW1ybU5EbkZvajNy?=
 =?utf-8?B?RWR2ZmQxRlNSeG9WaWR4aThweEt4UXBXTlJ0THArcG1ERmp5M1NxWGlOOHc9?=
 =?utf-8?Q?=3D?=
x-ms-exchange-senderadcheck: 1
x-microsoft-antispam-message-info:
 UJ1Y7XLQ0D62o85C8gxsJlkPeIG4aN4Zo2kx//iSc1+xyX8Wg2Fdl/wl7IAhp3sFxm8uOGj9BQ1YXuTVH/WTMTYt6fT74HhzKGB4Xzn2ofW7d2yTW47JHeXLz4A51KBzNcRGByeovsXOcdjKST0A6WG71Y3D723cMgN81+VVfOyl/cEBNr6d1qhZsdpLsMiKCbMtE6AbNmlQ29gCKlFFEnyePP3a6onKEmlpFZovUfonom3z82PIGiXgAQTn5NDLeeRW4K2LP4QqkswLiA5ALYg6jRhscsi4oQIv8yEKRRTD4X5vUdCRkWd7q5XnCiGzS1XkMvqDXYuqe1liXU98I300neP13IUS7M3EO7NVdjnIbz9xDmfEI4xpn+8Sxsc3XzNjesZUt4pZmHbuATDNdPDJnHU/D1O8q9f2DS8hohc=
Content-Type: text/plain; charset="utf-8"
Content-Transfer-Encoding: base64
MIME-Version: 1.0
X-OriginatorOrg: falklandtrucking.com
X-MS-Exchange-CrossTenant-Network-Message-Id: 779d68ed-63c3-46cd-6591-08d69291bc31
X-MS-Exchange-CrossTenant-originalarrivaltime: 14 Feb 2019 15:33:14.3620
 (UTC)
X-MS-Exchange-CrossTenant-fromentityheader: Hosted
X-MS-Exchange-CrossTenant-id: c1af1e1a-203e-460b-85aa-719d6bb7ced9
X-MS-Exchange-CrossTenant-mailboxtype: HOSTED
X-MS-Exchange-Transport-CrossTenantHeadersStamped: YTXPR0101MB1981
X-Spam-Status: No, score=-1.9
X-Spam-Score: -18
X-Spam-Bar: -
X-Ham-Report: Spam detection software, running on the system "s029.panelboxmanager.com",
 has NOT identified this incoming email as spam.  The original
 message has been attached to this so you can view it or label
 similar future email.  If you have any questions, see
 root\@localhost for details.
 
 Content preview:  Oh right!!! Let me check. Don' give it away.
 
 Content analysis details:   (-1.9 points, 10.0 required)
 
  pts rule name              description
 ---- ---------------------- --------------------------------------------------
  0.0 URIBL_BLOCKED          ADMINISTRATOR NOTICE: The query to URIBL was blocked.
                             See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#dnsbl-block
                              for more information.
                             [URIs: falkland.onmicrosoft.com]
 -1.9 BAYES_00               BODY: Bayes spam probability is 0 to 1%
                             [score: 0.0000]
 -0.0 SPF_PASS               SPF: sender matches SPF record
 -0.0 SPF_HELO_PASS          SPF: HELO matches SPF record
 -0.1 DKIM_VALID             Message has at least one valid DKIM or DK signature
  0.1 DKIM_SIGNED            Message has a DKIM or DK signature, not necessarily valid
X-Spam-Flag: NO
Original-Authentication-Results: spf=none (sender IP is )
 smtp.mailfrom=anita@falklandtrucking.com;
X-TNEF2MIME-Plugin: MS-TNEF -> MIME

Content-Type: image/jpeg; name="image001.jpg"
Content-Disposition: inline; filename="image001.jpg"
Content-Transfer-Encoding: base64
MIME-Version: 1.0
X-Mailer: MIME-tools 5.427 (Entity 5.427)


I have other examples of this from other domains and other messages. This is just one example.


 
« Last Edit: February 20, 2019, 07:14:02 PM by brianblaze420 »

Offline Jean-Philippe Pialasse

  • *
  • 2,747
  • +11/-0
  • aka Unnilennium
    • http://smeserver.pialasse.com
Re: Messages as Symbols!
« Reply #1 on: February 20, 2019, 11:40:11 PM »
The body only contain a jpg file and your client is teying to display it as text while content type seems clearly defined.

What are you using to read your emails?