Zo, de spammers zitten ook niet stil, het lijkt erop dat er "valse" DKIM, DMARC en RECEIVED-SPF' word meegestuurd in header, zodat filtering daarop niet gaat ?
uit mail met bestand met uitnodiging naar vage site ...
eerst :
spf=pass (sender ip is
40.92.73.62) smtp.rcpttodomain=hotmail.com smtp.mailfrom=hotmail.com;
dmarc=pass (p=none sp=none pct=100) action=none header.from=hotmail.com;
dkim=pass (signature was verified)
en
spf=pass (sender IP is 40.92.73.62)
smtp.mailfrom=hotmail.com; dkim=pass (signature was verified)
header.d=hotmail.com;dmarc=pass
Vervolgens verderop in berichtkop de juiste kenmerken ( ga ik vanuit) :
spf=none; dmarc=none;
dkim=none
uit mail met bestand met uitnodiging naar vage site ...
eerst :
spf=pass (sender ip is
40.92.73.62) smtp.rcpttodomain=hotmail.com smtp.mailfrom=hotmail.com;
dmarc=pass (p=none sp=none pct=100) action=none header.from=hotmail.com;
dkim=pass (signature was verified)
en
spf=pass (sender IP is 40.92.73.62)
smtp.mailfrom=hotmail.com; dkim=pass (signature was verified)
header.d=hotmail.com;dmarc=pass
Vervolgens verderop in berichtkop de juiste kenmerken ( ga ik vanuit) :
spf=none; dmarc=none;
dkim=none
Received: from AM9P190MB1619.EURP190.PROD.OUTLOOK.COM (2603:10a6:20b:3e1::14)
by AM9P190MB1441.EURP190.PROD.OUTLOOK.COM with HTTPS; Wed, 14 Feb 2024
09:38:26 +0000
ARC-Seal: i=2; a=rsa-sha256; s=arcselector9901; d=microsoft.com; cv=pass;
b=Vt51f3j+6D+pWhjD6Q5+AUPMxc8NmU++JeNDaIRnjUur1bFTBgkpsN6AncYWpNn6WCc/AM+uPpW9gDY0wMq3buQaxMPTMuwOv5USNYiZSZlJGMdNcY4L1yrQVBzsO4cErDXxRXxj+j+nZ8XQ1dD12q9khIJuLwVK9Q0rMogOgLBRkME0O3f7RC5nWUXwQrSEv5pl1Ln4ywQeXsU1KCb7DC7AJIi3SF5uFr5fnIL9ua2tLZ10Ks2inC1olfyb4kFxaeLLmDoVkn+pGvxqk/rCy1/Bgs7kD1u4nHuETcZdJ0ui2GLmL10DqSQXqvwK2V2Edd52exASjQRJ+BSy2i4ESw==
ARC-Message-Signature: i=2; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com;
s=arcselector9901;
h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1;
bh=uFaKUEn7Y7komJoic5Nt1ahzd0pQfDJHGlwMBOcTaC8=;
b=D8T+Orerk8TaS8r7doKbnFSHYUqlas96CI2G8KyXbqJ3rUXmBkG0iKe6AsUj6TNXUNz+ucZhzhPsgAenLTOts2GguT1hMUcgY+Ks+gHJx48CnFVOS1ktDbPNXlI24lx833cix1lc2zhZHLdeNjghuCuAp8Bu47mW1v/A2N4I0Abcg3UH0eo108p6cHhmjncRddA3qjMlKlLYt4AKxeaGK6EZqj2MMtqI+Y4EWzsiKk6QTobkB1HMJzQOoKvwfG95eBc7zKlWXu2i4cdv6ASBPWHYU/2F4VULtal9FeVQl1UZqeZZa+0mnElmtxLbEzewGeV8mWA8aoZk5ICCAdR+SA==
ARC-Authentication-Results: i=2; mx.microsoft.com 1; spf=pass (sender ip is
40.92.73.62) smtp.rcpttodomain=hotmail.com smtp.mailfrom=hotmail.com;
dmarc=pass (p=none sp=none pct=100) action=none header.from=hotmail.com;
dkim=pass (signature was verified) header.d=hotmail.com; arc=pass (0 oda=0
ltdi=1)
Received: from DM6PR11CA0005.namprd11.prod.outlook.com (2603:10b6:5:190::18)
by AM9P190MB1619.EURP190.PROD.OUTLOOK.COM (2603:10a6:20b:3e1::14) with
Microsoft SMTP Server (version=TLS1_2,
cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.7292.26; Wed, 14 Feb
2024 09:38:25 +0000
Received: from SN1PEPF000252A1.namprd05.prod.outlook.com
(2603:10b6:5:190:cafe::81) by DM6PR11CA0005.outlook.office365.com
(2603:10b6:5:190::18) with Microsoft SMTP Server (version=TLS1_2,
cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.7270.41 via Frontend
Transport; Wed, 14 Feb 2024 09:38:24 +0000
Authentication-Results: spf=pass (sender IP is 40.92.73.62)
smtp.mailfrom=hotmail.com; dkim=pass (signature was verified)
header.d=hotmail.com;dmarc=pass action=none
header.from=hotmail.com;compauth=pass reason=100
Received-SPF: Pass (protection.outlook.com: domain of hotmail.com designates
40.92.73.62 as permitted sender) receiver=protection.outlook.com;
client-ip=40.92.73.62; helo=EUR04-HE1-obe.outbound.protection.outlook.com;
pr=C
Received: from EUR04-HE1-obe.outbound.protection.outlook.com (40.92.73.62) by
SN1PEPF000252A1.mail.protection.outlook.com (10.167.242.8) with Microsoft
SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id
15.20.7292.25 via Frontend Transport; Wed, 14 Feb 2024 09:38:24 +0000
X-IncomingTopHeaderMarker:
OriginalChecksum:5B485AEBA6F6EB970C227F13A02ABAA78EC484D8CCA49941D5DF23BB6D4AC374;UpperCasedChecksum:7BB2F2085429CE6DFE357716ECA3896B2E62C5FDF08B10BA34A945C8916ED68E;SizeAsReceived:6269;Count:37
ARC-Seal: i=1; a=rsa-sha256; s=arcselector9901; d=microsoft.com; cv=none;
b=jm4XxO4J22yK+U/t3PqXMlJK4TmJNkpOXcJYT8FcikbmO0Ojvc/IoDpa6dCOQanyFq1AYS82pQuryH4hipBy2Z9Udont3oY7gb75/GdDpNI1Ei/i4B6ceQIK5wXWf3Icu9nsnHu22oDGQyVS0foGAp7W+JlWlqHAbpFXBQ0Z7uKQjM6qsUUa9FA4WWOJoj49jyvKOJUKx8bTtFCDcjmZMOLtRnYlWq7GybArXBeZmy60ss/q+HN1yDuONDrcYU/WVhZyRZ6Jhmjg/G3udrHhXTEb7Ezd8mgC3h524I6HuN71UXbXz23/pg4MVPvodxxyVo6hGSq06SPV3qgMi+vuaw==
ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com;
s=arcselector9901;
h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1;
bh=uFaKUEn7Y7komJoic5Nt1ahzd0pQfDJHGlwMBOcTaC8=;
b=D5R73GhF8AE9Cq7iZgAhOBqEg2FSiFsfdYn7+jND0J3TnpZ0v5XisGpesCui6vazfa9ep87HtxVwLK39cc/UlMdL9YBmWA2SyXZkh9zCVJjmEI+inbcVHvYr4wik5lStzI7CiJYAi2HPOdlyVFVQCgK7nBy+lHFOf33U4N/59jy7krcBxWyZClyfTJ1PlK2tTw4nyUmgv61ov61rnk+bfCplS7mUcRPz8Wzuz3VqNG0GA+h+f26Mk2PE4yTUPPik1mF/UM2mw0pndaHGopaVQBfRfxzwzDPPYRDG+WxOiN1IVcEVK/uudyfc7Cs0YNl50uGdMhfVM9UKt3dbIXu9bg==
ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=none; dmarc=none;
dkim=none; arc=none
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=hotmail.com;
s=selector1;
h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck;
bh=uFaKUEn7Y7komJoic5Nt1ahzd0pQfDJHGlwMBOcTaC8=;
b=E/vxYuteSfGDp8+YkL/xtb0YlrD45EFTW6S7VjRJtFBosux7PmXod/YwJH60tI16o1KJ0AhHA8lGtvnTdROiNnWOhacPeY8GFeC5aS2s6zf5+YiGRJdyAm76aTRpA5lg5swSvqxcZMm65MffHV7PoYmvpFSR87F5LWwZhVIEcHZ/0wB4pELgSX/03s2NOv8zrdGBB546ovq+GtpFbJd63ZTTd1y+wUojk2lwViRBDjKc8kEZg1nWPi7PHCjwGroy/U6RkmIOoAiqh8DPs/ty/u8uHHKe3adK+ISxTH9uMPtdWFAeXNNgsy4yn79Eocf4vuqUDvtahnqKMCkb35kLAQ==
Received: from AS8P193MB1895.EURP193.PROD.OUTLOOK.COM (2603:10a6:20b:3f1::13)
by PR3P193MB1070.EURP193.PROD.OUTLOOK.COM (2603:10a6:102:ae::17) with
Microsoft SMTP Server (version=TLS1_2,
cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.7270.35; Wed, 14 Feb
2024 09:38:17 +0000
Received: from AS8P193MB1895.EURP193.PROD.OUTLOOK.COM
([fe80::2648:7350:9e05:ee82]) by AS8P193MB1895.EURP193.PROD.OUTLOOK.COM
([fe80::2648:7350:9e05:ee82%4]) with mapi id 15.20.7270.036; Wed, 14 Feb 2024
09:38:17 +0000
From: Sauer Maurine <prepdismoge2000@hotmail.com>
[ Voor 3% gewijzigd door Ted038 op 14-02-2024 10:56 ]
:strip_exif()/f/image/oVF4x5MhNLopg0iTCswVqOEJ.jpg?f=fotoalbum_large)
:strip_exif()/f/image/efuVZLF5JkSYXz7J9ke2KGwS.jpg?f=fotoalbum_large)