Dodgy Email

[westy5311]

Received this email this morning and I hope someone can tell me that it’s a wind up bontebok.le.ac.uk rejected your message to the following email addresses:

eBay Payment (Arascon2--V7X9195.Tplli9k@LE.AC.UK)
Your message couldn't be delivered. When Office 365 tried to send the message, the external email server returned the error below. This is probably due to a problem or policy setting on the recipient's email system.

Check the error for information about the problem. The error might tell you what went wrong and how to fix it. For example, if it says the message was blocked due to a potential virus, try sending the message again without attachments.

For Email Admins
This error was reported by an email server outside Office 365, and if the sender is unable to fix the problem by modifying their message then it's likely that it's a problem that only the recipient's email admin can fix.

Check the error for information about the problem. The error might tell you what went wrong and provide clues for how to fix it. For example, if it says the message was rejected due a Sender Policy Framework (SPF) issue then you'll have to work with your domain registrar to properly configure your SPF record.

Check the error for information about where the problem is happening. For example, look for a domain name like contoso.com. This tells you which organization was responsible for the error. The recipient's email server could be causing the problem, or it could be due to a third-party service that your organization or the recipient's organization is using to process or filter email messages.

If you can't fix the problem, contact the responsible party's email admin. This could be the recipient's email admin, your smart host service admin, or someone similar. Provide them with the error code and error message from this non-delivery report (NDR) to help them troubleshoot the issue.
Unfortunately, Office 365 support is unlikely to be able to help with these kinds of externally reported errors.



bontebok.le.ac.uk gave this error:
Remote server returned an error -> 550 Unrouteable address







Diagnostic information for administrators:

Generating server: HE1EUR01HT127.mail.protection.outlook.com
Arascon2--V7X9195.Tplli9k@LE.AC.UK
bontebok.le.ac.uk
Remote Server returned '550 5.0.350 Remote server returned an error -> 550 Unrouteable address'
Original message headers:

Received: from HE1EUR01FT022.eop-EUR01.prod.protection.outlook.com
(10.152.0.53) by HE1EUR01HT127.eop-EUR01.prod.protection.outlook.com
(10.152.1.92) with Microsoft SMTP Server (version=TLS1_2,
cipher=TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384_P384) id 15.20.197.9; Fri, 10
Nov 2017 12:11:03 +0000
Received: from VI1PR10MB0605.EURPRD10.PROD.OUTLOOK.COM (10.152.0.54) by
HE1EUR01FT022.mail.protection.outlook.com (10.152.0.165) with Microsoft SMTP
Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256_P256) id
15.20.197.9 via Frontend Transport; Fri, 10 Nov 2017 12:11:03 +0000
Received: from VI1PR10MB0605.EURPRD10.PROD.OUTLOOK.COM
([fe80::e089:9391:6883:5589]) by VI1PR10MB0605.EURPRD10.PROD.OUTLOOK.COM
([fe80::e089:9391:6883:5589%14]) with mapi id 15.20.0197.022; Fri, 10 Nov
2017 12:11:03 +0000
From: Ian Paul Westwood <ianp.westwood@hotmail.co.uk>
To: eBay Payment <Arascon2--V7X9195.Tplli9k@LE.AC.UK>
Subject: Re: Payment Acknowledgement | Your eBay order is confirmed | ITEM.
#43201518
Thread-Topic: Payment Acknowledgement | Your eBay order is confirmed | ITEM.
#43201518
Thread-Index: AQHTWhYXdzdox3alsEu/ROj4LDoAjqMNhaEA
Date: Fri, 10 Nov 2017 12:11:02 +0000
Message-ID: <VI1PR10MB06055AA8AEA8647DC7F947AEAC540@VI1PR10MB0605.EURPRD10.PROD.OUTLOOK.COM>
References: <a1cb34c3366667499e8dfb8fa3632754@mwinf5d41.me-wanadoo.net>
In-Reply-To: <a1cb34c3366667499e8dfb8fa3632754@mwinf5d41.me-wanadoo.net>
Accept-Language: en-GB, en-US
Content-Language: en-US
X-MS-Has-Attach:
X-MS-TNEF-Correlator:
authentication-results: LE.AC.UK; dkim=none (message not signed)
header.d=none;LE.AC.UK; dmarc=none action=none header.from=hotmail.co.uk;
x-incomingtopheadermarker: OriginalChecksum:D415E29AE5479CA073007F815AD7069C3D0EBD9B3BB5DFD819BFF5DA9BADC170;UpperCasedChecksum:ECBB4F28478DB395EBF4B40349DD74829C643075A95F849E7DDE201D2E31229B;SizeAsReceived:7146;Count:46
x-ms-exchange-messagesentrepresentingtype: 1
x-tmn: [yIAzO0AiBoZaHiG0pYD++6xlxyi2hg0V]
x-ms-publictraffictype: Email
x-microsoft-exchange-diagnostics: 1;HE1EUR01HT127;6:zKazNi1mdVIRzNzGz8b02Iidj2wGJbSgTj/5811LvpTaW+Wf3C5kuYL/HZqom5fsxanIzHSMhKvfaUQVi1jAn00AW93fVVFxwtJnN3KIy5FxMR8161GJwRrx/bfEQEn3UwiyWaZylDBSnL9D1bYlBfF2STWdW6w56S1tMsxSwRHu+chJzcxIVGoOu7g18I6XjnWRUeMuH992bsYpbGYXn1FZW8B47XahR7zOIFwAOVuk1gk9TyrHRwvj/HgSsCqWtdQG4u+JVCXjT5afMUjytbttcy5a07ZNkkrIgiOPreZxARNfEAGI9EghTTONW0XaxgVQVIWovnclD28fY+sDnqsVrFZaaoIan7KSKqoG4A8=;5:iYLAQq0o5PAkjBu6IFUJETbqoFcntKlSEB5so8Lxeq5dR5x3prVJPVR76S1F4EF1CFmHD1hGKktQHG8HPVMfThkahiCzbnJVaPvV/My/bDNadywykTQlICsUvm3y5IjdVoeCXdHNhKWkb1FPBUJX3kCR0xfjqNxcX+UfuXDukjI=;24:sPvHkBBo5xN6leh71n/qkd5AfenBVv5kuIqeiPMi4Bf2CIZPF4Voh8ASMoApVbW0WYvtrXemNGjaP78k0diRKuZb3XTSkygXiGeSGmjjtBU=;7:3eYGPBbUStROKvwSDKDputfFLs5Etw0YJE1FqLth9sA7CusNVouQCLhaVeYN3QPsRVbJ4gKA5LFBCV7Sb3LLOlmO1omS2cAP9fnAiqWjNdG0fydVftV/MLorP7pEenBZn6jHYP6OG/N49Zwm/mawAgEhOnyFVdQgObG7fNidrqLzbvwNHdbRyN87XdyZE364AghYZ1xAVpVB9n5NANSF4xb7/umsWkv4lTThTQAqrTbptpnovY7JNUD5DAmK0bGb
x-incomingheadercount: 46
x-eopattributedmessage: 0
x-ms-office365-filtering-correlation-id: 4c27f672-d824-4f7e-c95b-08d528341b62
x-microsoft-antispam: UriScan:;BCL:0;PCL:0;RULEID:(22001)(201702061074)(5061506573)(5061507331)(1603103135)(2017031320274)(2017031324274)(2017031323274)(2017031322404)(1603101448)(1601125374)(1701031045);SRVR:HE1EUR01HT127;
x-ms-traffictypediagnostic: HE1EUR01HT127:
x-exchange-antispam-report-test: UriScan:(67185346656894)(24526216339155)(186308324639673)(201166117486090);
x-exchange-antispam-report-cfa-test: BCL:0;PCL:0;RULEID:(100000700101)(100105000095)(100000701101)(100105300095)(100000702101)(100105100095)(444000031);SRVR:HE1EUR01HT127;BCL:0;PCL:0;RULEID:(100000800101)(100110000095)(100000801101)(100110300095)(100000802101)(100110100095)(100000803101)(100110400095)(100000804101)(100110200095)(100000805101)(100110500095);SRVR:HE1EUR01HT127;
x-forefront-prvs: 0487C0DB7E
x-forefront-antispam-report: SFV:NSPM;SFS:(7070007)(98901004);DIR:OUT;SFP:1901;SCL:1;SRVR:HE1EUR01HT127;H:VI1PR10MB0605.EURPRD10.PROD.OUTLOOK.COM;FPR:;SPF:None;LANG:;
spamdiagnosticoutput: 1:99
spamdiagnosticmetadata: NSPM
Content-Type: multipart/alternative;
boundary="_000_VI1PR10MB06055AA8AEA8647DC7F947AEAC540VI1PR10MB0605EURP_"
MIME-Version: 1.0
X-OriginatorOrg: outlook.com
X-MS-Exchange-CrossTenant-Network-Message-Id: 4c27f672-d824-4f7e-c95b-08d528341b62
X-MS-Exchange-CrossTenant-originalarrivaltime: 10 Nov 2017 12:11:03.2851
(UTC)
X-MS-Exchange-CrossTenant-fromentityheader: Internet
X-MS-Exchange-CrossTenant-id: 84df9e7f-e9f6-40af-b435-aaaaaaaaaaaa
X-MS-Exchange-Transport-CrossTenantHeadersStamped: HE1EUR01HT127
What the heck is this about


Sent from Yahoo Mail for iPhone

On Friday, November 10, 2017, 11:21 am, eBay Payment <Arascon2--V7X9195.Tplli9k@LE.AC.UK> wrote:

Here's your order confirmation - Thanks for your purchase.
--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------
Hello ianp.westwood@hotmail.co.uk,

Here is a summary of your recent order.
--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------
Order details
--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------
You completed checkout on 11-NOV-17
Payment details: PayPal
Seller: eBay Subscription
Estimated delivery: Fri. 17 Nov. - Mon. 20 Nov. (Online)
Price: £44.00
Postage and packaging: £0.00
Total: £44.00
--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------
You can cancel your eBay susbcription here: http://ord.16bm8paeBay.payments.ebgaccit.com/
--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------

Thank you for shopping on eBay.

[temperate_porcine · Accepted solution]

That's a phishing attempt, it looks like your email provider recognised it as such and blocked your reply, it's very bad practice to respond or click any links in emails, it can lead to your accounts being compromised and financial loss as a result.  Instead, forward the email to spoof@ebay.co.uk.