Printable (PDF) Envelope and Header Summary ecelves Time: | 19 Ap 2021 20:51:42 (GHT -04:00) Message Sie: | 25.28 (KB) Subject: | Payroll Tox Adjustment Frvelope Sender: bounce te bida 370ea5-mensome= iso IronPort Host: ‘s2.chlrensplae (68.232.437.473) ‘SMTP Auth User 1 WA F peacoat gos2436, Covie-19 Peyol Tax Aajustment. docx Sending Host Summay ‘mal. certyjob com (veiied) 1 nares e747 SBRS Sear None 19 Apr 2021 20:81:41 (GMT-04:00) 19 Apr 2021 20:51:41 (GMT-04:00) 19.Apr 2021 20:51:41 (GHT-04:00) 139 Apr 2021 20:51:42 (@MT-04:00) 19 Apr 2024 20:51:42 (GMT-04:00) 19 Ape 2021 20:51 19 Apr 2021 20:51 19 Apr 2021 20:51 42 (GMT -04:00) 42 (GMT -04:00) 142 (GMT -04:00) 19 apr 2021 20:51 19 ape 2021 20:51 42 (6MT -04:00) 42 (GMT -04:00) 19 Apr 2021 20:51:42 (GMT-04:00) 19 Apr 2021 20:51 19 Apr 2021 20:51 19 Ape 2021 20:51 42 (GMT 08:00) 42 (@MT-04:00) 42 (GMT -04:00) 19 Ape 2021 20:51:42 (GMT-06:00) 19 Apr 2021 20:51:42 (GMT-04:00) 4£9.Apr 2021 20:51:42 (GHT-04:00) 19 Apr 2021 20:51:42 (GMT-04:00) 19 Apr 2021 20:51:42 (GMT -04:00), 419 Apr 2021 20:51:42 (GMT -04:00) 19 Apr 2021 20:51:42 (GMT -04:00) 19 Ape 2021 20:51:42 (GMT-06:00) 19 Apr 2021 26:51:42 (OMT -04:00) 19 Apr 2023 20:51:42 (GMP-06:00) 19 Apr 2021 20:51:42 (GMT -04:00) Incoming connection (ICID 118468006) has sender_group: SBRS_NONE, sender_p: 69.72.4731 a POLI "Domain_Whili” HT ENTS: mewaomeehlrensplee cm fd sor: None Protocol SMTP interface Data 1 (IP 68.232.137.173) on incoming connection (ICID 118486005) from sender 65 7287-31, Revorse ONS hort mauceryoo.cem verfieg Vos (Gct9 118468006) ACCEPT sender group SBRS_NONE match sbrafnane] SARS None sender IP 69.72.47 31 county Une States Incoming connection (IID 118458006) successfully accepted TLS protocol TSvi.2 cipher SMTP celveryconnaction (DCID 42465174) opened from Cisco IronPorntrace 68.232.137.173 fo scdrose 190-4044 169 on por 25 Message 124264616 Sender Domain: ooplsecurty nat ‘Star message 134264616 on incoming connection (HID 218468006). Message 134764616 enqueued on incoming connection (ICID 119468006) from bounce tclbida 370c¢3 mansomencharensplacecomebgooglesecurty nat Message 134264616 rection: Incoming Message 124264616 on incoming connection (C10 11 (mensomeschuarensplacs.com). Message 194264616 contains message 1D header "Spoaioetanoset 1. 1 eosenEAssooBbS7sagooglesecurty. nets 158006) aad recipient, Message 134264616 original subject on injection: Payroll Tax Adjustment Message 134264616 hos reply header no-eplyBsoogleccatty.net Message 134264516 containing domain name ‘gogllesecurty.ne! matched the domain excestion Ist 05% Bypass Message 134264616 (25650 byes) fom bounceschidrenspace com googlesscuy net ead Mossage 124264616 has sonder_group: SBRS_NONE, Sender_Ip:69.72.47.31 and sbrs: None Message 124264616 contain attachment mgQS2839 Message 124264616 contains sttacrmentCovid-9 Payroll Ta Aajustment doce Message 194264616 matched per-ecpent poy Oomain_ Whites for inbound mal plies. Message 124264616 scanned by ANt-Vitus engine Sophos, Interim vara: CLEAN Message 134264616 scanned by Ant-Virus engine Final verdict: Negative Fe reputlin query inittng. File Name = mg052839, MIO = 134264616, File Sie = bytes, Fe ype"= image/ineg Fle reputation query intting, file Name = Covie19 Payal Tax Adurement.coce, MID = ‘a42eceis, Pe Size = 10401 bytes Fle Type = apleavon/vna-operamlormats: oMcedocuriant wordprocesingm. document Response receive for fle reputation query from Clue. Fle Name = 02839, MiD 1342ec616, bispostion = FLEUNKNOWN, Malwate = None, Analysis Seore~ 0 e256 dstsa0s88 s22000 Inarralld@22859669!) ‘Queved mal fer deivery Incoming eeonedtion (EID 118468006 edt receive mal be of messges eed per