4

I usually delete SPAM, but this email caught my attention:

enter image description here As you can see, in "To:" field there is spammer account, but I thought: it's not important, in message header there must be some hidden "for" parameter which links to my email account... But there wasn't! I litterally checked all the message source and there is not any reference to my account, which is like gi********@hotmail.it So, can you explain how can be possible that this email is arrived to my inbox folder? Here you are all the source:

Received: from VI1PR03CA0029.eurprd03.prod.outlook.com (10.166.38.167) by
 DB5PR03MB1382.eurprd03.prod.outlook.com (10.164.37.144) with Microsoft SMTP
 Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384_P384) id
 15.1.659.11 via Mailbox Transport; Mon, 17 Oct 2016 19:42:17 +0000
Received: from inbound.mail.protection.outlook.com (213.199.154.183) by
 VI1PR03CA0029.outlook.office365.com (10.166.38.167) with Microsoft SMTP
 Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384_P384) id
 15.1.669.16 via Frontend Transport; Mon, 17 Oct 2016 19:42:17 +0000
Received: from DB5EUR01FT054.eop-EUR01.prod.protection.outlook.com
 (10.152.4.60) by DB5EUR01HT081.eop-EUR01.prod.protection.outlook.com
 (10.152.5.203) with Microsoft SMTP Server (version=TLS1_2,
 cipher=TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384_P384) id 15.1.669.7; Mon, 17 Oct
 2016 19:42:16 +0000
Received: from SNT004-MC4F15.hotmail.com (10.152.4.55) by
 DB5EUR01FT054.mail.protection.outlook.com (10.152.5.133) with Microsoft SMTP
 Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384_P384) id
 15.1.669.7 via Frontend Transport; Mon, 17 Oct 2016 19:42:15 +0000
Received: from NAM03-DM3-obe.outbound.protection.outlook.com ([104.47.41.98]) by SNT004-MC4F15.hotmail.com over TLS secured channel with Microsoft SMTPSVC(7.5.7601.23143);
     Mon, 17 Oct 2016 12:42:14 -0700
Authentication-Results: spf=none (sender IP is )
 smtp.mailfrom=Group@itunes-servers.com; 
Received: from smartermail (208.38.173.55) by
 MWHPR12MB1774.namprd12.prod.outlook.com (10.175.55.21) with Microsoft SMTP
 Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384_P384) id
 15.1.669.16; Mon, 17 Oct 2016 19:42:10 +0000
From: AppIe <Group@itunes-servers.com>
To: <Group@itunes-servers.com>
Reply-To: AppIe <Group@itunes-servers.com>
Date: Mon, 17 Oct 2016 15:41:42 -0400
Subject: Your billing statement is ready to be viewed.
Content-Type: multipart/alternative;
    boundary="--boundary_120_6c9d9615-eeaa-4f7e-8afd-a7bd50df7639"
X-Originating-IP: [208.38.173.55]
X-ClientProxiedBy: CY1PR14CA0066.namprd14.prod.outlook.com (10.164.65.162) To
 MWHPR12MB1774.namprd12.prod.outlook.com (10.175.55.21)
Return-Path: Group@itunes-servers.com
Message-ID: <MWHPR12MB17743EB17485B6365A45A33F81D00@MWHPR12MB1774.namprd12.prod.outlook.com>
X-MS-Office365-Filtering-Correlation-Id: 38ae925b-ddec-4687-9d3b-08d3f6c5b33b
X-Microsoft-Exchange-Diagnostics-untrusted: 1;MWHPR12MB1774;2:XpmL46FN06mC+TFf9Sua2hSeDabwW6kH2WdV5SUhO8XQH7E+ePCa9ZWRTO2UOhBs0GvrQzvVdM5lHf5O+O1mXKLcdShNbqhehQSE+uWaTLbgttEtYWAsWUicy9GAoFEwQu2kHUQORW7Bnr4PCZaC7Z2X2zElx+LM+enc6ovml5v6RH8mow8JZuQH1uYVfh0t2yu5YhKew7+5C5+1adPhvg==;3:4AFMwTPd1ZSsSUSSF23aGIQ6ltRwjy84i2EDyzAKLLd81CP/+UoIpRNlA0wjvWlmuiM16hHS/12li+Rghb9/wVdQVIHk35lrY/e1bUVkmGtxSpoRj0JxJWMBoxBIsvExw+qJuqu8HYxWgyytVlGIRw==;25:vJVmEC+w2DPrOiOKg/4hcch82FarH03THsH3wcJJb42Zk1axeuabVHcELbEvcl9dQmz5L4jwbxPq6clq8w17PX4kZ22qQQ8srTeJ9NSdTsQE2SrL5jU4yFSp3hz8C1RC8eMw7qWQsXS+kVtq8dVNMs0DaLp9ZzqMGFL50cp3scw3r0ycpfCdgk8wz2vZzHulfKJ+KkZZOmschBe4vHzizV0oSiyi/0yzg24222ZDx6uUJRfqk1Ws9MyN/GHjUeVLE+LDZlPX89LbFRWWLGY3sF5qXfiHn47/Vnq5BdL7kTBMCIjYMJWjBJ3BklgsgbKDJqEaQYI9h1vLiqh1ncn/x782SoMTwlK9FfwA+nhXqn6+2xltN3MdgBGpwfeojefiSmLLJiT3GblzOq9VlQwqzArQHL0xexe2TYDkow2LB2zhh2da6Ly3nZFh+K8cr7Yj
X-Microsoft-Antispam-Untrusted: UriScan:;BCL:0;PCL:0;RULEID:;SRVR:MWHPR12MB1774;
X-Microsoft-Exchange-Diagnostics-untrusted: 1;MWHPR12MB1774;31:iQDmvWMvDAUxE+Hzn+zOkwUc2VUKggBHmC2F8jbCB0wR+q4wICwoZ+CFlRZNsNbe5M+bre2N/UIHKynUbDuvpgjbAmDFCGUDH0+fffACiiUVHreRIL//vTT5rQQlL0m99d7coNshzrK4+BKtUXD9RQ7NK71txY80bC/C+d/WQh1VkgQeqNPDou7ctrCWNxCUG1KOGvvCOA0DApbd2WnNGSBVHTx/XeH07Uv7K1m9Wb3VR9DIcLQugXnI8awVUl33;4:jzd3JqBERFmrSOSshXLCv0O/6f/fVUiG79ph23Z/xz/UCB6d/CEgkn9qyXhADrcCkfD4HajILucYf9hpFEy0xY15my/h9tqawCeY+ArJnOwIqW4pRhepxfqX68KPfSDrOMFVvDV8LqDlDlpmgtbZDB9pd5/r/mpJPO4gPa9zRt5lciETz0gKsPTTbQ1akrC3WtsMbQ5aOaIVDOUZV+YPFxzhQ/lvsn1N/VjK+188S7aCwH/GGj3gQEDleOnRhXyyjndc+sGutzv3YGOSxnUwb6F+ess5I+rlsHsVBZk1h/JgqrqV8NyjmnVGJj8Ldj9beoAewTOxK30bGbjiTzsqb4AXhKeG4uIHj8YmYvMWZfgLQu/HqI8VbNwBR+rwNZIzGcM948SwGv0shX2xBLK6boOmx9eNIAAtBpBCdExgxwGiT0Mraeogvm+X8ST6uyGy
X-Microsoft-Antispam-PRVS: <MWHPR12MB17747F766AACDCB380EA08BC81D00@MWHPR12MB1774.namprd12.prod.outlook.com>
X-Exchange-Antispam-Report-Test: UriScan:;
X-Exchange-Antispam-Report-CFA-Test: BCL:0;PCL:0;RULEID:(6040176)(601004)(2401047)(8121501046)(5005006)(3002001)(10201501046)(6043046)(6042046);SRVR:MWHPR12MB1774;BCL:0;PCL:0;RULEID:;SRVR:MWHPR12MB1774;BCL:0;PCL:0;RULEID:(82015046);SRVR:DB5EUR01HT081;BCL:0;PCL:0;RULEID:;SRVR:DB5EUR01HT081;
X-Forefront-PRVS: 0098BA6C6C
X-Forefront-Antispam-Report-Untrusted: SFV:NSPM;SFS:(10019020)(4630300001)(7916002)(189002)(199003)(5660300001)(586003)(77096005)(15975445007)(50986999)(66066001)(6862003)(110136003)(19617315012)(101416001)(33656002)(54356999)(53806999)(551124005)(512874002)(76576001)(106356001)(105586002)(2351001)(7066003)(229853001)(42186005)(7416002)(10126002)(8676002)(81166006)(6200100001)(6666003)(551544002)(81156014)(74316002)(7736002)(7846002)(7906003)(3846002)(43066003)(19580395003)(107886002)(97736004)(2906002)(404494003)(80792005)(84326002)(6116002)(573324001)(3450700001)(86362001)(189998001)(15188155005)(9686002)(68736007)(16799955002);DIR:OUT;SFP:1102;SCL:1;SRVR:MWHPR12MB1774;H:smartermail;FPR:;SPF:None;PTR:InfoNoRecords;MX:1;A:0;LANG:en;
Received-SPF: None (protection.outlook.com: itunes-servers.com does not
 designate permitted sender hosts)
X-Microsoft-Exchange-Diagnostics-untrusted: =?us-ascii?Q?1;MWHPR12MB1774;23:CmSlgduSOzTgwLH3d/cPvzTGMnS4bq0Wc9xwBXZAK?=
 =?us-ascii?Q?NsuNom7yT2S1yqCtiXM8WcmzLvmjNA0tmul9BpNzwbLG8/+NrThl1TKYiPqm?=
 =?us-ascii?Q?TadKu1w4Tjn/HBIkXVbAQO68CsE8AyknEZ/13rB6xjzoezMzsIRZZ6vp/GvQ?=
 =?us-ascii?Q?lGCOVN5BR2U2F8tY4T1VnARBQIHWjZo7VrujRhw5703vv56AjYh7Fr6lKaZU?=
 =?us-ascii?Q?UkzutLQdJUzE10yKiVNEwCz1tJdFVRnI6n1s7JhZIEAr6ZgO1/VMQcuz5Dyb?=
 =?us-ascii?Q?RHPjk+LP9s1imFdyAlW2qgp2ZZM9x2K76G7g2rTD25OOsUNi7A61Rw3c7hB7?=
 =?us-ascii?Q?K8Z7ujBst81MgQYSCrfiwMLnfoSoBrRaZ+L88cAdeEjziFaE8eiPTS560n+f?=
 =?us-ascii?Q?2PKzpkJEXsXsKia/o49rNztwEzDBheF7Qzg4XlZ1K6xKPVbTRwMO5GZrKYYz?=
 =?us-ascii?Q?cyN14WmwZSs4SgonE7PLj0ub/cF5gp4hRMwW0wgrG5PMwJ1kc9O7mE/OqvKm?=
 =?us-ascii?Q?Ns6lO9eLMaSKRB4UIj0pih1WdMkiznFPnJ7aXdThrhwVPRhHIcMYoy6mlCft?=
 =?us-ascii?Q?e20eET25umrTTmKK6mpPkMfZMH7OuNeMwHxipoNfJdgQXweXqlwO7My8YgOJ?=
 =?us-ascii?Q?tLYAaTwp0a3ZN9ZZ4NO1B4L4uHRUk0JdzYvygKZP/RaVRBoKOby58f3+YnLn?=
 =?us-ascii?Q?G3t2a78GB1SqLIfB3qmDm0dZr2ZavPtAevBC1ekuSYanO1G6vwWw2dhi0l0r?=
 =?us-ascii?Q?YFR7xjwKbyepLeFrqvwV3fdS9uYQN2yblhvQDh4sq68lhegbBdv8NHuvlQKh?=
 =?us-ascii?Q?P2RXuWYsx+i1CIKKpSz3rv6l+Wv9Dh/Tpk8+2BwE8y2njGxRmeaocvRfxsJs?=
 =?us-ascii?Q?PHoawseTfksP1La20t0dCTRlMCaj8B6TLVul5ljCW622lzRRAStTJ+YNBzeW?=
 =?us-ascii?Q?DEl+lsfMxIyeO5m5D2xvgrFoFXBH0pm7DM0zZGOw5sKJV9dchCQWAGdCW48k?=
 =?us-ascii?Q?CMX06q+wskroFDRc4DMr8Wl82W1ju/zeXVJbti9jkw4xsGUWpTSCHxr61K7q?=
 =?us-ascii?Q?0YWuGnWWvbfg27jOOLIQX2e+a4iSovtbpTCwNXfUZCIHnEdjC3LMWYMT3JRy?=
 =?us-ascii?Q?0Lae95MXOgObPLN5t/A6ZpEgKd2bqUM/21Gtbq8+4Pu8Bs9JJOM0382Tzj8/?=
 =?us-ascii?Q?3eAzzUMFXlT3jABFd10/New3teDW1uivR9QkUwnqqfwipkPmZ7GcfpIaHuuL?=
 =?us-ascii?Q?u9P64LHqSmkTq4iqt7UCBlYYm7NqP35hxzhkHGGoV9zPTLr0/MaAxxpFumNr?=
 =?us-ascii?Q?UyZMY31s9b4gdAV2Vv00ihCWsFdNuHBIsiRtXMtFXVLLMO1jbSfqdNZCVmeO?=
 =?us-ascii?Q?AjjPrRYxT/qXhnd7UIf/p1IFI4=3D?=
X-Microsoft-Exchange-Diagnostics-untrusted: 1;MWHPR12MB1774;6:qjsaDhdJJwe1y3KfgNQskLPV8EyqAe7FdtbyaGOug5dlM8t9jgDzSg9O0AtRIf/OvCBxdJX9E+qlkOVyjDJ2yf/6FwH2VM7fY4Pub5qyftw+ZmwvWwPP4pJCJAHmGIdRtInazBqWGQkhSAKBDq486QDrkQK8cOv4oZfkOrjDsQbwB60PG718iRWv9/ejGaaKa3mNTn5xeBmw43tTAg/lXXHjmsEpiYs97vR+b+sKoVMg3KjPYJ9LvbE//+On3Oj7y5FN66zllG5NbJLGlYLZx7quCsbP45+T+chAaB2hgkxjK4U3BQhxV9GeTKd47en10IbHfN/0xNVJdZgKKAPnTA==;5:yh5AXLh1TSR8Hsodh5lW4LBA7gSf144NkB7+UkaOAOI2L4/dq+ERQPjf4WyoM01GWj7tD4GJNcz/YeVRDe20Mnn0quJX1vznpcG/jpz6Xkq7S4fKmTdKRxCttDnpjw72XiKNyNaX9J5Jx1rzYyGkPw==;24:rBQ9P+UL+Cs4ycbMj9ApNQ4yqTndLrbpOS8HP9QAK9kOB+vOykq8OMjlp3ty4EA153JZFrPy5XjosbFSW5VwavsByxPClaVLiTmE9Rh1k2o=
SpamDiagnosticOutput: 1:99
SpamDiagnosticMetadata: NSPM
X-Microsoft-Exchange-Diagnostics-untrusted: 1;MWHPR12MB1774;7:2CfzC2nwl4vq2OUkzKeR5BCZgmdKDEnaJ0igr+/CgpkGy9EViFlXPgF/g6jdJA7liz952hNZews211xSbHQMV2MOSnUzKYq+2y50VY4M9DFFbjUGyjYV4rmN0un2hEE//7k917xn/NB1rRMQCqARAZ8UVsVgzinAvZEgngkSCj5xSEd2WkIkcod8DMdPL+8WNamNKHLzedpjbWCgInCnfuuFYig3QzlD1Gi1DqH484zsyo2m6M9ZQfgsdXqtOwbLB/dBaZzdxtb/3ii7OItD75iWJA4q3pKKkW1KGaAzUq9zXFoLDwzfaDNevUBaUBMOPqYoQx0/juuY2WXigFXv5ViqyxqXhBeUvt7LffuULS0=
X-MS-Exchange-Transport-CrossTenantHeadersStamped: MWHPR12MB1774
X-OriginalArrivalTime: 17 Oct 2016 19:42:14.0410 (UTC) FILETIME=[8F7FBEA0:01D228AE]
X-MS-Exchange-Organization-Network-Message-Id: 38ae925b-ddec-4687-9d3b-08d3f6c5b33b
X-EOPAttributedMessage: 0
X-EOPTenantAttributedMessage: 84df9e7f-e9f6-40af-b435-aaaaaaaaaaaa:0
X-MS-Exchange-Organization-MessageDirectionality: Incoming
CMM-sender-ip: 104.47.41.98
CMM-sending-ip: 104.47.41.98
CMM-Authentication-Results: hotmail.com; spf=pass (sender IP is 104.47.41.98)
 smtp.mailfrom=Group@itunes-servers.com; dkim=none
 header.d=itunes-servers.com; x-hmca=pass header.id=Group@itunes-servers.com
CMM-X-SID-PRA: Group@itunes-servers.com
CMM-X-AUTH-Result: PASS
CMM-X-SID-Result: PASS
CMM-X-Message-Status: n:n
CMM-X-Message-Delivery: Vj0xLjE7dXM9MDtsPTE7YT0xO0Q9MTtHRD0xO1NDTD0w
CMM-X-Message-Info: IaKb45KF5f4bNtpQuCRPdIe8KYM1uMxzxZajHB3xEVFiLQvqejNIANh43kgiZ0FdU9NrdcRogQ39lpBvx6lwYYfejjVE1DkSN+YHQm2JusAuj8RUCgIyGIbSUm0mwxOgDO90FMG7eiEJdKeAOIMFhDjtPyGTAPYGi5HP+D1G4rD+gZC+RuwGkeq2nfTteImszoU8vKII1K51UOagnJM7FEbIwrxeRHpHwiDCMNCBMaUFHWpa2aJBP+ZkkMkj+BNC
X-MS-Exchange-Organization-PCL: 2
X-Microsoft-Exchange-Diagnostics: 1;DB5EUR01FT054;1:gMv2LdwEweKepO7czk5kvIs1chgxlJgncNg674gLJQjFAip+Ov4M0WAtqsOtyJTycIPEz/QN/OoY/TGtPa4M2b49WMMucyb+YSB464xwfNwVH6j9hnZgPaks49/U5iK23NNZmjOH0VKcN0LFB3e6CQ3KKhz/RdnRNGl2KFxR5pg=
X-Forefront-Antispam-Report: EFV:NLI;SFV:NSPM;SFS:(98900003);DIR:INB;SFP:;SCL:1;SRVR:DB5EUR01HT081;H:SNT004-MC4F15.hotmail.com;FPR:;SPF:None;LANG:en;
X-MS-Exchange-Transport-CrossTenantHeadersStripped: DB5EUR01FT054.eop-EUR01.prod.protection.outlook.com
X-Microsoft-Exchange-Diagnostics:
    1;DB5EUR01HT081;2:Ug6m7RMreyBkvQUAT2RVxvziuxemnmB/sgMWIHU9fp9u7OdvonD9aD9m7j545yjpK/6pRGUJ1gZftog74IDMb6bINTLEEv4fvearVxwRUj1u6+yvH6HREkWeeSc0/vkcYHt3alnKFKwmHEmQcJ1wGgjMlSRpjoX3OBYKqftMm/uxEB8SlerjYAOx2UDAif32zrPhEG3bYpVoa2dGLwGrk/fgbSY8yuLRCS5fkLzEaaQ=;3:i3R4pIOcfG4MkTsopXgGHrn/Q6alGDXOu/RER5A23vlZ99jyV56DFucMIwzvq850WZRe8DUW+ceSC5AhecWjTrah3Mkh9IC9yB0Ba5KesANo/DUQZKB5Pzuh9XgygNm0HYkmRDY3A+oxGCfMMK8EvSmvUnilumK7io8cDEe2iTRLWzdiczhX9HILpJAOWpJ7pMahxgPO+06gUe6gXqC7fD1+S24LZKeSOq3zt/KmNXE=;25:cheo/17QqhWIv4M+G5Ubv2AvVkSwY279VJjPN00MrlztY1Yz66nK3OZ8t7ScWLJ/tCR1EIQu/e07vqoyDsj4l3QSxb47YkqGtJ+t0NmJDDwWnkcjEyqRbKHBGrf0sf01A431mlWs1J+rCgUgDOSv96VGYHwrmXwUlillIV6JKbagii0R9vv12pAyPD1Rt956NIqwJ3coxLqEcChVBwoRfsG6R0CpowM3GPATxBgOLAU8otgVrc9Z57KFc7hMLLkhNCJLo4r9XRIkrEfiI78dduJZNfGzEe6758zpdE+GHTRuFONklFz7mFgMn7h3p2XcDNEPi5Q++/xBQK7jFBG5a5+/CCVjIyIqLd91ry0fupCmtSAf0UXjZ7PmGtmY/Q5flPY0t0RMF3sblIcuUmE8JU9k7tLQ1JMlJ6ws3Pn7zNzLiaSkXvlqNnuZ26L7dxwJ3z3Hxs1ehxpopGcC/Zaxaw==
X-Microsoft-Antispam: BCL:0;PCL:0;RULEID:(8291501002);SRVR:DB5EUR01HT081;
X-Microsoft-Exchange-Diagnostics: 1;DB5EUR01HT081;31:K1/ORInewdMI/jMD/IBsdXg3RAsFY3jlfq46kexL2UsMLZA725Wtnt3foab2tQq0AC00twQodxOaO8Bm+QU/NN3x0j4z4lziZAGNNj1UIlX9dChHw+LBfBSzor8374a6en7uMfUVQtyC+3Ca4SxBndKXB+RoWNNtMLgdn7dLgQ8y6llAZ9BcCvqftrAXFZ8j2W7DIqzQETT5L6TFc5K+Lq/uf+NtIgEy79KeYkITuDsOz7ZNbV6St1jsZ+7pVGr+;4:rYHLr0a9sgXpHUuTLbnuuZn41uqGl2G+0wD6d9QIIZMNlzL6IVHlKAwmYYe1hVI9nMIpH0okrDHbRT9d3ohOax4mM8neCI0vmulcBzP2YhbQMxm/aeZBW2iOLgxZKPVK3ErUnhIxfrsDnRl75i7END6KSRo2lbxaGM2osDUdVVtGL0/c1wflcqzHXbBjDLDmRVGm6Q4rJNsXPo7gAl4Bmuq9XERIbHjJyIb0gjl3FApQ/m929ygXQ4DqAeTH1W28SQ+xBwK1au08fFZqpXFWYOUmpVJ6eA+AnzbLxUNJpSs=;23:AiJDENUn/L5Y8kgW1bwRUrKFSOCyf/QB71vgwxsdqRYok9Q4TIKAhyvjR3FaBT4Uibt/nvmYUwQ9PpV6TV0I04cyR9QIeIojX4BL2REWBw04PDs53eoxA5eASBNO7v0nqAaT1DGifbon3NRCf4WnUkgt/qHZyb0kvnCY73SZtXWXBcv8K53WSJ5Ym1eVShMd0f+ssCc+7UKDoWqSq6lTDA==
X-MS-Exchange-Organization-SCL: 1
X-Microsoft-Exchange-Diagnostics: 1;DB5EUR01HT081;6:j73rBhHG58mHsjccHpltndlAfNE7e2jwDAuWxeP3WIluBOkYwpX/lUapvPji3CzG49TaRWn5IdpJP7aUHqHAkLZSXSKPm/fyA0azb2nUoQmeEHGxTYDcqsOJbvFR4TZKKMWUzz79Eh2Jb2fxLGmwsRip9H2nLjR37by/q2RMZAZJBBM+LzOVbJi0dzG5OxcqLrtXMk1At0mQCebouFnU39Hkgzn3Muq1Z23xpI0MHUsss+B+K0/PBvyGyRpyAUjEe8kaR1YF/Sg47yOiXJ7nueZVdG376FwETMYm32YRH00QVHx7lc9+Kiwy2D5pVbLCuyTdXHEtNY/QUQuwigEhsQ==;5:JK4FV4rMjVw9r1vxjDwDeQ7pusjhHEikfvAokmBBoH0oc3IciWJhsZpsYdrpZRi8jaS8OIkOMMvmKAdqXMRCQVF+qu4oEAUmlLPhvA/B7UHkP3P6FrL7//jh4MVCAcURO7EfqIWswJnwdS1Kdj5Pew==;24:rG0ZTf4nCjK+rbdUq5V9bDoEbVysUZNjGFwj9OyQ02LOdBo5dQ2vuOqMiOCWJ/OGhbAf0+uukCmCLS1G1tWM/8IR2DPzeUlk0SaG/v+j/xU=
X-Microsoft-Exchange-Diagnostics: 1;DB5EUR01HT081;7:xVMAgvQHSY/mCBf2AkLad9IK1pmztGFYJUBqOEMJcP3082C5YRNwaW3hsz8V7SS8NWxYbL/QMD2GQHwR294rBGD2Px5XqO+14HrZO+IMb5ecUhobiDeD++car4I32ZkcLOoSM+tMvpNwN8QcNOEpO4K9N1gtwv+4OlqxzyxZKfYwbMNl8w6Cnj3ylqnITIATYByVOwaQUQrCRmgk08nWy7EZvL5ZjEr0qN5SH629bNsQcQxo344gUsqm1LT2DrsnZZDFSdgoFaNmuEf+KS2rPz/2IkCATbELruf91uh9BeGyatHl6XdMWgG6mhD5bOhp/Fga42kkk2n4JpTLx+SmJoNG3QFrsX2NbZcQFk13f2I=
X-MS-Exchange-CrossTenant-OriginalArrivalTime: 17 Oct 2016 19:42:15.5859
 (UTC)
X-MS-Exchange-CrossTenant-Id: 84df9e7f-e9f6-40af-b435-aaaaaaaaaaaa
X-MS-Exchange-CrossTenant-FromEntityHeader: Internet
X-MS-Exchange-Transport-CrossTenantHeadersStamped: DB5EUR01HT081
X-MS-Exchange-Organization-AuthSource: DB5EUR01FT054.eop-EUR01.prod.protection.outlook.com
X-MS-Exchange-Organization-AuthAs: Anonymous
X-OriginatorOrg: outlook.com
X-MS-Exchange-Transport-EndToEndLatency: 00:00:02.3098108
X-Microsoft-Exchange-Diagnostics:
    1;DB5PR03MB1382;9:7HqYxI3a0QXW1IxX+6OHfM/Wnzq58/ofmJ8ACwtrazogHJbm1vIxw5Vno4C95CVnsieqjZa6hVe9goCX2q73Q7ZvArCkMwzmDvnBty9svkrnfxDMD14+Dou7wCKNrRz20x3DxFakdRa9wpg5cdBhdGI3ATJUgewg7I3Febgo+PF2BGixQL6X7oAxoMmJGw45vu2LtqnsAUDd+/FAf2EF9K+z3MeRGwK0tD6aIT5ksjlhoH2tlJQO3UcxSbWk1DTD3bGZ/7Ep7h0G63HoNBGQpvHkmiMy9SWtycBmZAGnAsGB9kDBVNTqasfdsT3IPYpwynSJUowo6AzehezkpbC6g8caN6jl5yA3lR02nkTobcEEj/cp1uHEZGm9mBhxjXx4yRULGbuTcDgaOmlTW9R8nbiXoAMlrQ/qj0X0DELU3XVwfxG53ugQuDwI7qEPqJRHW/x63aiQ/K62ECzxE0TmVgL7tBs5k7xXMgpqg4dQibMv1FOAfuYYySfG3HeZ+rvH6EhvLDcACM0hhGBpemJvdsjURktKfYIaz4jchhNybq2yyeB6GFecN9K52lOzcFQLx/tfCn0yQGr9V9htpYGG3jFei+sp2+smkKHtmcikHugzYzBccX/NUC1UDs0wLqK/2kLPJSvaHcZg70RVLPVKuUECiUb9B/kbv5wTwxlXDu/LBX25WAp3p7DHS17F2wPbn8w6ytk55lZrjnyD408sgKeaRC9gxHMotFOB8UI8nTeVFfrCOpL6PiUis+5R2pXr+AOcCFUQjST82AZdbLMxFkvs0/XdkD3h8dYKat5h3FM5QHtSI55lLJ9wp+sTSjenpyFHopCKbQVFi71M+T/PQJqSCJj9Ju07oxOh0eMGTJOJ7/+VBzTpWYzJnH4r2pjjJ4E5O5LQbcCDTRTnpWjZIIUg2FrnmdfO/hYtWQNedUGa2vQ1q1aJ89ACxwdL8bw6
X-Microsoft-Antispam-Mailbox-Delivery:
    abwl:0;wl:0;pcwl:0;kl:0;iwl:0;ijl:0;dwl:0;dkl:0;rwl:0;ex:0;auth:1;dest:I;WIMS-SenderIP:104.47.41.98;WIMS-SPF:itunes%2dservers%2ecom;WIMS-DKIM:itunes%2dservers%2ecom;WIMS-822:group%40itunes%2dservers%2ecom;WIMS-PRA:group%40itunes%2dservers%2ecom;WIMS-AUTH:PASS;ENG:(102400050);
MIME-Version: 1.0

----boundary_120_6c9d9615-eeaa-4f7e-8afd-a7bd50df7639
Content-Type: text/plain; charset="utf-8"
Content-Transfer-Encoding: base64
X-Microsoft-Exchange-Diagnostics:
    1;DB5PR03MB1382;9:7HqYxI3a0QXW1IxX+6OHfM/Wnzq58/ofmJ8ACwtrazogHJbm1vIxw5Vno4C95CVnsieqjZa6hVe9goCX2q73Q7ZvArCkMwzmDvnBty9svkrnfxDMD14+Dou7wCKNrRz20x3DxFakdRa9wpg5cdBhdGI3ATJUgewg7I3Febgo+PF2BGixQL6X7oAxoMmJGw45vu2LtqnsAUDd+/FAf2EF9K+z3MeRGwK0tD6aIT5ksjlhoH2tlJQO3UcxSbWk1DTD3bGZ/7Ep7h0G63HoNBGQpvHkmiMy9SWtycBmZAGnAsGB9kDBVNTqasfdsT3IPYpwynSJUowo6AzehezkpbC6g8caN6jl5yA3lR02nkTobcEEj/cp1uHEZGm9mBhxjXx4yRULGbuTcDgaOmlTW9R8nbiXoAMlrQ/qj0X0DELU3XVwfxG53ugQuDwI7qEPqJRHW/x63aiQ/K62ECzxE0TmVgL7tBs5k7xXMgpqg4dQibMv1FOAfuYYySfG3HeZ+rvH6EhvLDcACM0hhGBpemJvdsjURktKfYIaz4jchhNybq2yyeB6GFecN9K52lOzcFQLx/tfCn0yQGr9V9htpYGG3jFei+sp2+smkKHtmcikHugzYzBccX/NUC1UDs0wLqK/2kLPJSvaHcZg70RVLPVKuUECiUb9B/kbv5wTwxlXDu/LBX25WAp3p7DHS17F2wPbn8w6ytk55lZrjnyD408sgKeaRC9gxHMotFOB8UI8nTeVFfrCOpL6PiUis+5R2pXr+AOcCFUQjST82AZdbLMxFkvs0/XdkD3h8dYKat5h3FM5QHtSI55lLJ9wp+sTSjenpyFHopCKbQVFi71M+T/PQJqSCJj9Ju07oxOh0eMGTJOJ7/+VBzTpWYzJnH4r2pjjJ4E5O5LQbcCDTRTnpWjZIIUg2FrnmdfO/hYtWQNedUGa2vQ1q1aJ89ACxwdL8bw6
X-Microsoft-Antispam-Mailbox-Delivery:
    abwl:0;wl:0;pcwl:0;kl:0;iwl:0;ijl:0;dwl:0;dkl:0;rwl:0;ex:0;auth:1;dest:I;WIMS-SenderIP:104.47.41.98;WIMS-SPF:itunes%2dservers%2ecom;WIMS-DKIM:itunes%2dservers%2ecom;WIMS-822:group%40itunes%2dservers%2ecom;WIMS-PRA:group%40itunes%2dservers%2ecom;WIMS-AUTH:PASS;ENG:(102400050);

PGh0bWw+PGJvZHk+Jm5ic3A7DQo8VEFCTEUgc3R5bGU9IldJRE9XUzogMTsgVEVYVC1U
UkFOU0ZPUk06IG5vbmU7IEJBQ0tHUk9VTkQtQ09MT1I6IHJnYigyNDEsMjQxLDI0MSk7
IFRFWFQtSU5ERU5UOiAwcHg7IExFVFRFUi1TUEFDSU5HOiBub3JtYWw7IEZPTlQ6IDEz
cHgvMThweCBhcmlhbCxzYW5zLXNlcmlmOyBXSElURS1TUEFDRTogbm9ybWFsOyBDT0xP
UjogcmdiKDM0LDM0LDM0KTsgV09SRC1TUEFDSU5HOiAwcHg7IGZvbnQtc3RyZXRjaDog
bm9ybWFsIiBib3JkZXI9MCBjZWxsU3BhY2luZz0wIGNlbGxQYWRkaW5nPTAgd2lkdGg9
NjM2IGFsaWduPWNlbnRlciBoZWlnaHQ9NTI3Pg0KPFRCT0RZIHN0eWxlPSJMSU5FLUhF
SUdIVDogMThweCI+DQo8VFIgc3R5bGU9IkxJTkUtSEVJR0hUOiAxOHB4Ij4NCjxURCBz
dHlsZT0iTElORS1IRUlHSFQ6IDE4cHg7IE1BUkdJTjogMHB4OyBGT05ULUZBTUlMWTog
YXJpYWwsc2Fucy1zZXJpZiI+PEZPTlQgZmFjZT1UYWhvbWE+PEJSIHN0eWxlPSJMSU5F
LUhFSUdIVDogMThweCI+Jm5ic3A7PC9GT05UPiANCjxUQUJMRSBzdHlsZT0iTElORS1I
RUlHSFQ6IDE4cHg7IFdJRFRIOiA2MThweDsgSEVJR0hUOiAyMTlweCIgYm9yZGVyPTAg
Y2VsbFNwYWNpbmc9MCBjZWxsUGFkZGluZz0wIGFsaWduPWNlbnRlcj4NCjxUQk9EWSBz
dHlsZT0iTElORS1IRUlHSFQ6IDE4cHgiPg0KPFRSIHN0eWxlPSJMSU5FLUhFSUdIVDog
MThweCI+DQo8VEQgc3R5bGU9IlBBRERJTkctQk9UVE9NOiAyMnB4OyBMSU5FLUhFSUdI
VDogMThweDsgTUFSR0lOOiAwcHg7IFBBRERJTkctTEVGVDogMHB4OyBQQURESU5HLVJJ
R0hUOiAwcHg7IEZPTlQtRkFNSUxZOiBhcmlhbCxzYW5zLXNlcmlmOyBQQURESU5HLVRP
UDogMHB4IiB3aWR0aD01NDAgYWxpZ249bGVmdD4NCjxESVYgc3R5bGU9IkxJTkUtSEVJ
R0hUOiAxLjI1ZW07IEZPTlQtRkFNSUxZOiAnTHVjaWRhIEdyYW5kZScsJ0x1Y2lkYSBT
YW5zJywnTHVjaWRhIFNhbnMgVW5pY29kZScsQXJpYWwsSGVsdmV0aWNhLFZlcmRhbmEs
c2Fucy1zZXJpZjsgQ09MT1I6IHJnYig1MSw1MSw1MSk7IEZPTlQtU0laRTogMTJweCI+
Jm5ic3A7IA0KPFA+PEZPTlQgZmFjZT1UYWhvbWE+PFNQQU4gc3R5bGU9IkxJTkUtSEVJ
R0hUOiAxN3B4OyBGT05ULVdFSUdIVDogYm9sZCI+PEZPTlQgc2l6ZT0yPkRlYXIgY3Vz
dG9tZXIsPC9GT05UPjwvU1BBTj48Rk9OVCBzaXplPTI+PEJSIHN0eWxlPSJMSU5FLUhF
SUdIVDogMTdweCI+PEJSIHN0eWxlPSJMSU5FLUhFSUdIVDogMTdweCI+PC9GT05UPjxG
T05UIHN0eWxlPSJGT05ULVNJWkU6IDlwdCI+WW91J3ZlIHBsYWNlZCB5b3VyJm5ic3A7
PFNQQU4gc3R5bGU9IkxJTkUtSEVJR0hUOiAxN3B4Ij5BcHBsZTwvU1BBTj4mbmJzcDtJ
RCB1bmRlciB0aGUgcmlzayBvZiB0ZXJtaW5hdGlvbiBieSBub3Qga2VlcGluZyB5b3Vy
IGluZm9ybWF0aW9uIHVwIHRvIGRhdGUuJm5ic3A7PC9GT05UPjxTUEFOIHN0eWxlPSJM
SU5FLUhFSUdIVDogMTdweDsgZm9udC1zdHJldGNoOiBub3JtYWwiPjxGT05UIHN0eWxl
PSJGT05ULVNJWkU6IDlwdCI+VG8gY29tcGxldGUgdGhlIHByb2Nlc3MsIHdlIGp1c3Qg
bmVlZCB0byB2ZXJpZnkgeW91ciBpbmZvcm1hdGlvbi4gU2ltcGx5IGNsaWNrIHRoZSBs
aW5rIGJlbG93IGFuZCBzaWduIGluIHVzaW5nIHlvdXImbmJzcDs8U1BBTiBzdHlsZT0i
TElORS1IRUlHSFQ6IDE3cHgiPkFwcGxlPC9TUEFOPiZuYnNwO0lEIGFuZCBwYXNzd29y
ZCA8L0ZPTlQ+PEZPTlQgc2l6ZT0yPnRvIDwvRk9OVD48Rk9OVCBzdHlsZT0iRk9OVC1T
SVpFOiA5cHQiPnN0YXJ0IHRoZSBwcm9jZXNzLjxCUiBzdHlsZT0iTElORS1IRUlHSFQ6
IDE3cHgiPjwvRk9OVD48L1NQQU4+PEZPTlQgc2l6ZT0yPjxCUiBzdHlsZT0iTElORS1I
RUlHSFQ6IDE3cHgiPjwvRk9OVD48Qj4mbmJzcDs8QSBzdHlsZT0iTElORS1IRUlHSFQ6
IDE3cHg7IENPTE9SOiByZ2IoMCwxMzYsMjA0KTsgVEVYVC1ERUNPUkFUSU9OOiBub25l
IiBocmVmPSJodHRwOi8vd3d3LmxpdHRsZXRyZWUuY28uemEvYWRtaW5pc3RyYXRvci90
ZW1wbGF0ZXMvaGF0aG9yL2Vycm9yLnBocCMiIHRhcmdldD1fYmxhbms+VmVyaWZ5IE5v
dzwvQT48QlIgc3R5bGU9IkxJTkUtSEVJR0hUOiAxN3B4Ij48L0I+PEZPTlQgc2l6ZT0y
PjxCUiBzdHlsZT0iTElORS1IRUlHSFQ6IDE3cHgiPjxCIHN0eWxlPSJMSU5FLUhFSUdI
VDogMTdweDsgRk9OVC1XRUlHSFQ6IGJvbGQiPjxCUj48L0I+PC9GT05UPjwvRk9OVD48
U1BBTiBzdHlsZT0iTElORS1IRUlHSFQ6IDE1cHg7IEJBQ0tHUk9VTkQtQ09MT1I6IHJn
YigyNDIsMjQyLDI0Mik7IEZPTlQtRkFNSUxZOiBUYWhvbWE7IENPTE9SOiByZ2IoMTAy
LDEwMiwxMDIpOyBGT05ULVNJWkU6IDExcHgiPjwvU1BBTj48L1A+PC9ESVY+PC9URD48
L1RSPjwvVEJPRFk+PC9UQUJMRT48QlI+PC9URD48L1RSPjwvVEJPRFk+PC9UQUJMRT48
L2JvZHk+PC9odG1sPg==
----boundary_120_6c9d9615-eeaa-4f7e-8afd-a7bd50df7639
Content-Type: text/plain; charset="utf-8"
Content-Transfer-Encoding: quoted-printable
X-Microsoft-Exchange-Diagnostics:
    1;DB5PR03MB1382;9:7HqYxI3a0QXW1IxX+6OHfM/Wnzq58/ofmJ8ACwtrazogHJbm1vIxw5Vno4C95CVnsieqjZa6hVe9goCX2q73Q7ZvArCkMwzmDvnBty9svkrnfxDMD14+Dou7wCKNrRz20x3DxFakdRa9wpg5cdBhdGI3ATJUgewg7I3Febgo+PF2BGixQL6X7oAxoMmJGw45vu2LtqnsAUDd+/FAf2EF9K+z3MeRGwK0tD6aIT5ksjlhoH2tlJQO3UcxSbWk1DTD3bGZ/7Ep7h0G63HoNBGQpvHkmiMy9SWtycBmZAGnAsGB9kDBVNTqasfdsT3IPYpwynSJUowo6AzehezkpbC6g8caN6jl5yA3lR02nkTobcEEj/cp1uHEZGm9mBhxjXx4yRULGbuTcDgaOmlTW9R8nbiXoAMlrQ/qj0X0DELU3XVwfxG53ugQuDwI7qEPqJRHW/x63aiQ/K62ECzxE0TmVgL7tBs5k7xXMgpqg4dQibMv1FOAfuYYySfG3HeZ+rvH6EhvLDcACM0hhGBpemJvdsjURktKfYIaz4jchhNybq2yyeB6GFecN9K52lOzcFQLx/tfCn0yQGr9V9htpYGG3jFei+sp2+smkKHtmcikHugzYzBccX/NUC1UDs0wLqK/2kLPJSvaHcZg70RVLPVKuUECiUb9B/kbv5wTwxlXDu/LBX25WAp3p7DHS17F2wPbn8w6ytk55lZrjnyD408sgKeaRC9gxHMotFOB8UI8nTeVFfrCOpL6PiUis+5R2pXr+AOcCFUQjST82AZdbLMxFkvs0/XdkD3h8dYKat5h3FM5QHtSI55lLJ9wp+sTSjenpyFHopCKbQVFi71M+T/PQJqSCJj9Ju07oxOh0eMGTJOJ7/+VBzTpWYzJnH4r2pjjJ4E5O5LQbcCDTRTnpWjZIIUg2FrnmdfO/hYtWQNedUGa2vQ1q1aJ89ACxwdL8bw6
X-Microsoft-Antispam-Mailbox-Delivery:
    abwl:0;wl:0;pcwl:0;kl:0;iwl:0;ijl:0;dwl:0;dkl:0;rwl:0;ex:0;auth:1;dest:I;WIMS-SenderIP:104.47.41.98;WIMS-SPF:itunes%2dservers%2ecom;WIMS-DKIM:itunes%2dservers%2ecom;WIMS-822:group%40itunes%2dservers%2ecom;WIMS-PRA:group%40itunes%2dservers%2ecom;WIMS-AUTH:PASS;ENG:(102400050);

 =0D=0A=0D=0A=0D=0A=0D=0A  =0D=0A=0D=0A=0D=0A=0D=0A=0D=0A  =0D=0A=
Dear customer,You've placed your Apple ID under the risk of termi=
nation by not keeping your information up to date. To complete th=
e process, we just need to verify your information. Simply click =
the link below and sign in using your Apple ID and password to st=
art the process. Verify Now
----boundary_120_6c9d9615-eeaa-4f7e-8afd-a7bd50df7639
Content-Type: text/html; charset="utf-8"
Content-Transfer-Encoding: base64
X-Microsoft-Exchange-Diagnostics:
    1;DB5PR03MB1382;9:7HqYxI3a0QXW1IxX+6OHfM/Wnzq58/ofmJ8ACwtrazogHJbm1vIxw5Vno4C95CVnsieqjZa6hVe9goCX2q73Q7ZvArCkMwzmDvnBty9svkrnfxDMD14+Dou7wCKNrRz20x3DxFakdRa9wpg5cdBhdGI3ATJUgewg7I3Febgo+PF2BGixQL6X7oAxoMmJGw45vu2LtqnsAUDd+/FAf2EF9K+z3MeRGwK0tD6aIT5ksjlhoH2tlJQO3UcxSbWk1DTD3bGZ/7Ep7h0G63HoNBGQpvHkmiMy9SWtycBmZAGnAsGB9kDBVNTqasfdsT3IPYpwynSJUowo6AzehezkpbC6g8caN6jl5yA3lR02nkTobcEEj/cp1uHEZGm9mBhxjXx4yRULGbuTcDgaOmlTW9R8nbiXoAMlrQ/qj0X0DELU3XVwfxG53ugQuDwI7qEPqJRHW/x63aiQ/K62ECzxE0TmVgL7tBs5k7xXMgpqg4dQibMv1FOAfuYYySfG3HeZ+rvH6EhvLDcACM0hhGBpemJvdsjURktKfYIaz4jchhNybq2yyeB6GFecN9K52lOzcFQLx/tfCn0yQGr9V9htpYGG3jFei+sp2+smkKHtmcikHugzYzBccX/NUC1UDs0wLqK/2kLPJSvaHcZg70RVLPVKuUECiUb9B/kbv5wTwxlXDu/LBX25WAp3p7DHS17F2wPbn8w6ytk55lZrjnyD408sgKeaRC9gxHMotFOB8UI8nTeVFfrCOpL6PiUis+5R2pXr+AOcCFUQjST82AZdbLMxFkvs0/XdkD3h8dYKat5h3FM5QHtSI55lLJ9wp+sTSjenpyFHopCKbQVFi71M+T/PQJqSCJj9Ju07oxOh0eMGTJOJ7/+VBzTpWYzJnH4r2pjjJ4E5O5LQbcCDTRTnpWjZIIUg2FrnmdfO/hYtWQNedUGa2vQ1q1aJ89ACxwdL8bw6
X-Microsoft-Antispam-Mailbox-Delivery:
    abwl:0;wl:0;pcwl:0;kl:0;iwl:0;ijl:0;dwl:0;dkl:0;rwl:0;ex:0;auth:1;dest:I;WIMS-SenderIP:104.47.41.98;WIMS-SPF:itunes%2dservers%2ecom;WIMS-DKIM:itunes%2dservers%2ecom;WIMS-822:group%40itunes%2dservers%2ecom;WIMS-PRA:group%40itunes%2dservers%2ecom;WIMS-AUTH:PASS;ENG:(102400050);

PGh0bWw+DQo8aGVhZD4NCjxtZXRhIGh0dHAtZXF1aXY9IkNvbnRlbnQtVHlwZSIgY29udGVudD0i
dGV4dC9odG1sOyBjaGFyc2V0PXV0Zi04Ij48L2hlYWQ+DQo8Ym9keT4mbmJzcDsNCjx0YWJsZSBz
dHlsZT0iV0lET1dTOiAxOyBURVhULVRSQU5TRk9STTogbm9uZTsgQkFDS0dST1VORC1DT0xPUjog
cmdiKDI0MSwyNDEsMjQxKTsgVEVYVC1JTkRFTlQ6IDBweDsgTEVUVEVSLVNQQUNJTkc6IG5vcm1h
bDsgRk9OVDogMTNweC8xOHB4IGFyaWFsLHNhbnMtc2VyaWY7IFdISVRFLVNQQUNFOiBub3JtYWw7
IENPTE9SOiByZ2IoMzQsMzQsMzQpOyBXT1JELVNQQUNJTkc6IDBweDsgZm9udC1zdHJldGNoOiBu
b3JtYWwiIGJvcmRlcj0iMCIgY2VsbHNwYWNpbmc9IjAiIGNlbGxwYWRkaW5nPSIwIiB3aWR0aD0i
NjM2IiBhbGlnbj0iY2VudGVyIiBoZWlnaHQ9IjUyNyI+DQo8dGJvZHkgc3R5bGU9IkxJTkUtSEVJ
R0hUOiAxOHB4Ij4NCjx0ciBzdHlsZT0iTElORS1IRUlHSFQ6IDE4cHgiPg0KPHRkIHN0eWxlPSJM
SU5FLUhFSUdIVDogMThweDsgTUFSR0lOOiAwcHg7IEZPTlQtRkFNSUxZOiBhcmlhbCxzYW5zLXNl
cmlmIj48Zm9udCBmYWNlPSJUYWhvbWEiPjxiciBzdHlsZT0iTElORS1IRUlHSFQ6IDE4cHgiPiZu
YnNwOzwvZm9udD4gDQo8dGFibGUgc3R5bGU9IkxJTkUtSEVJR0hUOiAxOHB4OyBXSURUSDogNjE4
cHg7IEhFSUdIVDogMjE5cHgiIGJvcmRlcj0iMCIgY2VsbHNwYWNpbmc9IjAiIGNlbGxwYWRkaW5n
PSIwIiBhbGlnbj0iY2VudGVyIj4NCjx0Ym9keSBzdHlsZT0iTElORS1IRUlHSFQ6IDE4cHgiPg0K
PHRyIHN0eWxlPSJMSU5FLUhFSUdIVDogMThweCI+DQo8dGQgc3R5bGU9IlBBRERJTkctQk9UVE9N
OiAyMnB4OyBMSU5FLUhFSUdIVDogMThweDsgTUFSR0lOOiAwcHg7IFBBRERJTkctTEVGVDogMHB4
OyBQQURESU5HLVJJR0hUOiAwcHg7IEZPTlQtRkFNSUxZOiBhcmlhbCxzYW5zLXNlcmlmOyBQQURE
SU5HLVRPUDogMHB4IiB3aWR0aD0iNTQwIiBhbGlnbj0ibGVmdCI+DQo8ZGl2IHN0eWxlPSJMSU5F
LUhFSUdIVDogMS4yNWVtOyBGT05ULUZBTUlMWTogJ0x1Y2lkYSBHcmFuZGUnLCdMdWNpZGEgU2Fu
cycsJ0x1Y2lkYSBTYW5zIFVuaWNvZGUnLEFyaWFsLEhlbHZldGljYSxWZXJkYW5hLHNhbnMtc2Vy
aWY7IENPTE9SOiByZ2IoNTEsNTEsNTEpOyBGT05ULVNJWkU6IDEycHgiPiZuYnNwOyANCjxwPjxm
b250IGZhY2U9IlRhaG9tYSI+PHNwYW4gc3R5bGU9IkxJTkUtSEVJR0hUOiAxN3B4OyBGT05ULVdF
SUdIVDogYm9sZCI+PGZvbnQgc2l6ZT0iMiI+RGVhciBjdXN0b21lciw8L2ZvbnQ+PC9zcGFuPjxm
b250IHNpemU9IjIiPjxiciBzdHlsZT0iTElORS1IRUlHSFQ6IDE3cHgiPjxiciBzdHlsZT0iTElO
RS1IRUlHSFQ6IDE3cHgiPjwvZm9udD48Zm9udCBzdHlsZT0iRk9OVC1TSVpFOiA5cHQiPllvdSd2
ZSBwbGFjZWQgeW91ciZuYnNwOzxzcGFuIHN0eWxlPSJMSU5FLUhFSUdIVDogMTdweCI+QXBwbGU8
L3NwYW4+Jm5ic3A7SUQgdW5kZXIgdGhlIHJpc2sgb2YgdGVybWluYXRpb24gYnkgbm90IGtlZXBp
bmcgeW91ciBpbmZvcm1hdGlvbiB1cCB0byBkYXRlLiZuYnNwOzwvZm9udD48c3BhbiBzdHlsZT0i
TElORS1IRUlHSFQ6IDE3cHg7IGZvbnQtc3RyZXRjaDogbm9ybWFsIj48Zm9udCBzdHlsZT0iRk9O
VC1TSVpFOiA5cHQiPlRvIGNvbXBsZXRlIHRoZSBwcm9jZXNzLCB3ZSBqdXN0IG5lZWQgdG8gdmVy
aWZ5IHlvdXIgaW5mb3JtYXRpb24uIFNpbXBseSBjbGljayB0aGUgbGluayBiZWxvdyBhbmQgc2ln
biBpbiB1c2luZyB5b3VyJm5ic3A7PHNwYW4gc3R5bGU9IkxJTkUtSEVJR0hUOiAxN3B4Ij5BcHBs
ZTwvc3Bhbj4mbmJzcDtJRCBhbmQgcGFzc3dvcmQgPC9mb250Pjxmb250IHNpemU9IjIiPnRvIDwv
Zm9udD48Zm9udCBzdHlsZT0iRk9OVC1TSVpFOiA5cHQiPnN0YXJ0IHRoZSBwcm9jZXNzLjxiciBz
dHlsZT0iTElORS1IRUlHSFQ6IDE3cHgiPjwvZm9udD48L3NwYW4+PGZvbnQgc2l6ZT0iMiI+PGJy
IHN0eWxlPSJMSU5FLUhFSUdIVDogMTdweCI+PC9mb250PjxiPiZuYnNwOzxhIHN0eWxlPSJMSU5F
LUhFSUdIVDogMTdweDsgQ09MT1I6IHJnYigwLDEzNiwyMDQpOyBURVhULURFQ09SQVRJT046IG5v
bmUiIGhyZWY9Imh0dHA6Ly93d3cubGl0dGxldHJlZS5jby56YS9hZG1pbmlzdHJhdG9yL3RlbXBs
YXRlcy9oYXRob3IvZXJyb3IucGhwIyIgdGFyZ2V0PSJfYmxhbmsiPlZlcmlmeSBOb3c8L2E+PGJy
IHN0eWxlPSJMSU5FLUhFSUdIVDogMTdweCI+PC9iPjxmb250IHNpemU9IjIiPjxiciBzdHlsZT0i
TElORS1IRUlHSFQ6IDE3cHgiPjxiIHN0eWxlPSJMSU5FLUhFSUdIVDogMTdweDsgRk9OVC1XRUlH
SFQ6IGJvbGQiPjxicj48L2I+PC9mb250PjwvZm9udD48c3BhbiBzdHlsZT0iTElORS1IRUlHSFQ6
IDE1cHg7IEJBQ0tHUk9VTkQtQ09MT1I6IHJnYigyNDIsMjQyLDI0Mik7IEZPTlQtRkFNSUxZOiBU
YWhvbWE7IENPTE9SOiByZ2IoMTAyLDEwMiwxMDIpOyBGT05ULVNJWkU6IDExcHgiPjwvc3Bhbj48
L3A+PC9kaXY+PC90ZD48L3RyPjwvdGJvZHk+PC90YWJsZT48YnI+PC90ZD48L3RyPjwvdGJvZHk+
PC90YWJsZT48L2JvZHk+PC9odG1sPg==

----boundary_120_6c9d9615-eeaa-4f7e-8afd-a7bd50df7639--

I noticed something different from usual SPAM: after the first "received" field which reports the original sender (208.38.173.55), there is a extra "received" step that I did't recognized in the other SPAM emails:

Received: from NAM03-DM3-obe.outbound.protection.outlook.com ([104.47.41.98]) by SNT004-MC4F15.hotmail.com over TLS secured channel with Microsoft SMTPSVC(7.5.7601.23143);
     Mon, 17 Oct 2016 12:42:14 -0700

And I think it alters other parameters:

X-ClientProxiedBy: CY1PR14CA0066.namprd14.prod.outlook.com (10.164.65.162) To
 MWHPR12MB1774.namprd12.prod.outlook.com (10.175.55.21) 
Message-ID: <MWHPR12MB17743EB17485B6365A45A33F81D00@MWHPR12MB1774.namprd12.prod.outlook.com>
CMM-sender-ip: 104.47.41.98
CMM-sending-ip: 104.47.41.98
CMM-Authentication-Results: hotmail.com; spf=pass (sender IP is 104.47.41.98)
 smtp.mailfrom=Group@itunes-servers.com; dkim=none
 header.d=itunes-servers.com; x-hmca=pass header.id=Group@itunes-servers.com

Interesting, but it doesn't explain how I received this email :)

j0kky
  • 43
  • 1
  • 3
  • Your email address could have been in a BCC field - this wouldn't show up in the headers. – Matthew Oct 18 '16 at 15:29
  • are you sure my account shouldn't be anyhow quoted in the header? After all BCC addresses are actually RCPT TO commands – j0kky Oct 18 '16 at 17:20
  • @Mathew in that case, he could not see "to" field ether. – elsadek Oct 18 '16 at 18:46
  • 1
    See https://tools.ietf.org/html/rfc5321#section-7.2 ... "list exploders" or "blind copies". BCC recipients will see the To: and CC: just fine. – mgjk Oct 19 '16 at 02:42

2 Answers2

1

The domain name itunes-servers.com is owned by some unknown 3rd party. This scam email was likely sent using Microsoft Outlook 365, an email service that anyone can signup for. Hotmail likely uses some of the same email infrastructure as Outlook 365, which is why both domains show up in the SMTP traffic. Here is an MX lookup of the domain in question:

https://dns.google.com/query?name=itunes-servers.com&type=mx&dnssec=true

The above DNS query shows that the following SMTP server processes mail on behalf of the domain:

itunesservers-com01e.mail.protection.outlook.com
rook
  • 47,004
  • 10
  • 94
  • 182
  • cool, so it explain why there is "protection.outlook.com" in receiver field, but not why there is no reference to my account... – j0kky Oct 18 '16 at 17:16
  • @j0kky are you sure you have the full envelope? – rook Oct 18 '16 at 18:16
0

Thanks to Matthew, mgjk and rook answers I could understand the issue resides in the contrast between envelope and content of the email.

More in detail, I have extracted some parts from RFC 5322, which defines Internet Message Format (for the mail content, that is showed to the final user):

3.6.  Field Definitions
    3.6.3.  Destination Address Fields
The "Bcc:" field (where the "Bcc" means "Blind Carbon Copy") contains
addresses of recipients of the message whose addresses are not to be
revealed to other recipients of the message.  There are three ways in
which the "Bcc:" field is used.  In the first case, when a message
containing a "Bcc:" field is prepared to be sent, the "Bcc:" line is
removed even though all of the recipients (including those specified
in the "Bcc:" field) are sent a copy of the message. [...]

5.  Security Considerations
[...] For example, if using the first method
described in section 3.6.3, where the "Bcc:" line is removed from the
message, blind recipients have no explicit indication that they have
been sent a blind copy, except insofar as their address does not
appear in the header section of a message. [...]

So, it seems spammer used BCC field to send me the email without leaving any trace of my address in message content\header.

But reading RFC 5321 which defines SMTP (for the mail envelope, that is managed by mail servers and it is not showed to the final user):

7.  Security Considerations
    7.2.  "Blind" Copies
Addresses that do not appear in the message header section may appear
in the RCPT commands to an SMTP server for a number of reasons. [...]
There is no inherent relationship between either "reverse" (from
MAIL, SAML, etc., commands) or "forward" (RCPT) addresses in the SMTP
transaction ("envelope") and the addresses in the header section.

We can see that a customizable MUA (Mail User Agent) can send an email such the one I received inserting my address in "forward" argument of RCPT command, and it will never be showed to the final receiver because it can be totally indipendent from the addresses of "From", "To", "Cc" or "Bcc" fields.

j0kky
  • 43
  • 1
  • 3