OwlCyberSecurity - MANAGER

Edit File: 1702506516.M675055P471567.server237.web-hosting.com,S=45507,W=46395

Envelope-to: dev@ebaarchitects.org
Delivery-date: Wed, 13 Dec 2023 17:28:36 -0500
MIME-Version: 1.0
From: <postmaster@calgaryzoo.com>
To: <dev@ebaarchitects.org>
Date: Wed, 13 Dec 2023 22:27:47 +0000
Content-Type: multipart/report; report-type=delivery-status;
	boundary="79cc58c2-00ee-48fa-870c-33821cf0b3fe"
Content-Language: en-US
Message-ID:
 <c52ca69a-c72b-4306-b3cd-55ed2e3dcf59@YT3PR01MB8147.CANPRD01.PROD.OUTLOOK.COM>
In-Reply-To: <047f8205f1357ef3d07f76dd29edd68dae1c5b9f32@ebaarchitects.org>
References: <047f8205f1357ef3d07f76dd29edd68dae1c5b9f32@ebaarchitects.org>
Subject: Undeliverable: Querying a unusual transaction on your website -
 requesting your assistance
Auto-Submitted: auto-replied
X-MS-Exchange-AntiSpam-MessageData-ChunkCount: 1
X-MS-Exchange-AntiSpam-MessageData-0:
	3l9svEk1oulKa6xpld0qoR1OOac+YgnG9MoHQyvo8KZ1vvCVouQWNANPsULXsFRNEQW6DgIZsRJY5MX19/iin7TzrFyv96AZM5gciYyN0hP7QNdSNj6SMWFtZzfVTd4XYaw+FXDVA4YkAOP6wLYeYJaaKQqiQP+AfIKGtKNQJ1PdK2FB+3wTqX6E0ipd88RE
X-OriginatorOrg: calgaryzoo.com
X-MS-Exchange-CrossTenant-OriginalArrivalTime: 13 Dec 2023 22:27:47.5805
 (UTC)
X-MS-Exchange-CrossTenant-FromEntityHeader: Hosted
X-MS-Exchange-CrossTenant-AuthSource: YT3PR01MB8147.CANPRD01.PROD.OUTLOOK.COM
X-MS-Exchange-CrossTenant-AuthAs: Internal
X-MS-Exchange-CrossTenant-Network-Message-Id:
	01740606-37f6-486b-097b-08dbfc2abbfd
X-MS-Exchange-Transport-CrossTenantHeadersStamped: YT3PR01MB8147
X-Spam-Status: No, score=2.4
X-Spam-Score: 24
X-Spam-Bar: ++
X-Ham-Report: Spam detection software, running on the system "server237.web-hosting.com",
 has NOT identified this incoming email as spam.  The original
 message has been attached to this so you can view it or label
 similar future email.  If you have any questions, see
 root\@localhost for details.
 Content preview:  Delivery has failed to these recipients or groups: dawnh@calgaryzoo.com<mailto:dawnh@calgaryzoo.com>
    Your message wasn't delivered. Despite repeated attempts to deliver your
   message, a connection to the remote server couldn't be made. 
 Content analysis details:   (2.4 points, 5.0 required)
  pts rule name              description
 ---- ---------------------- --------------------------------------------------
  0.0 URIBL_BLOCKED          ADMINISTRATOR NOTICE: The query to URIBL was
                             blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#dnsbl-block
                              for more information.
                             [URIs: calgaryzoo.com]
 -0.0 SPF_HELO_PASS          SPF: HELO matches SPF record
  1.5 KAM_MXURI              URI: URI begins with a mail exchange prefix, i.e.
                             mx.[...]
  0.0 HTML_MESSAGE           BODY: HTML included in message
 -0.1 DKIM_VALID_AU          Message has a valid DKIM or DK signature from
                             author's domain
 -0.1 DKIM_VALID             Message has at least one valid DKIM or DK signature
  0.1 DKIM_SIGNED            Message has a DKIM or DK signature, not necessarily
                             valid
  1.0 FORGED_SPF_HELO        No description available.
 -0.0 T_SCC_BODY_TEXT_LINE   No description available.
X-Spam-Flag: NO

--79cc58c2-00ee-48fa-870c-33821cf0b3fe
Content-Type: multipart/alternative; differences=Content-Type;
	boundary="3152135f-4828-4245-8114-eb25a74c2c93"

--3152135f-4828-4245-8114-eb25a74c2c93
Content-Type: text/plain; charset="us-ascii"
Content-Transfer-Encoding: quoted-printable

Delivery has failed to these recipients or groups:

dawnh@calgaryzoo.com<mailto:dawnh@calgaryzoo.com>
Your message wasn't delivered. Despite repeated attempts to deliver your me=
ssage, a connection to the remote server couldn't be made.

Contact the recipient by some other means (by phone, for example) and ask t=
hem to tell their email admin that it appears that your email system is una=
ble to connecto their email system. Give them the error details shown below=
. It's likely that the recipient's email admin is the only one who can fix =
this problem.

For more information and tips to fix this issue see this article: https://g=
o.microsoft.com/fwlink/?LinkId=3D389361.

Diagnostic information for administrators:

Generating server: YT3PR01MB8147.CANPRD01.PROD.OUTLOOK.COM
Receiving server: YT3PR01MB8147.CANPRD01.PROD.OUTLOOK.COM

dawnh@calgaryzoo.com
12/13/2023 10:27:47 PM - Server at YT3PR01MB8147.CANPRD01.PROD.OUTLOOK.COM =
returned '550 5.4.317 Message expired, cannot connect to remote server(Subj=
ectMismatch)'
12/13/2023 10:23:00 PM - Server at calgaryzoo.com (104.47.75.228) returned =
'450 4.4.317 Cannot connect to remote server [Message=3DSubjectMismatch] [L=
astAttemptedServerName=3Dcalgaryzoo.com] [LastAttemptedIP=3D104.47.75.228:2=
5] [SmtpSecurity=3D-1;-1] [YT3CAN01FT026.eop-CAN01.prod.protection.outlook.=
com 2023-12-13T22:23:00.688Z 08DBFC0B0242FEE2](SubjectMismatch)'

Original message headers:

Received: from YT1PR01MB8252.CANPRD01.PROD.OUTLOOK.COM (2603:10b6:b01:c3::2=
2)
 by YT3PR01MB8147.CANPRD01.PROD.OUTLOOK.COM (2603:10b6:b01:9c::20) with
 Microsoft SMTP Server (version=3DTLS1_2,
 cipher=3DTLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.7091.26; Wed, 13 =
Dec
 2023 20:38:56 +0000
Received: from YQBPR0101MB8462.CANPRD01.PROD.OUTLOOK.COM (2603:10b6:c01:55:=
:7)
 by YT1PR01MB8252.CANPRD01.PROD.OUTLOOK.COM (2603:10b6:b01:c3::22) with
 Microsoft SMTP Server (version=3DTLS1_2,
 cipher=3DTLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.7091.26; Wed, 13 =
Dec
 2023 09:34:31 +0000
ARC-Seal: i=3D1; a=3Drsa-sha256; s=3Darcselector9901; d=3Dmicrosoft.com; cv=
=3Dnone;
 b=3DLoJvkvfSf8PqTqI8SPl6yeD2FogziKucKL7+fYO/czneRxUhNJ0as0uGIPeV39783GVbcU=
pwJgwbi9VmP/EuP4POXtVHusq7QpJVkAu94rhWFKLprF43ZkZSyvFxjn+ZWprc1r8ENw2g44fyj=
YmDFSVH/lEYMN2VPxqH5KCrLjZdokTxz1avsBNvc4WFaNNWRKPxBEj0n9CKOwVOJDm7VRfPAE+x=
98CL3gSKqU/RztQtDx1r/VbntZT0f8zvrHuMctLTwhevTJazKDBnnIGqPj9PfFygeCUZ88e/TbR=
6Ed23k+rnRa7fnloMXdfMVvRIPc79AUCKlQJQRwd7SYsnBg=3D=3D
ARC-Message-Signature: i=3D1; a=3Drsa-sha256; c=3Drelaxed/relaxed; d=3Dmicr=
osoft.com;
 s=3Darcselector9901;
 h=3DFrom:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-A=
ntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Ex=
change-AntiSpam-MessageData-1;
 bh=3D+gtM3aws/J7DGww/fiE2zyk8zSO9fRdE5RKCPXeJLYU=3D;
 b=3DfKErDV9Qo/hxDERirjr5dkpAamshZp5MPYNFlovQxlcMfkBGyupl/a08tStdnCThXM/xFR=
DF8ywrPr1DNsv1TGa/r8iLUTusAWGea4BZbdiEPNylhrCYXWbhy3OI2dY10lhLiLfp8AZDbdJLy=
7o58QRSte4exhjJxOprqyh4PhNbmPsBFBVlBiHlR46zhcAR9VmGAMnPpJ1BChAm9+xjTIKU3XVT=
q0+F2QG1oD2d+ERY1O/Az6W0lp5wF56xaLjlO8GuOQz73unKKGnmK6FzX/Jm30FkRYLrBUVHLmF=
qGV86WCr7lrFkIxDckebsrZOVBzjVo/9qmO8OvfBqzvMnxg=3D=3D
ARC-Authentication-Results: i=3D1; mx.microsoft.com 1; spf=3Dpass (sender i=
p is
 199.188.200.108) smtp.rcpttodomain=3Dcalgaryzoo.com
 smtp.mailfrom=3Debaarchitects.org; dmarc=3Dbestguesspass action=3Dnone
 header.from=3Debaarchitects.org; dkim=3Dpass (signature was verified)
 header.d=3Debaarchitects.org; arc=3Dnone (0)
Received: from YQXP288CA0019.CANP288.PROD.OUTLOOK.COM (2603:10b6:c00:41::47=
)
 by YQBPR0101MB8462.CANPRD01.PROD.OUTLOOK.COM (2603:10b6:c01:55::7) with
 Microsoft SMTP Server (version=3DTLS1_2,
 cipher=3DTLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.7091.26; Tue, 12 =
Dec
 2023 22:24:53 +0000
Received: from YQBCAN01FT023.eop-CAN01.prod.protection.outlook.com
 (2603:10b6:c00:41:cafe::fe) by YQXP288CA0019.outlook.office365.com
 (2603:10b6:c00:41::47) with Microsoft SMTP Server (version=3DTLS1_2,
 cipher=3DTLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.7068.36 via Front=
end
 Transport; Tue, 12 Dec 2023 22:24:53 +0000
Authentication-Results: spf=3Dpass (sender IP is 199.188.200.108)
 smtp.mailfrom=3Debaarchitects.org; dkim=3Dpass (signature was verified)
 header.d=3Debaarchitects.org;dmarc=3Dbestguesspass action=3Dnone
 header.from=3Debaarchitects.org;compauth=3Dpass reason=3D109
Received-SPF: Pass (protection.outlook.com: domain of ebaarchitects.org
 designates 199.188.200.108 as permitted sender)
 receiver=3Dprotection.outlook.com; client-ip=3D199.188.200.108;
 helo=3Dserver237-2.web-hosting.com; pr=3DC
Received: from server237-2.web-hosting.com (199.188.200.108) by
 YQBCAN01FT023.mail.protection.outlook.com (10.118.138.81) with Microsoft S=
MTP
 Server (version=3DTLS1_2, cipher=3DTLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) =
id
 15.20.7091.26 via Frontend Transport; Tue, 12 Dec 2023 22:24:53 +0000
DKIM-Signature: v=3D1; a=3Drsa-sha256; q=3Ddns/txt; c=3Drelaxed/relaxed;
        d=3Debaarchitects.org; s=3Ddefault; h=3DContent-Type:MIME-Version:D=
ate:Subject:To:
        From:Reply-To:Message-ID:Sender:Cc:Content-Transfer-Encoding:Conten=
t-ID:
        Content-Description:Resent-Date:Resent-From:Resent-Sender:Resent-To=
:Resent-Cc
        :Resent-Message-ID:In-Reply-To:References:List-Id:List-Help:List-Un=
subscribe:
        List-Subscribe:List-Post:List-Owner:List-Archive;
        bh=3Da+WgQb5Yvw9TxcLjZItnblDsmdJ8AncaUJBY9gJ2+Sg=3D; b=3DYzy88u5YFA=
j6M4oJeS3vkmC2Xq
        CiXcf0HjHgGb9wGuTfdjx6H1y8HHbBBo5UX+FDl/a1XxwJPGukno96AwL8ApANWIwM8=
wdpw4G/0Hz
        SwvO0hnDb1fJfwjw8wVQM3hGt36o+D3VZaBuqdUnS+Yllx/DofZR7e4jNK3TBPF0vX7=
/CQWRKU4Xl
        xa7YC5gs2P+MhWH3InPf9QSZdyzMMpqFc6CdLcqDV4nmHbiql4WPSfDuyCnInpeFlH6=
5omnTZDi3/
        FNM8ep+zAz51zIf0k5PjvOjXKDAhcgjt3IrRyec4Mx4i6MaKxtNxH1bEpx8Td60tMYl=
FrWHpJtaSM
        NWvoRRQw=3D=3D;
Received: from [14.224.175.203] (port=3D36976 helo=3D85.206.160.225)
        by server237.web-hosting.com with esmtpsa  (TLS1.2) tls TLS_ECDHE_R=
SA_WITH_AES_256_GCM_SHA384
        (Exim 4.96.1)
        (envelope-from <dev@ebaarchitects.org>)
        id 1rDBB7-00CL3d-30
        for dawnh@calgaryzoo.com;
        Tue, 12 Dec 2023 17:24:51 -0500
Message-ID: <047f8205f1357ef3d07f76dd29edd68dae1c5b9f32@ebaarchitects.org>
Reply-To: Oliver <oliver.f@mythenesa.com>
From: Oliver <dev@ebaarchitects.org>
To: dawnh@calgaryzoo.com
Subject: Querying a unusual transaction on your website - requesting your a=
ssistance
Date: Tue, 12 Dec 2023 14:19:18 -0800
MIME-Version: 1.0
Content-Type: multipart/alternative; boundary=3D"8b2168a2d0143b7053f9b00aae=
6a58ade390"
X-AntiAbuse: This header was added to track abuse, please include it with a=
ny abuse report
X-AntiAbuse: Primary Hostname - server237.web-hosting.com
X-AntiAbuse: Original Domain - calgaryzoo.com
X-AntiAbuse: Originator/Caller UID/GID - [47 12] / [47 12]
X-AntiAbuse: Sender Address Domain - ebaarchitects.org
X-Get-Message-Sender-Via: server237.web-hosting.com: authenticated_id: dev@=
ebaarchitects.org
X-Authenticated-Sender: server237.web-hosting.com: dev@ebaarchitects.org
X-Source:
X-Source-Args:
X-Source-Dir:
X-From-Rewrite: unmodified, already matched
Return-Path: dev@ebaarchitects.org
X-EOPAttributedMessage: 0
X-EOPTenantAttributedMessage: 134669ba-ae42-4cf0-a3b3-ae4791deca92:0
X-MS-PublicTrafficType: Email
X-MS-TrafficTypeDiagnostic:
        YQBCAN01FT023:EE_|YQBPR0101MB8462:EE_|YT1PR01MB8252:EE_|YT3PR01MB81=
47:EE_
X-MS-Office365-Filtering-Correlation-Id: 83cb80d8-375d-4508-e4de-08dbfb6129=
af
X-MS-Exchange-AtpMessageProperties: SA|SL
X-Microsoft-Antispam: BCL:0;
X-Microsoft-Antispam-Message-Info: =3D?utf-8?B?cC9kRHFVeWV3TFkvZWszMVhKK1hP=
Q25sTWJLTDZCSy9zYXErMG9jNzNweGdn?=3D
 =3D?utf-8?B?c1pzMWpnUE5IdWs1YXNGeXZIM1RmZ3FJU21vSldRdTIyMTFjbk1hZXJHQzhW?=
=3D
 =3D?utf-8?B?VVRqYnZvbG5NZXBqT2NTOUJyS01rUEFWeXhYQkEwT1orMUxRZEpRZ0ErM3li?=
=3D
 =3D?utf-8?B?c2IrUlprM3NITEttaldIallEOEVlZnhvMUIyK1h1Q3VLY0lXdWZIODR2ZFI0?=
=3D
 =3D?utf-8?B?ZVVpWGxxUmo3QzVvU0RhSDNpamY5MUlXbE94ZnZIRm5BaTYwL1pTNmtrVjYy?=
=3D
 =3D?utf-8?B?aWxGeWE0RlZXMjJWV1d0c0VicFZMOWZoc0tZbnR2anJlQjEzeTY4eDdaVTJa?=
=3D
 =3D?utf-8?B?VTZWak4ra1RyeTJaRDQvclg1TE1nVFdHWncvcTZjUGI2ejNFdnRFNWMyTTl2?=
=3D
 =3D?utf-8?B?RHZoNFVoSlRlandjZWdFcGxxRXBNbFFhMG9FNVpWWnZmZWtxdklyYmltdHUz?=
=3D
 =3D?utf-8?B?MVNzZVlDY2RhY0NzZGlmUTdZbGVWUXRBanFnYzZaakY1R1JBMWZCVnQ2eDE5?=
=3D
 =3D?utf-8?B?aHdOZVBzVkgzZFVIZ1RPYVdYMmZaaUtjaXEzTlp1SzE2c1NBKzJnUEZGVWFz?=
=3D
 =3D?utf-8?B?Z1lDOVRFMDU3SW9vZmhlOGgyMFNiZVlHVkEvS0hTR1l0NERmaENKc2l1V0xV?=
=3D
 =3D?utf-8?B?Z2FFcWNOeDdUZ1BpWDVBR09PWXRJUG1LSjgwWHJBcXl3Y0ErbExwSzZ5K0hF?=
=3D
 =3D?utf-8?B?WUNRdUJQazRIY2s4eWdqb1VTeFlyWDZKODkxNXFFbzh0cVEvVGF6M0ZkNzFl?=
=3D
 =3D?utf-8?B?V0RieTgzQ0ljUCs0TGw4M0VxNzRkZ2t6RzJHWjVOOCtIcEh2SE1LbnZhcWQ0?=
=3D
 =3D?utf-8?B?UUwxaVhYNXBQMzdWQ0lVMnBhMURXU3NQZXNJMXdWTFhwYWVKREJ4S2t1TjNn?=
=3D
 =3D?utf-8?B?OHhzbEx3cWhzek1HcmNkaE03RW1CZ3RsdzFSeG4vdGQxSVR1cTRlME9mZVl6?=
=3D
 =3D?utf-8?B?VGEyc3BheXFuL0VXbjlHa21sOUlHNTh3WWE3UUVrcE1QNk1aTzVSYVRQRkdr?=
=3D
 =3D?utf-8?B?dmlOb2t0MHFVVGVtMVdRcTU5cFB3RGJ1SysrWVNxSDFRNlQweDRJbVZYWVhr?=
=3D
 =3D?utf-8?B?cjdHTFNNWHEzVldITGdtVVpiMFg1MGtWN1pCeHI1Ty9JcHQwQW5nOGYxNlFB?=
=3D
 =3D?utf-8?B?Y3poVEdKQlJFVnE1NWdGRmNRbUZnQ2JIa0pvWE43SDBpL0VQK2hpZHF5TnVu?=
=3D
 =3D?utf-8?B?TE9FZFZXM21hM0pZVC9lNjY0YTZLeUpLS3VVbSt2YkZDWFZXRDB6TGxTZWEv?=
=3D
 =3D?utf-8?B?ZzBMTi9UYjNoSHUrMzJrZTZtb2tDOG9yVTF4eXFPMzNaVHlJaU8wMWpDakda?=
=3D
 =3D?utf-8?B?YzVwRDhmUnRIY0t1eGNOYW14TTF1eHY1YWE0d0JSRmprWG5nTlJ0MzFHdmxR?=
=3D
 =3D?utf-8?B?dmJCK0VpWld3czBLMDQzT2JhY1Q1NDAzOTEyMG9FckljUGh1S2lTcjFPbCsy?=
=3D
 =3D?utf-8?B?cUliZDZQbUJ4UGpKUHpRUGVmMThYSElXS1BJcEZ4TXpPNDZ2aXV4OEgyWC9m?=
=3D
 =3D?utf-8?B?eHdPT25HbnZIVE1hVWpFd0tyNlB5NUlheEZLTG01OUdoOStBT2R1aExrQ3Fl?=
=3D
 =3D?utf-8?B?VkJWOEpCUm5lTEhIbk16SE96K1YrVjBWVjczOXhtRU5QYllhTDdLUXVqRktD?=
=3D
 =3D?utf-8?B?YUlURHd4TTRqcnRXMUVGYkhvOVJyR29icFBHdGprdkw1RnNUWjBkeFZNWi9x?=
=3D
 =3D?utf-8?B?N1crNTVpbGNNb21vOUJOdzVYRkg4MzE0aElNVy9mRUJndXZONlpNYzR3MzVO?=
=3D
 =3D?utf-8?B?aVYvajlaK2lhS25vL21wa0NKOWtGMEd3UUpianVaU2JNK3RURnBNeWY5N1FQ?=
=3D
 =3D?utf-8?B?b09XTytNZGhyeXNMWjBWMkQ3cW1MclhkK3NhTzBmdmc4dVhMOHFoaUd6K0d0?=
=3D
 =3D?utf-8?B?N3grc0RsK01GMWVWMEc5VE9iYnRCWDlOSjVTRzMvYWtoNHlNZm9QeFhUOXJx?=
=3D
 =3D?utf-8?B?NWN0SUw2R3RyM3dNM2x6KzdWd09PaEdmQktvbkRVaUkvYzEzQ2xoajBKNE9W?=
=3D
 =3D?utf-8?B?MFUrUE5UejhvdDZLUjdUVEVOeTBrYmMvRlhMNitsYlkrNnJVQVdKMWNoVExG?=
=3D
 =3D?utf-8?B?QUlEWnBYQUcvSEtKalRxKzdyNGJYSCt3aFRPMUtSM0NLZXhObURzdGFwNklp?=
=3D
 =3D?utf-8?B?ZE44dHNpeWM0bGRObHdMNkR3UWVMbjZaTC8zYm1KK0VaeXMxbzFaYUFWdVl5?=
=3D
 =3D?utf-8?B?OEkzM1E0M2ZTRmgyTE5YUm5wMkVMRkdrVWFhcmV5YjFGUGZSWXVZSDNvT0FS?=
=3D
 =3D?utf-8?B?YUpTaDJnMG5ONlQ1NWtPWWlQZ09sQXhiNXF4M1ZYS1FBVGpWWkpwbUFPREZP?=
=3D
 =3D?utf-8?B?N0g1NlN5dlJBMHFTNXFZU1FKY2daK2pxdUJJSHJRRmF4Y3p1YXBucXk3OVBX?=
=3D
 =3D?utf-8?B?dkl4c1dMdXUxR2pYR2MvNWhmQldHL0g1VGozTG1TVzl6YURlVi8rK0ZmUjl4?=
=3D
 =3D?utf-8?B?eUNadWRFMDJYZEZ6d2FhQWovU0JWSzh6UUVuRUFobllkcUx2QktVZlpTakdi?=
=3D
 =3D?utf-8?Q?EZcINIRCBit?=3D
X-Forefront-Antispam-Report: CIP:199.188.200.108;CTRY:US;LANG:en;SCL:1;SRV:=
;IPV:NLI;SFV:NSPM;H:server237-2.web-hosting.com;PTR:server237-2.web-hosting=
.com;CAT:NONE;SFS:(13230031)(4636009)(230273577357003)(230173577357003)(451=
199024)(86362001)(36756003)(6916009)(7636003)(7596003)(356005)(33964004)(95=
6004)(2616005)(6666004)(120186005)(26005)(6966003)(83380400001)(336012)(347=
56004)(9786002)(5660300002)(8676002)(1096003)(17983001)(141083003)(93036002=
)(6106002);DIR:INB;
X-MS-Exchange-CrossTenant-OriginalArrivalTime: 12 Dec 2023 22:24:53.0662
 (UTC)
X-MS-Exchange-CrossTenant-Network-Message-Id: 83cb80d8-375d-4508-e4de-08dbf=
b6129af
X-MS-Exchange-CrossTenant-Id: 134669ba-ae42-4cf0-a3b3-ae4791deca92
X-MS-Exchange-CrossTenant-AuthSource: YQBCAN01FT023.eop-CAN01.prod.protecti=
on.outlook.com
X-MS-Exchange-CrossTenant-AuthAs: Anonymous
X-MS-Exchange-CrossTenant-FromEntityHeader: Internet
X-MS-Exchange-Transport-CrossTenantHeadersStamped: YQBPR0101MB8462
X-OrganizationHeadersPreserved: YQBPR0101MB8462.CANPRD01.PROD.OUTLOOK.COM
X-OriginatorOrg: calgaryzoo.com
X-CrossPremisesHeadersFilteredByDsnGenerator:
        YT3PR01MB8147.CANPRD01.PROD.OUTLOOK.COM

--3152135f-4828-4245-8114-eb25a74c2c93
Content-Type: text/html; charset="us-ascii"
Content-Transfer-Encoding: quoted-printable

<html>
<Head></head><body>
<p><b><font color=3D"#000066" size=3D"3" face=3D"Arial">Delivery has failed=
 to these recipients or groups:</font></b></p>
<font color=3D"#000000" size=3D"2" face=3D"Tahoma"><p><a href=3D"mailto:daw=
nh@calgaryzoo.com">dawnh@calgaryzoo.com</a><br>
</font>
<font color=3D"#000000" size=3D"3" face=3D"Arial">Your message wasn't deliv=
ered. Despite repeated attempts to deliver your message, a connection to th=
e remote server couldn't be made.<p>Contact the recipient by some other mea=
ns (by phone, for example) and ask them to tell their email admin that it a=
ppears that your email system is unable to connecto their email system. Giv=
e them the error details shown below. It's likely that the recipient's emai=
l admin is the only one who can fix this problem.</p><p>For more informatio=
n and tips to fix this issue see this article: https://go.microsoft.com/fwl=
ink/?LinkId=3D389361.</p><br>
</font>
<font color=3D"#000000" size=3D"2" face=3D"Tahoma"><br>
</p>
</font>
<br><br><br><br><br><br>
<font color=3D"#808080" size=3D"2" face=3D"Tahoma"><p><b>Diagnostic informa=
tion for administrators:</b></p>
<p>Generating server: YT3PR01MB8147.CANPRD01.PROD.OUTLOOK.COM<br>
Receiving server: YT3PR01MB8147.CANPRD01.PROD.OUTLOOK.COM <br>
</p>
<p>dawnh@calgaryzoo.com<br>
12/13/2023 10:27:47 PM - Server at YT3PR01MB8147.CANPRD01.PROD.OUTLOOK.COM =
 returned '550 5.4.317 Message expired, cannot connect to remote server(Sub=
jectMismatch)'<br>
12/13/2023 10:23:00 PM - Server at calgaryzoo.com (104.47.75.228) returned =
'450 4.4.317 Cannot connect to remote server [Message=3DSubjectMismatch] [L=
astAttemptedServerName=3Dcalgaryzoo.com] [LastAttemptedIP=3D104.47.75.228:2=
5] [SmtpSecurity=3D-1;-1] [YT3CAN01FT026.eop-CAN01.prod.protection.outlook.=
com 2023-12-13T22:23:00.688Z 08DBFC0B0242FEE2](SubjectMismatch)'</p>
<p>Original message headers:</p>
<pre>Received: from YT1PR01MB8252.CANPRD01.PROD.OUTLOOK.COM (2603:10b6:b01:=
c3::22)
 by YT3PR01MB8147.CANPRD01.PROD.OUTLOOK.COM (2603:10b6:b01:9c::20) with
 Microsoft SMTP Server (version=3DTLS1_2,
 cipher=3DTLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.7091.26; Wed, 13 =
Dec
 2023 20:38:56 +0000
Received: from YQBPR0101MB8462.CANPRD01.PROD.OUTLOOK.COM (2603:10b6:c01:55:=
:7)
 by YT1PR01MB8252.CANPRD01.PROD.OUTLOOK.COM (2603:10b6:b01:c3::22) with
 Microsoft SMTP Server (version=3DTLS1_2,
 cipher=3DTLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.7091.26; Wed, 13 =
Dec
 2023 09:34:31 +0000
ARC-Seal: i=3D1; a=3Drsa-sha256; s=3Darcselector9901; d=3Dmicrosoft.com; cv=
=3Dnone;
 b=3DLoJvkvfSf8PqTqI8SPl6yeD2FogziKucKL7+fYO/czneRxUhNJ0as0uGIPeV39783GVbcU=
pwJgwbi9VmP/EuP4POXtVHusq7QpJVkAu94rhWFKLprF43ZkZSyvFxjn+ZWprc1r8ENw2g44fyj=
YmDFSVH/lEYMN2VPxqH5KCrLjZdokTxz1avsBNvc4WFaNNWRKPxBEj0n9CKOwVOJDm7VRfPAE+x=
98CL3gSKqU/RztQtDx1r/VbntZT0f8zvrHuMctLTwhevTJazKDBnnIGqPj9PfFygeCUZ88e/TbR=
6Ed23k+rnRa7fnloMXdfMVvRIPc79AUCKlQJQRwd7SYsnBg=3D=3D
ARC-Message-Signature: i=3D1; a=3Drsa-sha256; c=3Drelaxed/relaxed; d=3Dmicr=
osoft.com;
 s=3Darcselector9901;
 h=3DFrom:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-A=
ntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Ex=
change-AntiSpam-MessageData-1;
 bh=3D+gtM3aws/J7DGww/fiE2zyk8zSO9fRdE5RKCPXeJLYU=3D;
 b=3DfKErDV9Qo/hxDERirjr5dkpAamshZp5MPYNFlovQxlcMfkBGyupl/a08tStdnCThXM/xFR=
DF8ywrPr1DNsv1TGa/r8iLUTusAWGea4BZbdiEPNylhrCYXWbhy3OI2dY10lhLiLfp8AZDbdJLy=
7o58QRSte4exhjJxOprqyh4PhNbmPsBFBVlBiHlR46zhcAR9VmGAMnPpJ1BChAm9+xjTIKU3XVT=
q0+F2QG1oD2d+ERY1O/Az6W0lp5wF56xaLjlO8GuOQz73unKKGnmK6FzX/Jm30FkRYLrBUVHLmF=
qGV86WCr7lrFkIxDckebsrZOVBzjVo/9qmO8OvfBqzvMnxg=3D=3D
ARC-Authentication-Results: i=3D1; mx.microsoft.com 1; spf=3Dpass (sender i=
p is
 199.188.200.108) smtp.rcpttodomain=3Dcalgaryzoo.com
 smtp.mailfrom=3Debaarchitects.org; dmarc=3Dbestguesspass action=3Dnone
 header.from=3Debaarchitects.org; dkim=3Dpass (signature was verified)
 header.d=3Debaarchitects.org; arc=3Dnone (0)
Received: from YQXP288CA0019.CANP288.PROD.OUTLOOK.COM (2603:10b6:c00:41::47=
)
 by YQBPR0101MB8462.CANPRD01.PROD.OUTLOOK.COM (2603:10b6:c01:55::7) with
 Microsoft SMTP Server (version=3DTLS1_2,
 cipher=3DTLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.7091.26; Tue, 12 =
Dec
 2023 22:24:53 +0000
Received: from YQBCAN01FT023.eop-CAN01.prod.protection.outlook.com
 (2603:10b6:c00:41:cafe::fe) by YQXP288CA0019.outlook.office365.com
 (2603:10b6:c00:41::47) with Microsoft SMTP Server (version=3DTLS1_2,
 cipher=3DTLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.7068.36 via Front=
end
 Transport; Tue, 12 Dec 2023 22:24:53 +0000
Authentication-Results: spf=3Dpass (sender IP is 199.188.200.108)
 smtp.mailfrom=3Debaarchitects.org; dkim=3Dpass (signature was verified)
 header.d=3Debaarchitects.org;dmarc=3Dbestguesspass action=3Dnone
 header.from=3Debaarchitects.org;compauth=3Dpass reason=3D109
Received-SPF: Pass (protection.outlook.com: domain of ebaarchitects.org
 designates 199.188.200.108 as permitted sender)
 receiver=3Dprotection.outlook.com; client-ip=3D199.188.200.108;
 helo=3Dserver237-2.web-hosting.com; pr=3DC
Received: from server237-2.web-hosting.com (199.188.200.108) by
 YQBCAN01FT023.mail.protection.outlook.com (10.118.138.81) with Microsoft S=
MTP
 Server (version=3DTLS1_2, cipher=3DTLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) =
id
 15.20.7091.26 via Frontend Transport; Tue, 12 Dec 2023 22:24:53 +0000
DKIM-Signature: v=3D1; a=3Drsa-sha256; q=3Ddns/txt; c=3Drelaxed/relaxed;
	d=3Debaarchitects.org; s=3Ddefault; h=3DContent-Type:MIME-Version:Date:Sub=
ject:To:
	From:Reply-To:Message-ID:Sender:Cc:Content-Transfer-Encoding:Content-ID:
	Content-Description:Resent-Date:Resent-From:Resent-Sender:Resent-To:Resent=
-Cc
	:Resent-Message-ID:In-Reply-To:References:List-Id:List-Help:List-Unsubscri=
be:
	List-Subscribe:List-Post:List-Owner:List-Archive;
	bh=3Da+WgQb5Yvw9TxcLjZItnblDsmdJ8AncaUJBY9gJ2+Sg=3D; b=3DYzy88u5YFAj6M4oJe=
S3vkmC2Xq
	CiXcf0HjHgGb9wGuTfdjx6H1y8HHbBBo5UX+FDl/a1XxwJPGukno96AwL8ApANWIwM8wdpw4G/=
0Hz
	SwvO0hnDb1fJfwjw8wVQM3hGt36o+D3VZaBuqdUnS+Yllx/DofZR7e4jNK3TBPF0vX7/CQWRKU=
4Xl
	xa7YC5gs2P+MhWH3InPf9QSZdyzMMpqFc6CdLcqDV4nmHbiql4WPSfDuyCnInpeFlH65omnTZD=
i3/
	FNM8ep+zAz51zIf0k5PjvOjXKDAhcgjt3IrRyec4Mx4i6MaKxtNxH1bEpx8Td60tMYlFrWHpJt=
aSM
	NWvoRRQw=3D=3D;
Received: from [14.224.175.203] (port=3D36976 helo=3D85.206.160.225)
	by server237.web-hosting.com with esmtpsa  (TLS1.2) tls TLS_ECDHE_RSA_WITH=
_AES_256_GCM_SHA384
	(Exim 4.96.1)
	(envelope-from &lt;dev@ebaarchitects.org&gt;)
	id 1rDBB7-00CL3d-30
	for dawnh@calgaryzoo.com;
	Tue, 12 Dec 2023 17:24:51 -0500
Message-ID: &lt;047f8205f1357ef3d07f76dd29edd68dae1c5b9f32@ebaarchitects.or=
g&gt;
Reply-To: Oliver &lt;oliver.f@mythenesa.com&gt;
From: Oliver &lt;dev@ebaarchitects.org&gt;
To: dawnh@calgaryzoo.com
Subject: Querying a unusual transaction on your website - requesting your a=
ssistance
Date: Tue, 12 Dec 2023 14:19:18 -0800
MIME-Version: 1.0
Content-Type: multipart/alternative; boundary=3D&quot;8b2168a2d0143b7053f9b=
00aae6a58ade390&quot;
X-AntiAbuse: This header was added to track abuse, please include it with a=
ny abuse report
X-AntiAbuse: Primary Hostname - server237.web-hosting.com
X-AntiAbuse: Original Domain - calgaryzoo.com
X-AntiAbuse: Originator/Caller UID/GID - [47 12] / [47 12]
X-AntiAbuse: Sender Address Domain - ebaarchitects.org
X-Get-Message-Sender-Via: server237.web-hosting.com: authenticated_id: dev@=
ebaarchitects.org
X-Authenticated-Sender: server237.web-hosting.com: dev@ebaarchitects.org
X-Source:
X-Source-Args:
X-Source-Dir:
X-From-Rewrite: unmodified, already matched
Return-Path: dev@ebaarchitects.org
X-EOPAttributedMessage: 0
X-EOPTenantAttributedMessage: 134669ba-ae42-4cf0-a3b3-ae4791deca92:0
X-MS-PublicTrafficType: Email
X-MS-TrafficTypeDiagnostic:
	YQBCAN01FT023:EE_|YQBPR0101MB8462:EE_|YT1PR01MB8252:EE_|YT3PR01MB8147:EE_
X-MS-Office365-Filtering-Correlation-Id: 83cb80d8-375d-4508-e4de-08dbfb6129=
af
X-MS-Exchange-AtpMessageProperties: SA|SL
X-Microsoft-Antispam: BCL:0;
X-Microsoft-Antispam-Message-Info: =3D?utf-8?B?cC9kRHFVeWV3TFkvZWszMVhKK1hP=
Q25sTWJLTDZCSy9zYXErMG9jNzNweGdn?=3D
 =3D?utf-8?B?c1pzMWpnUE5IdWs1YXNGeXZIM1RmZ3FJU21vSldRdTIyMTFjbk1hZXJHQzhW?=
=3D
 =3D?utf-8?B?VVRqYnZvbG5NZXBqT2NTOUJyS01rUEFWeXhYQkEwT1orMUxRZEpRZ0ErM3li?=
=3D
 =3D?utf-8?B?c2IrUlprM3NITEttaldIallEOEVlZnhvMUIyK1h1Q3VLY0lXdWZIODR2ZFI0?=
=3D
 =3D?utf-8?B?ZVVpWGxxUmo3QzVvU0RhSDNpamY5MUlXbE94ZnZIRm5BaTYwL1pTNmtrVjYy?=
=3D
 =3D?utf-8?B?aWxGeWE0RlZXMjJWV1d0c0VicFZMOWZoc0tZbnR2anJlQjEzeTY4eDdaVTJa?=
=3D
 =3D?utf-8?B?VTZWak4ra1RyeTJaRDQvclg1TE1nVFdHWncvcTZjUGI2ejNFdnRFNWMyTTl2?=
=3D
 =3D?utf-8?B?RHZoNFVoSlRlandjZWdFcGxxRXBNbFFhMG9FNVpWWnZmZWtxdklyYmltdHUz?=
=3D
 =3D?utf-8?B?MVNzZVlDY2RhY0NzZGlmUTdZbGVWUXRBanFnYzZaakY1R1JBMWZCVnQ2eDE5?=
=3D
 =3D?utf-8?B?aHdOZVBzVkgzZFVIZ1RPYVdYMmZaaUtjaXEzTlp1SzE2c1NBKzJnUEZGVWFz?=
=3D
 =3D?utf-8?B?Z1lDOVRFMDU3SW9vZmhlOGgyMFNiZVlHVkEvS0hTR1l0NERmaENKc2l1V0xV?=
=3D
 =3D?utf-8?B?Z2FFcWNOeDdUZ1BpWDVBR09PWXRJUG1LSjgwWHJBcXl3Y0ErbExwSzZ5K0hF?=
=3D
 =3D?utf-8?B?WUNRdUJQazRIY2s4eWdqb1VTeFlyWDZKODkxNXFFbzh0cVEvVGF6M0ZkNzFl?=
=3D
 =3D?utf-8?B?V0RieTgzQ0ljUCs0TGw4M0VxNzRkZ2t6RzJHWjVOOCtIcEh2SE1LbnZhcWQ0?=
=3D
 =3D?utf-8?B?UUwxaVhYNXBQMzdWQ0lVMnBhMURXU3NQZXNJMXdWTFhwYWVKREJ4S2t1TjNn?=
=3D
 =3D?utf-8?B?OHhzbEx3cWhzek1HcmNkaE03RW1CZ3RsdzFSeG4vdGQxSVR1cTRlME9mZVl6?=
=3D
 =3D?utf-8?B?VGEyc3BheXFuL0VXbjlHa21sOUlHNTh3WWE3UUVrcE1QNk1aTzVSYVRQRkdr?=
=3D
 =3D?utf-8?B?dmlOb2t0MHFVVGVtMVdRcTU5cFB3RGJ1SysrWVNxSDFRNlQweDRJbVZYWVhr?=
=3D
 =3D?utf-8?B?cjdHTFNNWHEzVldITGdtVVpiMFg1MGtWN1pCeHI1Ty9JcHQwQW5nOGYxNlFB?=
=3D
 =3D?utf-8?B?Y3poVEdKQlJFVnE1NWdGRmNRbUZnQ2JIa0pvWE43SDBpL0VQK2hpZHF5TnVu?=
=3D
 =3D?utf-8?B?TE9FZFZXM21hM0pZVC9lNjY0YTZLeUpLS3VVbSt2YkZDWFZXRDB6TGxTZWEv?=
=3D
 =3D?utf-8?B?ZzBMTi9UYjNoSHUrMzJrZTZtb2tDOG9yVTF4eXFPMzNaVHlJaU8wMWpDakda?=
=3D
 =3D?utf-8?B?YzVwRDhmUnRIY0t1eGNOYW14TTF1eHY1YWE0d0JSRmprWG5nTlJ0MzFHdmxR?=
=3D
 =3D?utf-8?B?dmJCK0VpWld3czBLMDQzT2JhY1Q1NDAzOTEyMG9FckljUGh1S2lTcjFPbCsy?=
=3D
 =3D?utf-8?B?cUliZDZQbUJ4UGpKUHpRUGVmMThYSElXS1BJcEZ4TXpPNDZ2aXV4OEgyWC9m?=
=3D
 =3D?utf-8?B?eHdPT25HbnZIVE1hVWpFd0tyNlB5NUlheEZLTG01OUdoOStBT2R1aExrQ3Fl?=
=3D
 =3D?utf-8?B?VkJWOEpCUm5lTEhIbk16SE96K1YrVjBWVjczOXhtRU5QYllhTDdLUXVqRktD?=
=3D
 =3D?utf-8?B?YUlURHd4TTRqcnRXMUVGYkhvOVJyR29icFBHdGprdkw1RnNUWjBkeFZNWi9x?=
=3D
 =3D?utf-8?B?N1crNTVpbGNNb21vOUJOdzVYRkg4MzE0aElNVy9mRUJndXZONlpNYzR3MzVO?=
=3D
 =3D?utf-8?B?aVYvajlaK2lhS25vL21wa0NKOWtGMEd3UUpianVaU2JNK3RURnBNeWY5N1FQ?=
=3D
 =3D?utf-8?B?b09XTytNZGhyeXNMWjBWMkQ3cW1MclhkK3NhTzBmdmc4dVhMOHFoaUd6K0d0?=
=3D
 =3D?utf-8?B?N3grc0RsK01GMWVWMEc5VE9iYnRCWDlOSjVTRzMvYWtoNHlNZm9QeFhUOXJx?=
=3D
 =3D?utf-8?B?NWN0SUw2R3RyM3dNM2x6KzdWd09PaEdmQktvbkRVaUkvYzEzQ2xoajBKNE9W?=
=3D
 =3D?utf-8?B?MFUrUE5UejhvdDZLUjdUVEVOeTBrYmMvRlhMNitsYlkrNnJVQVdKMWNoVExG?=
=3D
 =3D?utf-8?B?QUlEWnBYQUcvSEtKalRxKzdyNGJYSCt3aFRPMUtSM0NLZXhObURzdGFwNklp?=
=3D
 =3D?utf-8?B?ZE44dHNpeWM0bGRObHdMNkR3UWVMbjZaTC8zYm1KK0VaeXMxbzFaYUFWdVl5?=
=3D
 =3D?utf-8?B?OEkzM1E0M2ZTRmgyTE5YUm5wMkVMRkdrVWFhcmV5YjFGUGZSWXVZSDNvT0FS?=
=3D
 =3D?utf-8?B?YUpTaDJnMG5ONlQ1NWtPWWlQZ09sQXhiNXF4M1ZYS1FBVGpWWkpwbUFPREZP?=
=3D
 =3D?utf-8?B?N0g1NlN5dlJBMHFTNXFZU1FKY2daK2pxdUJJSHJRRmF4Y3p1YXBucXk3OVBX?=
=3D
 =3D?utf-8?B?dkl4c1dMdXUxR2pYR2MvNWhmQldHL0g1VGozTG1TVzl6YURlVi8rK0ZmUjl4?=
=3D
 =3D?utf-8?B?eUNadWRFMDJYZEZ6d2FhQWovU0JWSzh6UUVuRUFobllkcUx2QktVZlpTakdi?=
=3D
 =3D?utf-8?Q?EZcINIRCBit?=3D
X-Forefront-Antispam-Report: CIP:199.188.200.108;CTRY:US;LANG:en;SCL:1;SRV:=
;IPV:NLI;SFV:NSPM;H:server237-2.web-hosting.com;PTR:server237-2.web-hosting=
.com;CAT:NONE;SFS:(13230031)(4636009)(230273577357003)(230173577357003)(451=
199024)(86362001)(36756003)(6916009)(7636003)(7596003)(356005)(33964004)(95=
6004)(2616005)(6666004)(120186005)(26005)(6966003)(83380400001)(336012)(347=
56004)(9786002)(5660300002)(8676002)(1096003)(17983001)(141083003)(93036002=
)(6106002);DIR:INB;
X-MS-Exchange-CrossTenant-OriginalArrivalTime: 12 Dec 2023 22:24:53.0662
 (UTC)
X-MS-Exchange-CrossTenant-Network-Message-Id: 83cb80d8-375d-4508-e4de-08dbf=
b6129af
X-MS-Exchange-CrossTenant-Id: 134669ba-ae42-4cf0-a3b3-ae4791deca92
X-MS-Exchange-CrossTenant-AuthSource: YQBCAN01FT023.eop-CAN01.prod.protecti=
on.outlook.com
X-MS-Exchange-CrossTenant-AuthAs: Anonymous
X-MS-Exchange-CrossTenant-FromEntityHeader: Internet
X-MS-Exchange-Transport-CrossTenantHeadersStamped: YQBPR0101MB8462
X-OrganizationHeadersPreserved: YQBPR0101MB8462.CANPRD01.PROD.OUTLOOK.COM
X-OriginatorOrg: calgaryzoo.com
X-CrossPremisesHeadersFilteredByDsnGenerator:
	YT3PR01MB8147.CANPRD01.PROD.OUTLOOK.COM
</pre>
</font>
</body>
</html>=

--3152135f-4828-4245-8114-eb25a74c2c93--

--79cc58c2-00ee-48fa-870c-33821cf0b3fe
Content-Type: message/delivery-status

Reporting-MTA: dns;YT3PR01MB8147.CANPRD01.PROD.OUTLOOK.COM
Received-From-MTA: dns;YT1PR01MB8252.CANPRD01.PROD.OUTLOOK.COM
Arrival-Date: Wed, 13 Dec 2023 20:38:56 +0000

Final-Recipient: rfc822;dawnh@calgaryzoo.com
Action: failed
Status: 5.4.317
Diagnostic-Code: smtp;550 5.4.317 Message expired, cannot connect to remote server

--79cc58c2-00ee-48fa-870c-33821cf0b3fe
Content-Type: message/rfc822

Received: from YT1PR01MB8252.CANPRD01.PROD.OUTLOOK.COM (2603:10b6:b01:c3::22)
 by YT3PR01MB8147.CANPRD01.PROD.OUTLOOK.COM (2603:10b6:b01:9c::20) with
 Microsoft SMTP Server (version=TLS1_2,
 cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.7091.26; Wed, 13 Dec
 2023 20:38:56 +0000
Received: from YQBPR0101MB8462.CANPRD01.PROD.OUTLOOK.COM (2603:10b6:c01:55::7)
 by YT1PR01MB8252.CANPRD01.PROD.OUTLOOK.COM (2603:10b6:b01:c3::22) with
 Microsoft SMTP Server (version=TLS1_2,
 cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.7091.26; Wed, 13 Dec
 2023 09:34:31 +0000
ARC-Seal: i=1; a=rsa-sha256; s=arcselector9901; d=microsoft.com; cv=none;
 b=LoJvkvfSf8PqTqI8SPl6yeD2FogziKucKL7+fYO/czneRxUhNJ0as0uGIPeV39783GVbcUpwJgwbi9VmP/EuP4POXtVHusq7QpJVkAu94rhWFKLprF43ZkZSyvFxjn+ZWprc1r8ENw2g44fyjYmDFSVH/lEYMN2VPxqH5KCrLjZdokTxz1avsBNvc4WFaNNWRKPxBEj0n9CKOwVOJDm7VRfPAE+x98CL3gSKqU/RztQtDx1r/VbntZT0f8zvrHuMctLTwhevTJazKDBnnIGqPj9PfFygeCUZ88e/TbR6Ed23k+rnRa7fnloMXdfMVvRIPc79AUCKlQJQRwd7SYsnBg==
ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com;
 s=arcselector9901;
 h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1;
 bh=+gtM3aws/J7DGww/fiE2zyk8zSO9fRdE5RKCPXeJLYU=;
 b=fKErDV9Qo/hxDERirjr5dkpAamshZp5MPYNFlovQxlcMfkBGyupl/a08tStdnCThXM/xFRDF8ywrPr1DNsv1TGa/r8iLUTusAWGea4BZbdiEPNylhrCYXWbhy3OI2dY10lhLiLfp8AZDbdJLy7o58QRSte4exhjJxOprqyh4PhNbmPsBFBVlBiHlR46zhcAR9VmGAMnPpJ1BChAm9+xjTIKU3XVTq0+F2QG1oD2d+ERY1O/Az6W0lp5wF56xaLjlO8GuOQz73unKKGnmK6FzX/Jm30FkRYLrBUVHLmFqGV86WCr7lrFkIxDckebsrZOVBzjVo/9qmO8OvfBqzvMnxg==
ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass (sender ip is
 199.188.200.108) smtp.rcpttodomain=calgaryzoo.com
 smtp.mailfrom=ebaarchitects.org; dmarc=bestguesspass action=none
 header.from=ebaarchitects.org; dkim=pass (signature was verified)
 header.d=ebaarchitects.org; arc=none (0)
Received: from YQXP288CA0019.CANP288.PROD.OUTLOOK.COM (2603:10b6:c00:41::47)
 by YQBPR0101MB8462.CANPRD01.PROD.OUTLOOK.COM (2603:10b6:c01:55::7) with
 Microsoft SMTP Server (version=TLS1_2,
 cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.7091.26; Tue, 12 Dec
 2023 22:24:53 +0000
Received: from YQBCAN01FT023.eop-CAN01.prod.protection.outlook.com
 (2603:10b6:c00:41:cafe::fe) by YQXP288CA0019.outlook.office365.com
 (2603:10b6:c00:41::47) with Microsoft SMTP Server (version=TLS1_2,
 cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.7068.36 via Frontend
 Transport; Tue, 12 Dec 2023 22:24:53 +0000
Authentication-Results: spf=pass (sender IP is 199.188.200.108)
 smtp.mailfrom=ebaarchitects.org; dkim=pass (signature was verified)
 header.d=ebaarchitects.org;dmarc=bestguesspass action=none
 header.from=ebaarchitects.org;compauth=pass reason=109
Received-SPF: Pass (protection.outlook.com: domain of ebaarchitects.org
 designates 199.188.200.108 as permitted sender)
 receiver=protection.outlook.com; client-ip=199.188.200.108;
 helo=server237-2.web-hosting.com; pr=C
Received: from server237-2.web-hosting.com (199.188.200.108) by
 YQBCAN01FT023.mail.protection.outlook.com (10.118.138.81) with Microsoft SMTP
 Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id
 15.20.7091.26 via Frontend Transport; Tue, 12 Dec 2023 22:24:53 +0000
DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed;
	d=ebaarchitects.org; s=default; h=Content-Type:MIME-Version:Date:Subject:To:
	From:Reply-To:Message-ID:Sender:Cc:Content-Transfer-Encoding:Content-ID:
	Content-Description:Resent-Date:Resent-From:Resent-Sender:Resent-To:Resent-Cc
	:Resent-Message-ID:In-Reply-To:References:List-Id:List-Help:List-Unsubscribe:
	List-Subscribe:List-Post:List-Owner:List-Archive;
	bh=a+WgQb5Yvw9TxcLjZItnblDsmdJ8AncaUJBY9gJ2+Sg=; b=Yzy88u5YFAj6M4oJeS3vkmC2Xq
	CiXcf0HjHgGb9wGuTfdjx6H1y8HHbBBo5UX+FDl/a1XxwJPGukno96AwL8ApANWIwM8wdpw4G/0Hz
	SwvO0hnDb1fJfwjw8wVQM3hGt36o+D3VZaBuqdUnS+Yllx/DofZR7e4jNK3TBPF0vX7/CQWRKU4Xl
	xa7YC5gs2P+MhWH3InPf9QSZdyzMMpqFc6CdLcqDV4nmHbiql4WPSfDuyCnInpeFlH65omnTZDi3/
	FNM8ep+zAz51zIf0k5PjvOjXKDAhcgjt3IrRyec4Mx4i6MaKxtNxH1bEpx8Td60tMYlFrWHpJtaSM
	NWvoRRQw==;
Received: from [14.224.175.203] (port=36976 helo=85.206.160.225)
	by server237.web-hosting.com with esmtpsa  (TLS1.2) tls TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384
	(Exim 4.96.1)
	(envelope-from <dev@ebaarchitects.org>)
	id 1rDBB7-00CL3d-30
	for dawnh@calgaryzoo.com;
	Tue, 12 Dec 2023 17:24:51 -0500
Message-ID: <047f8205f1357ef3d07f76dd29edd68dae1c5b9f32@ebaarchitects.org>
Reply-To: Oliver <oliver.f@mythenesa.com>
From: Oliver <dev@ebaarchitects.org>
To: dawnh@calgaryzoo.com
Subject: Querying a unusual transaction on your website - requesting your assistance
Date: Tue, 12 Dec 2023 14:19:18 -0800
MIME-Version: 1.0
Content-Type: multipart/alternative; boundary="8b2168a2d0143b7053f9b00aae6a58ade390"
X-AntiAbuse: This header was added to track abuse, please include it with any abuse report
X-AntiAbuse: Primary Hostname - server237.web-hosting.com
X-AntiAbuse: Original Domain - calgaryzoo.com
X-AntiAbuse: Originator/Caller UID/GID - [47 12] / [47 12]
X-AntiAbuse: Sender Address Domain - ebaarchitects.org
X-Get-Message-Sender-Via: server237.web-hosting.com: authenticated_id: dev@ebaarchitects.org
X-Authenticated-Sender: server237.web-hosting.com: dev@ebaarchitects.org
X-Source:
X-Source-Args:
X-Source-Dir:
X-From-Rewrite: unmodified, already matched
Return-Path: dev@ebaarchitects.org
X-EOPAttributedMessage: 0
X-EOPTenantAttributedMessage: 134669ba-ae42-4cf0-a3b3-ae4791deca92:0
X-MS-PublicTrafficType: Email
X-MS-TrafficTypeDiagnostic:
 YQBCAN01FT023:EE_|YQBPR0101MB8462:EE_|YT1PR01MB8252:EE_|YT3PR01MB8147:EE_
X-MS-Office365-Filtering-Correlation-Id: 83cb80d8-375d-4508-e4de-08dbfb6129af
X-MS-Exchange-AtpMessageProperties: SA|SL
X-Microsoft-Antispam: BCL:0;
X-Microsoft-Antispam-Message-Info: =?utf-8?B?cC9kRHFVeWV3TFkvZWszMVhKK1hPQ25sTWJLTDZCSy9zYXErMG9jNzNweGdn?=
 =?utf-8?B?c1pzMWpnUE5IdWs1YXNGeXZIM1RmZ3FJU21vSldRdTIyMTFjbk1hZXJHQzhW?=
 =?utf-8?B?VVRqYnZvbG5NZXBqT2NTOUJyS01rUEFWeXhYQkEwT1orMUxRZEpRZ0ErM3li?=
 =?utf-8?B?c2IrUlprM3NITEttaldIallEOEVlZnhvMUIyK1h1Q3VLY0lXdWZIODR2ZFI0?=
 =?utf-8?B?ZVVpWGxxUmo3QzVvU0RhSDNpamY5MUlXbE94ZnZIRm5BaTYwL1pTNmtrVjYy?=
 =?utf-8?B?aWxGeWE0RlZXMjJWV1d0c0VicFZMOWZoc0tZbnR2anJlQjEzeTY4eDdaVTJa?=
 =?utf-8?B?VTZWak4ra1RyeTJaRDQvclg1TE1nVFdHWncvcTZjUGI2ejNFdnRFNWMyTTl2?=
 =?utf-8?B?RHZoNFVoSlRlandjZWdFcGxxRXBNbFFhMG9FNVpWWnZmZWtxdklyYmltdHUz?=
 =?utf-8?B?MVNzZVlDY2RhY0NzZGlmUTdZbGVWUXRBanFnYzZaakY1R1JBMWZCVnQ2eDE5?=
 =?utf-8?B?aHdOZVBzVkgzZFVIZ1RPYVdYMmZaaUtjaXEzTlp1SzE2c1NBKzJnUEZGVWFz?=
 =?utf-8?B?Z1lDOVRFMDU3SW9vZmhlOGgyMFNiZVlHVkEvS0hTR1l0NERmaENKc2l1V0xV?=
 =?utf-8?B?Z2FFcWNOeDdUZ1BpWDVBR09PWXRJUG1LSjgwWHJBcXl3Y0ErbExwSzZ5K0hF?=
 =?utf-8?B?WUNRdUJQazRIY2s4eWdqb1VTeFlyWDZKODkxNXFFbzh0cVEvVGF6M0ZkNzFl?=
 =?utf-8?B?V0RieTgzQ0ljUCs0TGw4M0VxNzRkZ2t6RzJHWjVOOCtIcEh2SE1LbnZhcWQ0?=
 =?utf-8?B?UUwxaVhYNXBQMzdWQ0lVMnBhMURXU3NQZXNJMXdWTFhwYWVKREJ4S2t1TjNn?=
 =?utf-8?B?OHhzbEx3cWhzek1HcmNkaE03RW1CZ3RsdzFSeG4vdGQxSVR1cTRlME9mZVl6?=
 =?utf-8?B?VGEyc3BheXFuL0VXbjlHa21sOUlHNTh3WWE3UUVrcE1QNk1aTzVSYVRQRkdr?=
 =?utf-8?B?dmlOb2t0MHFVVGVtMVdRcTU5cFB3RGJ1SysrWVNxSDFRNlQweDRJbVZYWVhr?=
 =?utf-8?B?cjdHTFNNWHEzVldITGdtVVpiMFg1MGtWN1pCeHI1Ty9JcHQwQW5nOGYxNlFB?=
 =?utf-8?B?Y3poVEdKQlJFVnE1NWdGRmNRbUZnQ2JIa0pvWE43SDBpL0VQK2hpZHF5TnVu?=
 =?utf-8?B?TE9FZFZXM21hM0pZVC9lNjY0YTZLeUpLS3VVbSt2YkZDWFZXRDB6TGxTZWEv?=
 =?utf-8?B?ZzBMTi9UYjNoSHUrMzJrZTZtb2tDOG9yVTF4eXFPMzNaVHlJaU8wMWpDakda?=
 =?utf-8?B?YzVwRDhmUnRIY0t1eGNOYW14TTF1eHY1YWE0d0JSRmprWG5nTlJ0MzFHdmxR?=
 =?utf-8?B?dmJCK0VpWld3czBLMDQzT2JhY1Q1NDAzOTEyMG9FckljUGh1S2lTcjFPbCsy?=
 =?utf-8?B?cUliZDZQbUJ4UGpKUHpRUGVmMThYSElXS1BJcEZ4TXpPNDZ2aXV4OEgyWC9m?=
 =?utf-8?B?eHdPT25HbnZIVE1hVWpFd0tyNlB5NUlheEZLTG01OUdoOStBT2R1aExrQ3Fl?=
 =?utf-8?B?VkJWOEpCUm5lTEhIbk16SE96K1YrVjBWVjczOXhtRU5QYllhTDdLUXVqRktD?=
 =?utf-8?B?YUlURHd4TTRqcnRXMUVGYkhvOVJyR29icFBHdGprdkw1RnNUWjBkeFZNWi9x?=
 =?utf-8?B?N1crNTVpbGNNb21vOUJOdzVYRkg4MzE0aElNVy9mRUJndXZONlpNYzR3MzVO?=
 =?utf-8?B?aVYvajlaK2lhS25vL21wa0NKOWtGMEd3UUpianVaU2JNK3RURnBNeWY5N1FQ?=
 =?utf-8?B?b09XTytNZGhyeXNMWjBWMkQ3cW1MclhkK3NhTzBmdmc4dVhMOHFoaUd6K0d0?=
 =?utf-8?B?N3grc0RsK01GMWVWMEc5VE9iYnRCWDlOSjVTRzMvYWtoNHlNZm9QeFhUOXJx?=
 =?utf-8?B?NWN0SUw2R3RyM3dNM2x6KzdWd09PaEdmQktvbkRVaUkvYzEzQ2xoajBKNE9W?=
 =?utf-8?B?MFUrUE5UejhvdDZLUjdUVEVOeTBrYmMvRlhMNitsYlkrNnJVQVdKMWNoVExG?=
 =?utf-8?B?QUlEWnBYQUcvSEtKalRxKzdyNGJYSCt3aFRPMUtSM0NLZXhObURzdGFwNklp?=
 =?utf-8?B?ZE44dHNpeWM0bGRObHdMNkR3UWVMbjZaTC8zYm1KK0VaeXMxbzFaYUFWdVl5?=
 =?utf-8?B?OEkzM1E0M2ZTRmgyTE5YUm5wMkVMRkdrVWFhcmV5YjFGUGZSWXVZSDNvT0FS?=
 =?utf-8?B?YUpTaDJnMG5ONlQ1NWtPWWlQZ09sQXhiNXF4M1ZYS1FBVGpWWkpwbUFPREZP?=
 =?utf-8?B?N0g1NlN5dlJBMHFTNXFZU1FKY2daK2pxdUJJSHJRRmF4Y3p1YXBucXk3OVBX?=
 =?utf-8?B?dkl4c1dMdXUxR2pYR2MvNWhmQldHL0g1VGozTG1TVzl6YURlVi8rK0ZmUjl4?=
 =?utf-8?B?eUNadWRFMDJYZEZ6d2FhQWovU0JWSzh6UUVuRUFobllkcUx2QktVZlpTakdi?=
 =?utf-8?Q?EZcINIRCBit?=
X-Forefront-Antispam-Report: CIP:199.188.200.108;CTRY:US;LANG:en;SCL:1;SRV:;IPV:NLI;SFV:NSPM;H:server237-2.web-hosting.com;PTR:server237-2.web-hosting.com;CAT:NONE;SFS:(13230031)(4636009)(230273577357003)(230173577357003)(451199024)(86362001)(36756003)(6916009)(7636003)(7596003)(356005)(33964004)(956004)(2616005)(6666004)(120186005)(26005)(6966003)(83380400001)(336012)(34756004)(9786002)(5660300002)(8676002)(1096003)(17983001)(141083003)(93036002)(6106002);DIR:INB;
X-MS-Exchange-CrossTenant-OriginalArrivalTime: 12 Dec 2023 22:24:53.0662
 (UTC)
X-MS-Exchange-CrossTenant-Network-Message-Id: 83cb80d8-375d-4508-e4de-08dbfb6129af
X-MS-Exchange-CrossTenant-Id: 134669ba-ae42-4cf0-a3b3-ae4791deca92
X-MS-Exchange-CrossTenant-AuthSource: YQBCAN01FT023.eop-CAN01.prod.protection.outlook.com
X-MS-Exchange-CrossTenant-AuthAs: Anonymous
X-MS-Exchange-CrossTenant-FromEntityHeader: Internet
X-MS-Exchange-Transport-CrossTenantHeadersStamped: YQBPR0101MB8462
X-OrganizationHeadersPreserved: YQBPR0101MB8462.CANPRD01.PROD.OUTLOOK.COM
X-OriginatorOrg: calgaryzoo.com
X-CrossPremisesHeadersFilteredByDsnGenerator:
 YT3PR01MB8147.CANPRD01.PROD.OUTLOOK.COM

--8b2168a2d0143b7053f9b00aae6a58ade390
Content-Type: text/plain; charset="utf-8"
Content-Transfer-Encoding: quoted-printable

CAUTION: This email originated from outside of the organization. Do not cli=
ck links or open attachments unless you recognize the sender and know the c=
ontent is safe.

I am writing to you today because I have noticed an unrecognized payment ma=
de on my credit card, and it was made on your website. I am extremely conce=
rned about how my personal information may have been compromised.

I have never made a purchase on your website before, and I have already con=
tacted my bank and provided them with all the necessary documentation to pr=
ove that I did not make this payment.

Please help me investigate this matter by providing any relevant informatio=
n, such as the order number, that could help me identify the source of the =
problem.

Thank you for your attention to this matter.

--8b2168a2d0143b7053f9b00aae6a58ade390
Content-Type: text/html; charset="utf-8"
Content-Transfer-Encoding: quoted-printable

<html>
<head>
<meta http-equiv=3D"Content-Type" content=3D"text/html; charset=3Dutf-8">
</head>
<body bgcolor=3D"#ffffff">
<div id=3D"footer" style=3D"background-color: #ffeb9c; width: 100%; border:=
 1px solid #FFEB9C; padding: 2pt; border-style: solid; border-color: #9C650=
0;">
<b>CAUTION:</b> This email originated from outside of the organization. Do =
not click links or open attachments unless you recognize the sender and kno=
w the content is safe.</div>
<br>
<div>
<div><font size=3D"2" face=3D"Arial">I am writing to you today because I ha=
ve noticed an unrecognized payment made on my credit card, and it was made =
on your website. I am extremely concerned about how my personal information=
 may have been compromised.</font></div>
<div>&nbsp;</div>
<div><font size=3D"2" face=3D"Arial">I have never made a purchase on your w=
ebsite before, and I have already contacted my bank and provided them with =
all the necessary documentation to prove that I did not make this payment.<=
/font></div>
<div>&nbsp;</div>
<div><font size=3D"2" face=3D"Arial">Please help me investigate this matter=
 by providing any relevant information, such as the order number, that coul=
d help me identify the source of the problem.</font></div>
<div>&nbsp;</div>
<div><font size=3D"2" face=3D"Arial">Thank you for your attention to this m=
atter.<br>
</font></div>
<div align=3D"left"><font size=3D"2" face=3D"Arial"></font></div>
</div>
</body>
</html>

--8b2168a2d0143b7053f9b00aae6a58ade390--

--79cc58c2-00ee-48fa-870c-33821cf0b3fe--