Alta quantidade de e-mails contendo spam recebidos diariamente - ccTLD ".fi" e/ou ".FI".

Prezados,

Peço, desde logo, desculpas pelas imprecisões terminológicas decorrentes do conhecimento limitado em TI.

Há alguns meses venho recebendo, diariamente, inúmeras mensagens de e-mail com conteúdo de spam inequívoco, cujos domínios dos remetentes, indicados em "from", "smtp.mailfrom" e "return-path", são formados por sequências alfanuméricas múltiplas e que nunca se repetem, mas têm em comum, sempre, as terminações ".fi" e/ou ".FI".

Já tentei de várias formas evitar o recebimento desses e-mails indesejados, seja os relatando como tentativa de phishing, seja bloqueando todos os remetentes/domínios encontrados por meio da ferramenta de exibição da origem da mensagem, seja criando regras de e-mail, em nada, porém, obtendo êxito.

Assim, solicito ajuda da comunidade para a resolução do incidente.

Transcrevo a seguir, exemplificativamente, as informações obtidas por meio da ferramenta de exibição da origem de duas mensagens de e-mail com spam, nos exatos termos acima relatados, recebidas na data de hoje.

Exemplo 1:

Received: from ROAP284MB0672.BRAP284.PROD.OUTLOOK.COM (2603:10d6:10:37::11) by

CPYP284MB1064.BRAP284.PROD.OUTLOOK.COM with HTTPS; Wed, 17 Nov 2021 05:07:31

+0000

Received: from AM6PR08CA0033.eurprd08.prod.outlook.com (2603:10a6:20b:c0::21)

by ROAP284MB0672.BRAP284.PROD.OUTLOOK.COM (2603:10d6:10:37::11) with

Microsoft SMTP Server (version=TLS1_2,

cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.4713.19; Wed, 17 Nov

2021 05:07:29 +0000

Received: from AM6EUR05FT028.eop-eur05.prod.protection.outlook.com

(2603:10a6:20b:c0:cafe::2) by AM6PR08CA0033.outlook.office365.com

(2603:10a6:20b:c0::21) with Microsoft SMTP Server (version=TLS1_2,

cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.4713.19 via Frontend

Transport; Wed, 17 Nov 2021 05:07:29 +0000

Authentication-Results: spf=none (sender IP is 40.83.47.118)

smtp.mailfrom=eacXq**.fi**; dkim=none (message not signed)

header.d=none;dmarc=none action=none header.from=MVSEl.fi;compauth=fail

reason=001

Received-SPF: None (protection.outlook.com: eacXq.fi does not designate

permitted sender hosts)

Received: from 1oq176.merrell.pl (40.83.47.118) by

AM6EUR05FT028.mail.protection.outlook.com (10.233.240.253) with Microsoft

SMTP Server id 15.20.4690.19 via Frontend Transport; Wed, 17 Nov 2021

05:07:29 +0000

X-IncomingTopHeaderMarker:

OriginalChecksum:7C34FF9436BA7CCE1F95FC4BCD1461B9C23D3EE52657F1790AAF245E2845B83A;UpperCasedChecksum:8F61B6A25515764AA3296946E1B9DADD609C114CC49404A78E459327C247B6A4;SizeAsReceived:381;Count:11

From: Ｗａｌｍａｒｔ<MVSEl@MVSEl**.fi>**

Subject: Attn: Your Monthly 𝐖𝐚𝐥𝐦𝐚𝐫𝐭 Voucher Statement Has Arrived #12111611✔️💲

To: <"******@hotmail.com">

Content-Transfer-Encoding: 7bit

Content-Type: text/html; charset="UTF-8"

Date: Tue, 16 Nov 2021 12:50:46 +0000

drop_meta: 38518|110715

X-IncomingHeaderCount: 11

Message-ID:

<******@AM6EUR05FT028.eop-eur05.prod.protection.outlook.com>

Return-Path: eacXq@eacXq.fi

X-MS-Exchange-Organization-ExpirationStartTime: 17 Nov 2021 05:07:29.1576

(UTC)

X-MS-Exchange-Organization-ExpirationStartTimeReason: OriginalSubmit

X-MS-Exchange-Organization-ExpirationInterval: 1:00:00:00.0000000

X-MS-Exchange-Organization-ExpirationIntervalReason: OriginalSubmit

X-MS-Exchange-Organization-Network-Message-Id:

9af99ec4-aeb8-463c-8cca-08d9a988276a

X-EOPAttributedMessage: 0

X-EOPTenantAttributedMessage: 84df9e7f-e9f6-40af-b435-aaaaaaaaaaaa:0

X-MS-Exchange-Organization-MessageDirectionality: Incoming

X-MS-PublicTrafficType: Email

X-MS-Exchange-Organization-AuthSource:

AM6EUR05FT028.eop-eur05.prod.protection.outlook.com

X-MS-Exchange-Organization-AuthAs: Anonymous

X-MS-UserLastLogonTime: 11/17/2021 2:19:18 AM

X-MS-Office365-Filtering-Correlation-Id: 9af99ec4-aeb8-463c-8cca-08d9a988276a

X-MS-TrafficTypeDiagnostic: ROAP284MB0672:

X-MS-Exchange-EOPDirect: true

X-Sender-IP: 40.83.47.118

X-SID-PRA: MVSEL@MVSEL**.FI**

X-SID-Result: NONE

X-MS-Exchange-Organization-PCL: 2

X-MS-Exchange-AtpMessageProperties: SA|SL

X-MS-Exchange-Organization-SCL: 5

X-Microsoft-Antispam: BCL:0;

X-MS-Exchange-CrossTenant-OriginalArrivalTime: 17 Nov 2021 05:07:29.0507

(UTC)

X-MS-Exchange-CrossTenant-Network-Message-Id: 9af99ec4-aeb8-463c-8cca-08d9a988276a

X-MS-Exchange-CrossTenant-Id: 84df9e7f-e9f6-40af-b435-aaaaaaaaaaaa

X-MS-Exchange-CrossTenant-AuthSource:

AM6EUR05FT028.eop-eur05.prod.protection.outlook.com

X-MS-Exchange-CrossTenant-AuthAs: Anonymous

X-MS-Exchange-CrossTenant-FromEntityHeader: Internet

X-MS-Exchange-CrossTenant-RMS-PersistedConsumerOrg:

00000000-0000-0000-0000-000000000000

X-MS-Exchange-Transport-CrossTenantHeadersStamped: ROAP284MB0672

X-MS-Exchange-Transport-EndToEndLatency: 00:00:02.6281082

X-MS-Exchange-Processed-By-BccFoldering: 15.20.4713.019

Exemplo 2:

Received: from CP4P284MB1313.BRAP284.PROD.OUTLOOK.COM (2603:10d6:103:a5::7) by

ROAP284MB1069.BRAP284.PROD.OUTLOOK.COM with HTTPS; Wed, 17 Nov 2021 09:23:43

+0000

Received: from DB7PR05CA0030.eurprd05.prod.outlook.com (2603:10a6:10:36::43)

by CP4P284MB1313.BRAP284.PROD.OUTLOOK.COM (2603:10d6:103:a5::7) with

Microsoft SMTP Server (version=TLS1_2,

cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.4713.19; Wed, 17 Nov

2021 09:23:41 +0000

Received: from DB3EUR04FT059.eop-eur04.prod.protection.outlook.com

(2603:10a6:10:36:cafe::62) by DB7PR05CA0030.outlook.office365.com

(2603:10a6:10:36::43) with Microsoft SMTP Server (version=TLS1_2,

cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.4690.25 via Frontend

Transport; Wed, 17 Nov 2021 09:23:40 +0000

Authentication-Results: spf=none (sender IP is 20.205.105.192)

smtp.mailfrom=twZIC**.fi**; dkim=none (message not signed)

header.d=none;dmarc=none action=none header.from=PaM5j.fi;compauth=fail

reason=001

Received-SPF: None (protection.outlook.com: twZIC.fi does not designate

permitted sender hosts)

Received: from ddv18.merrell.pl (20.205.105.192) by

DB3EUR04FT059.mail.protection.outlook.com (10.152.24.234) with Microsoft SMTP

Server id 15.20.4713.19 via Frontend Transport; Wed, 17 Nov 2021 09:23:40

+0000

X-IncomingTopHeaderMarker:

OriginalChecksum:5E25B1E75B3AAB055A0AADB028D15E2BFFC9490C9DA226B03549E38CAF5C1ACB;UpperCasedChecksum:54EEDB1A2BDFCDE49FB6808F930B27C67619F8B4204E3547E97BB858C9A6E890;SizeAsReceived:388;Count:11

From: Bank of America<PaM5j@PaM5j**.fi**>

Subject: Attn: Your Monthly Bank of America Voucher Statement Has Arrived #66651668🎁

To: <"******@hotmail.com">

Content-Transfer-Encoding: 7bit

Content-Type: text/html; charset="UTF-8"

Date: Tue, 16 Nov 2021 13:29:31 +0000

drop_meta: 38552|113204

X-IncomingHeaderCount: 11

Message-ID:

<******@DB3EUR04FT059.eop-eur04.prod.protection.outlook.com>

Return-Path: twZIC@twZIC**.fi**

X-MS-Exchange-Organization-ExpirationStartTime: 17 Nov 2021 09:23:40.7858

(UTC)

X-MS-Exchange-Organization-ExpirationStartTimeReason: OriginalSubmit

X-MS-Exchange-Organization-ExpirationInterval: 1:00:00:00.0000000

X-MS-Exchange-Organization-ExpirationIntervalReason: OriginalSubmit

X-MS-Exchange-Organization-Network-Message-Id:

12fb3617-a548-4487-df7c-08d9a9abf19e

X-EOPAttributedMessage: 0

X-EOPTenantAttributedMessage: 84df9e7f-e9f6-40af-b435-aaaaaaaaaaaa:0

X-MS-Exchange-Organization-MessageDirectionality: Incoming

X-MS-PublicTrafficType: Email

X-MS-Exchange-Organization-AuthSource:

DB3EUR04FT059.eop-eur04.prod.protection.outlook.com

X-MS-Exchange-Organization-AuthAs: Anonymous

X-MS-UserLastLogonTime: 11/17/2021 2:19:18 AM

X-MS-Office365-Filtering-Correlation-Id: 12fb3617-a548-4487-df7c-08d9a9abf19e

X-MS-TrafficTypeDiagnostic: CP4P284MB1313:

X-MS-Exchange-EOPDirect: true

X-Sender-IP: 20.205.105.192

X-SID-PRA: PAM5J@PAM5J**.FI**

X-SID-Result: NONE

X-MS-Exchange-Organization-PCL: 2

X-MS-Exchange-AtpMessageProperties: SA|SL

X-MS-Exchange-Organization-SCL: 5

X-Microsoft-Antispam: BCL:0;

X-MS-Exchange-CrossTenant-OriginalArrivalTime: 17 Nov 2021 09:23:40.5749

(UTC)

X-MS-Exchange-CrossTenant-Network-Message-Id: 12fb3617-a548-4487-df7c-08d9a9abf19e

X-MS-Exchange-CrossTenant-Id: 84df9e7f-e9f6-40af-b435-aaaaaaaaaaaa

X-MS-Exchange-CrossTenant-AuthSource:

DB3EUR04FT059.eop-eur04.prod.protection.outlook.com

X-MS-Exchange-CrossTenant-AuthAs: Anonymous

X-MS-Exchange-CrossTenant-FromEntityHeader: Internet

X-MS-Exchange-CrossTenant-RMS-PersistedConsumerOrg:

00000000-0000-0000-0000-000000000000

X-MS-Exchange-Transport-CrossTenantHeadersStamped: CP4P284MB1313

X-MS-Exchange-Transport-EndToEndLatency: 00:00:02.8022943

X-MS-Exchange-Processed-By-BccFoldering: 15.20.4690.028

Grata,