May 02 2022 12:23 AM
May 02 2022 12:23 AM
I got this e-mail today and it was in my Junk folder so I thought it was phishing email. But once I opened it sender had microsoft.com in email as domain. After inspecting similar e-mails I noticed that the structure of this e-mail is nothing like when Outlook sends this e-mail.
My question is how the hell did the sender use @microsoft.com domain for his/hers email?
Here is the e-mail:
May 02 2022 02:10 AM
May 02 2022 02:17 AM - edited May 02 2022 02:19 AM
Can you confirm this is phishing e-mail?
Also for this particular e-mail there are flags ( '!' and 'flag icon') and I think Microsoft never sends those, at least it did not in e-mails I received before. Can you also confirm this?
I mean I'm 99% sure it was phishing, why the heck would Outlook send its own e-mail to Junk xd. But domain part is confusing to me and if it happened to me it may happen to others which could easily click on link sent in that e-mail..
May 02 2022 02:33 AM
May 02 2022 03:31 AM - edited May 02 2022 03:33 AM
May 02 2022 03:40 AM - edited May 02 2022 03:44 AM
Yeah I checked. There is nothing similar to information I got in that e-mail.
So now I am convinced that it is 100% phishing e-mail.
Could you maybe explain how did that e-mail used microsoft.com domain as sender?
This is really "scary" since it comes from Microsoft and you said that you have seen legit Microsoft e-mails go in Junk, there is no way to know if this is phishing or not.
Many will click links right away, others might check domain if they were burnt before but even those who do check it are going to get tricked. Luckily I do not trust anyone when it comes to these kind of things.
May 02 2022 01:33 PMSolution
Hi @usanzadunje ,
It's a good catch from your end, as this is definitely a phishing email. See below.
Dkim, dmarc, spf failed... There is no doubt that message was tagged to go to junk, but I also see that action=oreject might have been the reason it went to Inbox.
Hopefully you won't have these issues in the future, but if you suspect to anything you can analyze the heard, go to Message Header Analyzer (mha.azurewebsites.net) and paste the header.
May 03 2022 12:32 AM