Phising e-mail from microsoft domain?!

[usanzadunje]

Hello,

I got this e-mail today and it was in my Junk folder so I thought it was phishing email. But once I opened it sender had microsoft.com in email as domain. After inspecting similar e-mails I noticed that the structure of this e-mail is nothing like when Outlook sends this e-mail.

My question is how the hell did the sender use @Pernille-Eskebo.com domain for his/hers email?

Here is the e-mail: 

[#2]

@usanzadunje 

Hi, is your guess browser Edge?
Are you using a third-party Outlook extension?

[#3]

@A1 
Nope, I am using Brave, not 3rd party extension. I just went on live.com website as I always do to check my e-mail.

[#4]

You can do 2 things to check:
Set Edge by default - of course, then you can change it.
And I suggest you add an Outlook account - to the mail app for Windows10 -> is the most secure configuration!

[#5]

@A1 

Can you confirm this is phishing e-mail?

Also for this particular e-mail there are flags ( '!' and 'flag icon') and I think Microsoft never sends those, at least it did not in e-mails I received before. Can you also confirm this?

I mean I'm 99% sure it was phishing, why the heck would Outlook send its own e-mail to Junk xd. But domain part is confusing to me and if it happened to me it may happen to others which could easily click on link sent in that e-mail..

[#6]

Do not expect confirmation in a public forum - this is not possible.
Emails can always be crafted, so it's best to enter your account directly without using the shared link
Best regards

[#7]

Hi @usanzadunje ,

In order to be 100% certain that your account is safe, please visit: https://account.microsoft.com/security?lang=en-US and check Sign-in activity. 

I have seen legitimate emails from Microsoft in the junk folder in the past.

[#8]

Yeah I checked. There is nothing similar to information I got in that e-mail.
So now I am convinced that it is 100% phishing e-mail.

Could you maybe explain how did that e-mail used microsoft.com domain as sender?

This is really "scary" since it comes from Microsoft and you said that you have seen legit Microsoft e-mails go in Junk, there is no way to know if this is phishing or not. 

Many will click links right away, others might check domain if they were burnt before but even those who do check it are going to get tricked. Luckily I do not trust anyone when it comes to these kind of things.

[#9]

Hi @usanzadunje ,

Thanks for your reply. It is challenging to understand what is happening because we don't have access to the mailbox, but would you be able to View message source and upload the logs? Thanks!

[#10]

@Adin_Calkic 

Sure, here is the log. It wont let me upload .txt file so I dumped whole log here.

[#11 · Accepted solution]

Hi @usanzadunje ,

It's a good catch from your end, as this is definitely a phishing email. See below.

Dkim, dmarc, spf failed... There is no doubt that message was tagged to go to junk, but I also see that action=oreject might have been the reason it went to Inbox.

Hopefully you won't have these issues in the future, but if you suspect to anything you can analyze the heard, go to Message Header Analyzer (mha.azurewebsites.net) and paste the header.

[#12]

Ohh, good to know this. Thanks for that.

I guess these malicious users have become very crafty these days :)

[#13]

@usanzadunje 

I think you should remove the log dumps -> there is information that should not be shared in a public forum.
And other MTC Members should not ask for this - for safety.

[#14]

Could this log file lead to my account being compromised?

[#15]

@usanzadunje 

Since you are not an enterprise administrator, this is unlikely, but such sharing in the enterprise is dangerous!may lead to data encryption.