I recently received an email that appears to be from myself, containing a QR code attachment. This is unusual since it didn't come from the typical spoofed sender that I usually encounter and block. Upon tracing the message through Microsoft 365, I found it actually originated from my email, not a spoof. Furthermore, this email didn't show up in the Mimecast trace, and there were no unusual logins or Outlook rules set up that could explain it. I also confirmed that there's no outbound traffic from the two users involved, only this single email. Looking at the headers, I noticed that the sending IP address is traced back to Ukraine (139.28.38.35), yet I have no permitted senders in my 365 settings according to the headers. If anyone has insight into how this could happen, I'd appreciate your help!
1 Answer
It sounds like this might be a spoof where the email looks like it's from yourself, which can sometimes happen. I’ve heard Microsoft support mention before that message traces can show something as being sent by the user even when it's spoofed. You might want to double check the configuration on your email security settings, even if the traceback shows no issues. Some bad actors can be sneaky!
Right! And just to add, you should check your SPF settings, as that can play a big part in preventing spoofed emails. Make sure everything is configured correctly as it could be letting unwanted emails slip through.