1

I am a mobile application developer using Microsoft Azure with my MSDN subscription to develop my back-end of the application.

Today I got the following email: enter image description here

So given my above background this email seems to be correct. But there are a few red flags here for me:

  1. The email was sent from mscloude@clickdimensions.microsoft.com. Doing a WhoIs on clickdimensions.com I can see no connection to Microsoft
  2. The email starts "Dear Customer" instead of "Dear [My Name]" another red flag for me
  3. There is no mention of the name of the VM in question which is strange
  4. It is very strange that I have to reply to an email to keep my VM alive, what am I even supposed to write in the reply?

I haven't clicked the link but it seems to link to a clickdimensions site and I haven't replied to the email. I am confused to what the payload is if this is infact a phishing scam.

Is this a phishing scam or just a badly written Microsoft email?

What should I be looking out for when identifying a phishing email?

  • Looks like a plot to try and find active email accounts to then spam/attack later. – hd. May 9 '16 at 10:50
  • 1
    Bit of a gray area, but I'm leaning ever so slightly towards fake. Where do the links lead? – Vegard May 9 '16 at 11:44
  • 3
    @user1, "The email was sent from mscloude@clickdimensions.microsoft.com. Doing a WhoIs on clickdimensions.com I can see no connection to Microsoft". That's hardly surprising, as clickdimensions.microsoft.com is a subdomain of microsoft.com, whereas clickdimensions.com is a different domain altogether. What is the reason why you performed a Whois lookup on clickdimensions.com? Also, in your question, you mention that the email contains a link. What is the domain of that link? – sampablokuper May 9 '16 at 13:05
  • @sampablokuper so are you saying this email did infact come from Microsoft? Therefore meaning its safe? The link links to http://elink.clickdimensions.com. I am looking for ways to tell for sure whether this is a phishing email or legit Microsoft email – user1 May 9 '16 at 13:20
  • 1
    don't suppose you have the headers? – chriz May 9 '16 at 13:33
5

The aim of phishing is to obtain information about the victim, to which the attacker is not entitled.

There are two typical ways a phisher would obtain that information:

  • The victim supplies it by including it in a reply to the phishing email, i.e. by sending the information to an email address controlled by the attacker.
  • The victim supplies it by first following a link in the phishing email, which takes them to a web page controlled by the attacker, and by then entering the information into that web page.

Regardless of the mechanism, the aim is the same: to persuade the victim to send that information to some external resource (email address or web page) controlled by the attacker.

Therefore, to identify a phishing email, follow these steps:

  1. Establish which mechanism the email is asking you to use: is it asking you to reply by email, or to click a link to a web page?
  2. Establish whether the external resource is owned by a legitimate entity. Here's how:

    • View the source code of the email you received. If you don't know how to do this, look in your email client's menus for a "View source" or "View original" menu item, or look online for help with this step.
    • If the email you received asks you to send an email:
      • Read through the source code to find the email address it is asking you to reply to (e.g. the "reply-to" address). Make a note of the domain name for that email address (typically but not always the whole part after the "@" symbol). For instance, in the case of phisher@example.com, the domain name is example.com.
    • If the email you received asks you to click a link:
      • Read through the source code to find the URL it is asking you to visit. Depending upon how the email you received was formatted, this URL might be in an href attribute of an HTML a element. Make a note of the relevant part of the domain name for that URL. The relevant part consists of: the top-level domain or country-code second-level domain (i.e. the rightmost part), and the word and dot preceeding that. Examples:
        • URL: https://microsoft.odd.com/form/. Relevant part: odd.com.
        • URL: https://microsoft.odd.co.uk/form/. Relevant part: odd.co.uk.
        • URL: https://odd.microsoft.com/form/. Relevant part: microsoft.com.
        • URL: https://www.microsoft.com/form/. Relevant part: microsoft.com.
        • URL: https://microsoft.com/form/. Relevant part: microsoft.com.
  3. Now that you have the domain name, or at least the relevant part of it, check whether it matches the ostensible sender of the email.

    • If the domain bears no apparent relation to the ostensible sender, the email is probably phishing. (E.g. email is ostensibly from Microsoft, yet domain is v5fld7s5d1g.com.)
    • If the domain bears some apparent relation to the ostensible sender, but is not their primary domain, the the email might be phishing. (E.g. email is ostensibly from Microsoft, yet domain is emailsfrommicrosoft.com.) In this case, perform a WHOIS lookup on the domain in order to establish the domain's owner. If WHOIS reports an owner that doesn't match the ostensible sender, the email is probably phishing.
    • If the domain matches the ostensible sender's primary domain name, then the email is probably not phishing. (E.g. email is ostensibly from Microsoft, and domain is microsoft.com.)
  4. If you are still in doubt, contact the organisation in question after obtaining their contact information from some other, more trusted route (i.e. not using any contact information in the email). For example, in your case, you could look for Azure's customer service team's contact information on the Azure website and contact them to ask whether they sent you the email.

1

I think you can safely reply the message. A MX record lookup gives outlook.com as top level domain.

Also,the top level domain in mscloude@clickdimensions.microsoft.com is microsoft.com.
Even if the email is spoofed with clickdimensions.microsoft.com. Your reply email will not be delivered to attacker.

Also, just make sure that reply (reply-to) address also contains microsoft.com or outlook.com as top level domains.

  • 2
    Is the image always included, or is it linked. I think that is the real issue. Because if its linked, the attacker already knows this email account is active. – Simply G. May 9 '16 at 11:07
  • @SimplyG. Just changed that.. Good that you pointed – Sravan May 9 '16 at 11:25

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.