Is this a legitimate Microsoft email or is this a Phishing email and how can I tell?

Question

I am a mobile application developer using Microsoft Azure with my MSDN subscription to develop my back-end of the application.

Today I got the following email:

So given my above background this email seems to be correct. But there are a few red flags here for me:

1. The email was sent from [email protected]. Doing a WhoIs on clickdimensions.com I can see no connection to Microsoft
2. The email starts "Dear Customer" instead of "Dear [My Name]" another red flag for me
3. There is no mention of the name of the VM in question which is strange
4. It is very strange that I have to reply to an email to keep my VM alive, what am I even supposed to write in the reply?

I haven't clicked the link but it seems to link to a clickdimensions site and I haven't replied to the email. I am confused to what the payload is if this is infact a phishing scam.

Is this a phishing scam or just a badly written Microsoft email?

What should I be looking out for when identifying a phishing email?

Answer 1

The aim of phishing is to obtain information about the victim, to which the attacker is not entitled.

There are two typical ways a phisher would obtain that information:

• The victim supplies it by including it in a reply to the phishing email, i.e. by sending the information to an email address controlled by the attacker.
• The victim supplies it by first following a link in the phishing email, which takes them to a web page controlled by the attacker, and by then entering the information into that web page.

Regardless of the mechanism, the aim is the same: to persuade the victim to send that information to some external resource (email address or web page) controlled by the attacker.

Therefore, to identify a phishing email, follow these steps:

1. Establish which mechanism the email is asking you to use: is it asking you to reply by email, or to click a link to a web page?

2. Establish whether the external resource is owned by a legitimate entity. Here's how:

   • View the source code of the email you received. If you don't know how to do this, look in your email client's menus for a "View source" or "View original" menu item, or look online for help with this step.
   • If the email you received asks you to send an email:
     • Read through the source code to find the email address it is asking you to reply to (e.g. the "reply-to" address). Make a note of the domain name for that email address (typically but not always the whole part after the "@" symbol). For instance, in the case of [email protected], the domain name is example.com.
   • If the email you received asks you to click a link:
     • Read through the source code to find the URL it is asking you to visit. Depending upon how the email you received was formatted, this URL might be in an href attribute of an HTML a element. Make a note of the relevant part of the domain name for that URL. The relevant part consists of: the top-level domain or country-code second-level domain (i.e. the rightmost part), and the word and dot preceeding that. Examples:
       • URL: https://microsoft.odd.com/form/. Relevant part: odd.com.
       • URL: https://microsoft.odd.co.uk/form/. Relevant part: odd.co.uk.
       • URL: https://odd.microsoft.com/form/. Relevant part: microsoft.com.
       • URL: https://www.microsoft.com/form/. Relevant part: microsoft.com.
       • URL: https://microsoft.com/form/. Relevant part: microsoft.com.

3. Now that you have the domain name, or at least the relevant part of it, check whether it matches the ostensible sender of the email.

   • If the domain bears no apparent relation to the ostensible sender, the email is probably phishing. (E.g. email is ostensibly from Microsoft, yet domain is v5fld7s5d1g.com.)
   • If the domain bears some apparent relation to the ostensible sender, but is not their primary domain, the the email might be phishing. (E.g. email is ostensibly from Microsoft, yet domain is emailsfrommicrosoft.com.) In this case, perform a WHOIS lookup on the domain in order to establish the domain's owner. If WHOIS reports an owner that doesn't match the ostensible sender, the email is probably phishing.
   • If the domain matches the ostensible sender's primary domain name, then the email is probably not phishing. (E.g. email is ostensibly from Microsoft, and domain is microsoft.com.)

4. If you are still in doubt, contact the organisation in question after obtaining their contact information from some other, more trusted route (i.e. not using any contact information in the email). For example, in your case, you could look for Azure's customer service team's contact information on the Azure website and contact them to ask whether they sent you the email.

Answer 2

I think you can safely reply the message. A MX record lookup gives outlook.com as top level domain.

Also,the top level domain in [email protected] is microsoft.com.
Even if the email is spoofed with clickdimensions.microsoft.com. Your reply email will not be delivered to attacker.

Also, just make sure that reply (reply-to) address also contains microsoft.com or outlook.com as top level domains.