Information Security Stack Exchange is a question and answer site for information security professionals. It only takes a minute to sign up.
Sign up to join this community
I have received an email, claiming to be from Microsoft.
Here is a snapshot of it:
Google marked this email as spam with the following notice:
These are some header details:
Now, the text of the email is clearly nonsensical, but the reply address seems legit and the email does not contain any obvious links. What is the attacker trying to achieve here?
I do not see any evidence from the e-mail you posted that a viable scam could be operated from the message. However, if you post full details maybe this will change. But based on the screenshot, and the information provided I can't conclude there's malicious intent.
A check of the SPF records for email-2.microsoft.com shows:
v=spf1 include:customers.clickdimensions.com ~all
That means clickdimensions.com is known to handle the e-mail traffic out of Azure, and Microsoft themselves uses them. However, the email was sent from email.clickdimensions.com instead of cusotmers.clickdimensions.com; which may explain why the message was marked as spam. Alternatively it is possible someone else is using ClickDimensions CRM to try to masquerade as microsoft -- but the email lacks evidence saying that.
Because both the reply-to addresses and the from address are @microsoft.com, anyone operating a scam would have to work at Microsoft or have hacked someone with access to that address in order to receive replies. Microsoft commonly uses group emails at microsoft.com for support so this seems pretty normal.
It makes sense that they would want VMs with no load on them, that they are giving you for free as part of MSDN, not to be left on because you logged in to play with it and never logged back to use the VM. They probably have a lot of these "orphan" VMs and these e-mails may make it possible for them to reclaim a lot of CPU and Memory they're giving away for marketing reasons.
The question is: Are you an MSDN subscriber who has spun up an Azure instance? Is this e-mail completely out of left field or within your usage pattern?
If you do use Azure and MSDN, in the end this message is more likely than not legitimate, just poorly done by low-level likely outsourced support staff.
The question you have to ask yourself is, why would ClickDimensions be sending an email and would attempt to make it look like it came from Microsoft? This is what GMail is alerting you to; the source address doesn't 100% match up.
Also, the notice is absolutely worth paying attention to, emphasis mine:
It has a from address in email-2.microsoft.com but has failed email-2.microsoft.com's tests for authentication.
GMail has done a check to see if this email really is authentic, and it's saying "no".
You're likely not being forced to click any dodgy links, but in any event, you should look not to trust this sort of email at all. Let it reside in Spam and never give it a second thought. Once they have your trust, it's pretty much game over.
