-2

Our organization had received a phishing email some time ago. The phishing email was sent from a Compromised account within the organization. On seeing the header of the email, it has following Received fields:

Received: from SG2PR01MB0944.apcprd01.prod.exchangelabs.com (10.169.100.10) by
 KL1PR01MB0933.apcprd01.prod.exchangelabs.com (10.164.231.11) with Microsoft
 SMTP Server (version=TLS1_2,
 cipher=TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384_P256) id 15.20.156.4 via Mailbox
 Transport; Fri, 27 Oct 2017 09:39:59 +0000
Received: from SG2PR01MB0459.apcprd01.prod.exchangelabs.com (10.161.6.149) by
 SG2PR01MB0944.apcprd01.prod.exchangelabs.com (10.169.100.10) with Microsoft
 SMTP Server (version=TLS1_2,
 cipher=TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384_P256) id 15.20.178.6; Fri, 27
 Oct 2017 09:39:59 +0000
Received: from SG2PR01MB1343.apcprd01.prod.exchangelabs.com (10.167.76.21) by
 SG2PR01MB0459.apcprd01.prod.exchangelabs.com (10.161.6.149) with Microsoft
 SMTP Server (version=TLS1_2,
 cipher=TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384_P256) id 15.20.156.4; Fri, 27
 Oct 2017 09:39:58 +0000
Received: from SG2PR01MB1023.apcprd01.prod.exchangelabs.com (10.169.100.137)
 by SG2PR01MB1343.apcprd01.prod.exchangelabs.com (10.167.76.21) with Microsoft
 SMTP Server (version=TLS1_2,
 cipher=TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384_P256) id 15.20.178.6; Fri, 27
 Oct 2017 09:39:46 +0000
Received: from SG2PR01MB1023.apcprd01.prod.exchangelabs.com
 ([fe80::1867:203b:f12:380b]) by SG2PR01MB1023.apcprd01.prod.exchangelabs.com
 ([fe80::1867:203b:f12:380b%13]) with mapi id 15.20.0178.007; Fri, 27 Oct 2017
 09:39:46 +0000
From: xyz <xyz>
Subject: Notice
Thread-Topic: Notice
Thread-Index:
    AdNPBpX5rIMKqJjjTuGn/nek8DrJzgAAAC7wAAAAHRAAAAAUYAAAABTAAAAAFPAAAAAVUAAAABVAAAAAFwAAAAAXYAAAABWQAAAAFPAAAAAagAAAABHQAAAAFDAAAAAUYAAAABVQAAAAFFAAAAATEAAAABRw
Date: Fri, 27 Oct 2017 15:09:38 +0530
Message-ID:
    <SG2PR01MB1023229A62F250B921895178A75A0@SG2PR01MB1023.apcprd01.prod.exchangelabs.com>
Accept-Language: en-US
Content-Language: en-US
X-MS-Exchange-Organization-AuthAs: Internal
X-MS-Exchange-Organization-AuthMechanism: 04
X-MS-Exchange-Organization-AuthSource:
    SG2PR01MB1023.apcprd01.prod.exchangelabs.com
X-MS-Has-Attach:
X-Auto-Response-Suppress: DR, OOF, AutoReply
X-MS-Exchange-Organization-Network-Message-Id:
    d5ec70e0-6238-44fa-694a-08d51d1ea8d5
X-MS-Exchange-Organization-SCL: -1
X-MS-TNEF-Correlator:
X-MS-Exchange-Organization-RecordReviewCfmType: 0
x-ms-publictraffictype: Email
X-Microsoft-Exchange-Diagnostics:
    1;KL1PR01MB0933;27:Ajs/I3flIgzdhgTPkcBiDAtWGGFtnAcLkzCg2qbkKkkaVOYm0bU3qTPq7lPpvRQdDfDu8ZOJ2ApzRS02N2+usY7nLefJJqe/dQHB+Du9lETal7rOXfoYhdwmkWpgTUkF
X-Microsoft-Antispam-Mailbox-Delivery:
    ex:0;auth:0;dest:I;ENG:(400001000128)(400125000095)(750103)(520011016)(706028)(400001001318)(400125100095)(61617190)(400001002128)(400125200095);
Content-Type: text/html; charset="us-ascii"
MIME-Version: 1.0

Now, the IPs are private IPs. Does this mean that the attacker who had compromised the sending account, was sending the phishing email from our network itself? Meaning the attacker is possibly from our organization itself?

Improve this question
  • This looks like all your mail servers are using local IPs - and as if there is some kind of cloud mail happening. Those IPs are those of the mail servers. If they are multi-homed (and accessible from the outside), the mail could have come from everywhere. – Tobi Nary Nov 5 '17 at 10:06
  • Are these really all Received headers from the mail? They all only look like communication between internal mail servers but none of these looks like a header you get when the mail server receives the mail from the original sender. I don't think that any information about the origin of the sender can be done solely on these headers. – Steffen Ullrich Nov 5 '17 at 10:11
  • @SmokeDispenser the organization uses outlook, and is based on cloud. So the mail servers are using local IPs? – user5155835 Nov 5 '17 at 10:13
  • @SteffenUllrich while headers are generally unreliable, if they are complete, one could guess that the mail came from someone authorized to send from the first mail server - one in the cloud. I have no knowledge about the layout of that cloud, so idk if that is internal just for the organization or maybe for all of exchangelabs.com. – Tobi Nary Nov 5 '17 at 10:17
  • @SmokeDispenser the organization uses outlook OWA service, and is based on cloud. So are the mail servers using local IPs? – user5155835 Nov 5 '17 at 10:18
0

All the IPs in email headers show server to server communications and they show you the server names. Everything you are seeing is internal to Microsoft. The client IPs that sent the mail are not normally captured in the email headers.

You can make no conclusions as to where the client was that sent the email.

There are online tools that can help you sort out email headers: https://mxtoolbox.com/Public/Tools/EmailHeaders.aspx?huid=36a154a1-933f-4a9f-a83b-8a1a907da21a

The IP you were concerned about resolves to SG2PR01MB1023.apcprd01.prod.exchangelabs.com. That same machine was listed as

X-MS-Exchange-Organization-AuthSource:

That was what you needed to notice.

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.