What to do with a suspicious email from someone I know (seemingly using the real mail of that person)?

Question

TL;DR, I think this mail was sent by mail.okgroup.cz. Not sure though, I would like confirmation.

I just got a mail from my sister with no subject and only a link.

NOTE; That the email used in this mail is the ACTUAL mail of my sister.

I am using Outlook for my email (and I'm using it via Firefox)

When hovering over the little icon (where a picture of my sister is shown (now shows a question mark in the opened box, also giving me a "non-verified sender" tag)).

• Should my sister be worried/ is my sisters email compromised?
• Can i just ignore this mail?
• What is going on?

I have recently gotten a lot of spam in my mailbox, But never like this.

After skimming through my mail, I found another one from my "sister", same mail structure, only a link.

HEADER:

(Geen onderwerp)  Dit bericht is geïdentificeerd als spam. Het wordt na 10 dagen verwijderd. Het bericht is geen spam  Opvolgen. My sisters name <My Sisters actual email> Vr 24-1-2020 00:13 My mail name

Suspicious link

My sister's name

Received: from DB8EUR05HT142.eop-eur05.prod.protection.outlook.com
 (2603:10a6:802:59::49) by VI1PR03MB4142.eurprd03.prod.outlook.com with HTTPS
 via VI1P195CA0096.EURP195.PROD.OUTLOOK.COM; Thu, 23 Jan 2020 23:13:01 +0000
Received: from DB8EUR05FT027.eop-eur05.prod.protection.outlook.com
 (2a01:111:e400:fc0f::38) by
 DB8EUR05HT142.eop-eur05.prod.protection.outlook.com (2a01:111:e400:fc0f::315)
 with Microsoft SMTP Server (version=TLS1_2,
 cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.2644.19; Thu, 23 Jan
 2020 23:13:01 +0000
Authentication-Results: spf=permerror (sender IP is 95.129.100.50)
 smtp.mailfrom=okklient.cz; live.nl; dkim=none (message not signed)
 header.d=none;live.nl; dmarc=fail action=none header.from=hotmail.com;
Received-SPF: PermError (protection.outlook.com: domain of okklient.cz used an
 invalid SPF mechanism)
Received: from mail.okgroup.cz (95.129.100.50) by
 DB8EUR05FT027.mail.protection.outlook.com (10.233.239.192) with Microsoft
 SMTP Server id 15.20.2665.18 via Frontend Transport; Thu, 23 Jan 2020
 23:13:00 +0000
X-IncomingTopHeaderMarker:
 OriginalChecksum:B2AAF034E39027F209C64FC43131BC6A85DB494CE4EA1CF63F6CF4BBAB69D399;UpperCasedChecksum:032C25CE4D6E9B0F87551C4D4146F4B4D120FFCD126100DE4F858E5673CC142E;SizeAsReceived:1121;Count:14
Received: from localhost (localhost [127.0.0.1])
    by mail.okgroup.cz (Postfix) with ESMTP id AC22372D
    for <*My email address*>; Fri, 24 Jan 2020 00:13:00 +0100 (CET)
X-Virus-Scanned: Debian amavisd-new at mail.okgroup.cz
Received: from mail.okgroup.cz ([127.0.0.1])
    by localhost (mail.okgroup.cz [127.0.0.1]) (amavisd-new, port 10024)
    with ESMTP id 0ziGSgz90EGB for <*My Email address*>;
    Fri, 24 Jan 2020 00:13:00 +0100 (CET)
Received: from mail.okgroup.cz (unknown [221.4.205.30])
    (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits))
    (No client certificate requested)
    by mail.okgroup.cz (Postfix) with ESMTPSA id 62C40655
    for <*My email address*>; Fri, 24 Jan 2020 00:12:59 +0100 (CET)
Content-transfer-encoding: 7bit
From: "*My sisters name*" <*My sisters Email*>
Content-type: text/plain; charset=us-ascii
Date: Fri, 24 Jan 2020 02:12:58 +0300
Message-Id: <0D7EBF3E-BEFC-4916-ED43-6A4A1904DAE2@okklient.cz>
Subject:
To: "*my Mail name*" <*My Email address*>
Reply-To: "*My sisters name*" <*My sisters email address*>
X-Mailer: iPhone Mail (15E216)
X-IncomingHeaderCount: 14
Return-Path: *firstpartofmysistersemailaddress*@okklient.cz
X-MS-Exchange-Organization-ExpirationStartTime: 23 Jan 2020 23:13:01.0431
 (UTC)
X-MS-Exchange-Organization-ExpirationStartTimeReason: OriginalSubmit
X-MS-Exchange-Organization-ExpirationInterval: 1:00:00:00.0000000
X-MS-Exchange-Organization-ExpirationIntervalReason: OriginalSubmit
X-MS-Exchange-Organization-Network-Message-Id:
 85c585a5-a260-4c64-92c6-08d7a059cac1
X-EOPAttributedMessage: 0
X-EOPTenantAttributedMessage: 84df9e7f-e9f6-40af-b435-aaaaaaaaaaaa:0
X-MS-Exchange-Organization-MessageDirectionality: Incoming
X-Forefront-Antispam-Report: EFV:NLI;
X-MS-Exchange-Organization-AuthSource:
 DB8EUR05FT027.eop-eur05.prod.protection.outlook.com
X-MS-Exchange-Organization-AuthAs: Anonymous
X-MS-PublicTrafficType: Email
X-MS-UserLastLogonTime: 1/23/2020 9:58:15 PM
X-MS-Office365-Filtering-Correlation-Id: 85c585a5-a260-4c64-92c6-08d7a059cac1
X-MS-TrafficTypeDiagnostic: DB8EUR05HT142:
X-MS-Exchange-EOPDirect: true
X-Sender-IP: 95.129.100.50
X-SID-PRA: *My sisters email address*
X-SID-Result: NONE
X-MS-Exchange-Organization-PCL: 2
X-Microsoft-Antispam: BCL:0;
X-OriginatorOrg: hotmail.com
X-MS-Exchange-CrossTenant-OriginalArrivalTime: 23 Jan 2020 23:13:00.9130
 (UTC)
X-MS-Exchange-CrossTenant-Network-Message-Id: 85c585a5-a260-4c64-92c6-08d7a059cac1
X-MS-Exchange-CrossTenant-Id: 84df9e7f-e9f6-40af-b435-aaaaaaaaaaaa
X-MS-Exchange-CrossTenant-FromEntityHeader: Internet
X-MS-Exchange-CrossTenant-RMS-PersistedConsumerOrg:
 00000000-0000-0000-0000-000000000000
X-MS-Exchange-Transport-CrossTenantHeadersStamped: DB8EUR05HT142
X-MS-Exchange-Transport-EndToEndLatency: 00:00:00.7923850
X-MS-Exchange-Processed-By-BccFoldering: 15.20.2644.026
X-Message-Flag: Flag for follow up
Keywords: Categorie Rood < this was a tag i attached to the mail, Not important
X-Microsoft-Antispam-Mailbox-Delivery:
    kl:0;dkl:0;rwl:0;ucf:0;jmr:0;ex:0;auth:0;dest:J;OFR:SpamFilterAuthJ;ENG:(5062000261)(5061607266)(5061608174)(4900115)(4920090)(6392002)(4950130)(4990090)(9140004);RF:JunkEmail;
X-Message-Info:
    qoGN4b5S4yoZj1tYlRsjA9pVh/kpy3YY8dFhfcbPMyUsx9US3V/zgFPa74wuRzpavqFSJpg7Mg6gKNgXfcEV5JTtQC4bgDkp8kZXi2IfFS+RDX3Uc4yiNG6pYPgX+XK3yeeWnj++kROH6WpVsaTwkzcHyukxl7YyyW4tqBmkSsYt9E88m8Tf+1zwxMvnC1AaRoMTyl24RU9/Mm86KN7BYg==
X-Message-Delivery: Vj0xLjE7dXM9MDtsPTA7YT0wO0Q9MjtHRD0yO1NDTD02
X-Microsoft-Antispam-Message-Info:
    =?us-ascii?Q?j7GzwzhoZPDrhcowLclpLRQ/5FyY/FeTBUmx/05CvTAc5OH1Z13+BMPGnXVG?=
 =?us-ascii?Q?w5gK2Nfbtt/CE+7oa9z30RTdidzxmdfV22Ohu78x1NUjjIT7fu5JA7Piy1Af?=
 =?us-ascii?Q?W64qUe9A8BF/mPUJ5ZOqTLcJzS52r1v1fFKCZcn5wv8SCQdSsTwN4XwugLzD?=
 =?us-ascii?Q?L6ennWJVCkLqk5yXSfxCHtl5EnuFAr0bJtYodrWYiURqZ9gbf/aoxNRbN/uM?=
 =?us-ascii?Q?P6IGTsqlBaMk0xdlbPleda46/nrcLuTBo0dboS2c2ettYKHcDwpjwfPMHs0S?=
 =?us-ascii?Q?Ggtbxuv5Hion7xx5uGKMiCoJaRUsYj/qzTbwZL2BsnPhLW18hSWNk+6O8DRI?=
 =?us-ascii?Q?ewczzVQ0Idozpz5CkRlk6dDed3Tf09XaB7MMpBlQEwvvaMNbtnZHFns0BRjK?=
 =?us-ascii?Q?1bOmQMN2/kXtyPauWvZdjSL2ot009hvqcZzChDTc9ENOjUvQN8BAcaueWVKr?=
 =?us-ascii?Q?nEmScmjLE2+w0QrTc8mUEkS5wc9lfJltBopp3yHxQamL62lmRYA1R7+lwnWP?=
 =?us-ascii?Q?qiN/WAbbFxPpOYxm7irlg+BrVtXhNEvn+UX77IpPc5FA9XiQ5dAHUTEfM3uE?=
 =?us-ascii?Q?Fp1YMuEZxoJ9FipR/NU2yfpTn5nbj28KqbH/z7DjNCd14wbE4znUyDmN5HWQ?=
 =?us-ascii?Q?bcPiLzj9gJDiwv0/tgnMqX3TFGAAVpwOsrq/Rm6ULYBDd2710tO3jY6kEsCK?=
 =?us-ascii?Q?W6CD8HsLrPmgC+iJXFnrWz4/2IZo3YRyIV9MWuBNfloLnX7zZ10Zl0fmTww/?=
 =?us-ascii?Q?YJ4y4pItLZUSC59/Puc9hUycZxz+FsncGKtZdHIWhvIpUtRDADbenQ8+K9B2?=
 =?us-ascii?Q?aBCJ2Wg1jLavlgg1DeRQCnPIpnnoew8QSEbdxI+wCQKKNuEzrBuO9IV8HcHt?=
 =?us-ascii?Q?SzLTmyv5xCYtBzddhfDLWaNoDaDcbPfmp/ZPRtxuDVvHBEFnN54a/9EKpQ68?=
 =?us-ascii?Q?7vhjMEDo//1hF+z4sL+uhUd8XIMrQ6YUhx3glF7hQFEhUeaRbdxAEZGzSroo?=
 =?us-ascii?Q?P6x5?=
MIME-Version: 1.0

Answer 1

The mail address displayed by Outlook is just what is contained in the From: header, and can easily be forged. In fact, it is just one line of text in the top part of the message that is written by the sender (using low level tools, you can put anything there) and transported by all mail relays to the final recipient(s).

By examining all Received header lines, you can try to guess where this message followed the same relay chain as other true messages from your sister, but if you are not used to the SMTP protocol it can look rather cryptic...

Only if your sister finds the message in her Sent folder, il means that its mail account have been compromissed and she should change its password ASAP. Else it just means that someone has found its mail address somewhere and uses it at a mere label, and little if any can be done.

Answer 2

Analyzing the message

When examining Received headers, the only ones you can trust are the ones added by your own email service's infrastructure. Among those, the only header of any consequence is the earliest (which will be the last in order as you read). To find it, determine your email domain's MX records and search for them. I'm guessing (since you redacted this info) that's DB8EUR05FT027.mail.protection.outlook.com in your case, so the key header is where this system received the connection from mail.okgroup.cz, as you suspected:

Received: from mail.okgroup.cz (95.129.100.50) by
 DB8EUR05FT027.mail.protection.outlook.com (10.233.239.192) with Microsoft
 SMTP Server id 15.20.2665.18 via Frontend Transport; Thu, 23 Jan 2020
 23:13:00 +0000

Therefore, you should be able to trust that header and everything above it, including the Authentication-Results header denoting that SPF (an anti-spoof system that allows a domain to authorize sending IPs) had a permanent error (which means the sending domain has probably improperly configured SPF) and that DKIM (an anti-spoof system that allows a domain to designate cryptographic keys to sign outgoing mail) was not configured.

The Authentication-Results header tells me your sister's email uses Hotmail, which definitely does not authorize okklient.cz to send on its behalf. Still, Hotmail does not have a DMARC policy of p=reject because too many users send through other infrastructures (older freemail providers like Hotmail are kind of locked into allowing this), so o365 didn't block the message as spoofed.

You can recreate this analysis by pasting the unredacted headers into a tool like G Suite Messageheader.

What does this say about the attack?

This sort of spam is increasingly common. It is a hallmark of Emotet for example, which infects a computer and sends mail to the victim's contacts.

We already know that the message was not sent from your sister's computer (unless she normally relays through okgroup.cz), so there's no direct evidence that she's infected, but somebody with both your and her email addresses was probably infected at some point in time (or else your contacts were harvested from some public resource, like a mailing list archive).

What should you do?

There isn't much you can do, unfortunately. Report the message as spam to your provider (I assume there's a "report spam" button) and to third parties like SpamCop (disclaimer, I work there). Since it didn't come from your sister's provider, you don't have to report it there (but it can't hurt).

If the set of people who have both your and your sister's email addresses is really small, you could reach out to them and encourage them to update their anti-virus software and then run a full virus scan on their systems. You and your sister should of course do this too.

Your sister, and that set of people if it's small enough, should change their email passwords just to be safe. If this happens again to you, you should change your password too. Use a password manager that generates a true random 11+ character password. Add two-factor authentication (2FA, MFA) to your account and advocate for that broadly.

Should you worry?

No, not really; this is sadly normal nowadays.

If this were targeted (which it is not!), if there were specific language targeting you (excluding a copy of an old email, which Emotet can do automatically), then you should worry because a human could be trying to compromise you in some specific manner, in which case you'd have to ask why; do you have some kind of access to resources, people, or money that might be worth something? Read more about that by searching for Business Email Compromise (BEC) or Advance-fee fraud (419).