Phishing email sender [email protected]

Reginald StaRosa 0 Reputation points
2026-10-15T12:43:00.5233333+00:00

One of our employees received a phishing email from this sender [email protected] with the Subject Line:

High-severity alert: tenant compromised .

The malicious hyperlink inside the email redirects users to a spoofed UK domain designed to harvest credentials.

I want to verify if this sender [email protected] is a service account of microsoft.com.

Thank you

Microsoft Security | Microsoft Defender | Microsoft Defender for Office 365
0 comments

2 answers

Sort by: Most helpful
Most helpful Newest Oldest
  1. Marcin Policht 110.6K Reputation points MVP Volunteer Moderator
    2026-10-15T16:53:51.3666667+00:00

    Well - [[email protected]] is indeed a legitimate Microsoft-controlled sender address that Microsoft 365 uses for certain alert and notification messages. However, the presence of this address by itself, does not prove that a particular message was actually sent by Microsoft.

    An attacker can spoof the visible From address and make a phishing message appear to originate from [[email protected]]. Effectively, the fact that the message displayed this sender does not make the email trustworthy.

    In this case, the malicious hyperlink that redirects to a spoofed UK domain designed to capture credentials pretty much proves that the message is part of the phishing attack. The attack is based on the difference between the visible From address and the authenticated origin of the message.

    To determine whether this particular email actually originated from Microsoft, you'd need to examine the full message headers, especially the Authentication-Results entries for SPF, DKIM, and DMARC, along with the Return-Path, DKIM signing domain, Received headers, and Microsoft's composite authentication result.

    For that, follow https://support.microsoft.com/en-us/outlook/view-internet-message-headers-in-outlook

    If the above response helps answer your question, remember to "Accept Answer" so that others in the community facing similar issues can easily find the solution. Your contribution is highly appreciated.

    hth

    Marcin

    Was this answer helpful?

    0 comments

  2. AI answer

    2026-10-15T12:43:59.91+00:00

    [Email] is used for some Microsoft 365 alert notifications, but that does not authenticate this message; because its link leads to a credential-harvesting domain, treat the message as confirmed phishing.

    The visible From address can be forged. SMTP permits the displayed From address to differ from the actual envelope sender, so an attacker can display [Email] without controlling that mailbox.^1^

    Microsoft-hosted discussions and examples associate [Email] with some DLP and high-severity Microsoft 365 notifications, but there is no authoritative product document establishing it as the canonical sender for every alert.^2^ ^3^

    Verify the received message

    1. Do not use its hyperlink.
    2. Open the message headers and inspect Authentication-Results for:
      • spf=
      • dkim=
      • dmarc=
      • compauth=
      Microsoft 365 records these results in the Authentication-Results header. DMARC checks whether the authenticated SPF or DKIM domain aligns with the displayed From domain.^4^
    3. Review:
      • Return-Path / 5321.MailFrom
      • DKIM signing domain (d=)
      • earliest external Received hop
      • any Outlook via or unverified-sender indicator
      A mismatch or authentication failure supports spoofing. However, authentication results are not a substitute for analyzing the URL and content; Microsoft notes that other protection technologies can identify even an authenticated message as spoofed or malicious.^1^
    4. Independently open the Microsoft Defender portal, not the email link, and check whether a corresponding alert or incident exists. Defender alert policies can send email notifications, while triggered alerts remain available on the portal’s Alerts page.^5^

    Report and contain it

    As a Microsoft 365 administrator:

    1. Go to Microsoft Defender portal → Actions & submissions → Submissions.
    2. On Emails, select Submit to Microsoft for analysis.
    3. Supply the message’s network message ID or upload the email file.
    4. Select I’ve confirmed it’s a threat → Phish, then submit it.
    5. Submit the malicious URL separately from the URLs tab if required.

    These are Microsoft’s documented tenant-admin submission paths.^6^

    Also:

    • Search message trace and Defender for other recipients of the same message, URL, or network message ID.
    • Quarantine or purge matching copies using your organization’s normal incident-response process.
    • Block the malicious URL/domain, rather than permanently blocking [Email], because that address can also be used for legitimate notifications.
    • If anyone entered credentials, immediately reset that account’s password, revoke active sessions, require MFA, and investigate sign-ins and mailbox changes.

    For end-user reporting in supported Outlook clients, select the message and choose Report → Report phishing. Microsoft notes that reporting a message does not itself block future mail from the sender.^7^

    References

    1. Email authentication in cloud organizations
    2. Change the sender address for DLP notifications
    3. High-severity alert: A potentially malicious URL click was detected
    4. Security Operations guide for email authentication in Microsoft 365
    5. Alert policies in the Microsoft Defender portal
    6. Use the Submissions page to submit suspected spam, phish, URLs, legitimate email getting blocked, and email attachments to Microsoft
    7. Phishing and suspicious behavior in Outlook | Microsoft Support
    AI-generated content may be incorrect. Read our transparency notes for more information.

    Was this answer helpful?

Your answer

Answers can be marked as 'Accepted' by the question author and 'Recommended' by moderators, which helps users know the answer solved the author's problem.