Phishing email sender [email protected]

[Email] is used for some Microsoft 365 alert notifications, but that does not authenticate this message; because its link leads to a credential-harvesting domain, treat the message as confirmed phishing.

The visible From address can be forged. SMTP permits the displayed From address to differ from the actual envelope sender, so an attacker can display [Email] without controlling that mailbox.^1^

Microsoft-hosted discussions and examples associate [Email] with some DLP and high-severity Microsoft 365 notifications, but there is no authoritative product document establishing it as the canonical sender for every alert.^2^ ^3^

Verify the received message

1. Do not use its hyperlink.
2. Open the message headers and inspect Authentication-Results for:
   • spf=
   • dkim=
   • dmarc=
   • compauth=
   Microsoft 365 records these results in the Authentication-Results header. DMARC checks whether the authenticated SPF or DKIM domain aligns with the displayed From domain.^4^
3. Review:
   • Return-Path / 5321.MailFrom
   • DKIM signing domain (d=)
   • earliest external Received hop
   • any Outlook via or unverified-sender indicator
   A mismatch or authentication failure supports spoofing. However, authentication results are not a substitute for analyzing the URL and content; Microsoft notes that other protection technologies can identify even an authenticated message as spoofed or malicious.^1^
4. Independently open the Microsoft Defender portal, not the email link, and check whether a corresponding alert or incident exists. Defender alert policies can send email notifications, while triggered alerts remain available on the portal’s Alerts page.^5^

Report and contain it

As a Microsoft 365 administrator:

1. Go to Microsoft Defender portal → Actions & submissions → Submissions.
2. On Emails, select Submit to Microsoft for analysis.
3. Supply the message’s network message ID or upload the email file.
4. Select I’ve confirmed it’s a threat → Phish, then submit it.
5. Submit the malicious URL separately from the URLs tab if required.

These are Microsoft’s documented tenant-admin submission paths.^6^

Also:

• Search message trace and Defender for other recipients of the same message, URL, or network message ID.
• Quarantine or purge matching copies using your organization’s normal incident-response process.
• Block the malicious URL/domain, rather than permanently blocking [Email], because that address can also be used for legitimate notifications.
• If anyone entered credentials, immediately reset that account’s password, revoke active sessions, require MFA, and investigate sign-ins and mailbox changes.

For end-user reporting in supported Outlook clients, select the message and choose Report → Report phishing. Microsoft notes that reporting a message does not itself block future mail from the sender.^7^

References

1. Email authentication in cloud organizations
2. Change the sender address for DLP notifications
3. High-severity alert: A potentially malicious URL click was detected
4. Security Operations guide for email authentication in Microsoft 365
5. Alert policies in the Microsoft Defender portal
6. Use the Submissions page to submit suspected spam, phish, URLs, legitimate email getting blocked, and email attachments to Microsoft
7. Phishing and suspicious behavior in Outlook | Microsoft Support