How to detect certain Spoofing/Phishing/Spearfishing e-mails.
Review any suspicious message to see who sent the message. Sometimes this is masked by Outlook or other client showing just the name and not the e-mail address. If you open the e-mail it should show you the originating address. Again, sometimes these are spoofed to look legitimate.
Below is a sample e-mail sent to one of our customers (I’ve blanked out her name), but you can see that the e-mail is coming from smoot.org – definitely not Microsoft.
Also look for bad grammar, mis-spellings and poor translation – “Syncing failed to go through” is a poor translation of “Your mailbox failed to synchronize”, and “due to invalidation” would be “due to invalid credentials”.
And, also when I hover over the link in the message, it is not taking me to any Microsoft site, but to a domain in New Zealand (.nz).
So, if we need to say it, DO NOT CLICK ON THE LINK, and then DO NOT ENTER YOUR PASSWORD.
If you really want to investigate further, you can look at the Properties of the message, and review where it came from. This gets more difficult to read, but below is a message I received, and below it are the “Internet Headers” from the message. You get to these by opening the message and clicking on File, then Properties. In this case, the e-mail looks legitimate – the sent-from address looks OK, and there are no grammar or spelling issues that I see. On the other hand, the Inspector General of the Small Business Association (SBA) would not be requesting this information. And all the links and embedded images are being blocked.
So, I looked in to the Internet Headers – it shows that it originated in Japan, so definitely not the SBA.
