Phishing Analysis: Deconstructing a Fake Microsoft Security Alert

Email is one of the main ways that social engineers target their victims. In this post, we are going to take a look at a phishing attempt that uses the theme of an "Unusual Sign-in Activity" from Microsoft , in other words, this is one of those emails that most of us would delete in the Spam/Junk folder without hesitation if we received it from an unknown address.

This report contains technical header analysis, delivery mechanism and methods the attackers have used to deliver this attack.

Key Findings

Threat Type- Social Engineering

**Spoofed Display Name- "**Microsoft account team"

Claimed From Domain- access-accsecurity.com

Actual Origin Domain- quihdimdfghdrflmnder.co.uk

Sending IP- 89.144.44.42

Authentication Status- SPF Fail / DKIM None / DMARC Error

Reply-To- solutionteamrecognizd03@gmail.com

Technical Analysis

1. Header & Origin Tracing- Looking at the Received: headers from bottom to top shows the actual path that the message travelled, and this is the correct way to read them, since every hop adds a Received: line on top of the previous one, meaning that it's the oldest hop in the header block.

Received: from quihdimdfghdrflmnder.co.uk (89.144.44.42) by DM6NAM04FT056.mail.protection.outlook.com … Authentication-Results: spf=none (sender IP is 89.144.44.42) smtp.mailfrom=quihdimdfghdrflmnder.co.uk; dkim=none (message not signed) header.d=none;dmarc=permerror action=none header.from=access-accsecurity.com; From: Microsoft account team no-reply@access-accsecurity.com Reply-To: solutionteamrecognizd03@gmail.com Return-Path: bounce@quihdimdfghdrflmnder.co.uk

Anomalies Identified:

Header Mismatch: While the From: header specified no-reply@access-accsecurity.com (a legitimate-seeming address, designed to appear as an account-security resource), the Return-Path: bounced to a completely different, randomly generated domain at bounce@quihdimdfghdrflmnder.co.uk — a clear indicator of a spam. Three unrelated "identities" in one message: the visible brand, the From: subdomain, and the actual hosting provider.

Reply-To Trap: All reply actions (a "Report The User" button, an "unsubscribe" link) were present as mailto: links pointing to a third-party consumer Gmail inbox (solutionteamrecognizd03@gmail.com) rather than any Microsoft-owned address. Also there's no fake login page anywhere in this email — the entire objective appears to be getting the recipient to reply, which confirms the target address is live and monitored.

2. Authentication Breakdown- The email failed every standard domain protection check:

• SPF: The sending IP (89.144.44.42) was not authorized to send mail for the claimed domain — meaning DNS has no record listing this host as a permitted sender.
• DKIM: Missing cryptographic signature entirely — no way to verify message integrity or origin authenticity.
• DMARC: The email produced a "permerror", which means either that there is no DMARC policy published for the domain or that the policy cannot be retrieved due to a DNS issue. In short, there is no instruction for handling spoofed emails with this domain in the "from" field.

3. Hiding the Trap & Tracking the Victim

• Tricking the Spam Filter: The email hid a giant block of random words and invisible text in its code. This is designed to confuse automated spam filters, making the scam email look like harmless everyday messages so it sneaks past security into your inbox.
• Hidden Email Tracker: A tiny, invisible image was hidden in the email. As soon as the message is opened, this image secretly alerts the attacker that your email address is active, while also revealing your general location (IP address) and device details.
• Fake Urgency Markers: The email was tagged with high-priority flags (Importance: high and X-Priority: 1) and added to the email header to prompt the urgency banner in Outlook and other email clients that recognize such headers, increasing the importance of the message next to the login information. The country, IP address, browser, and operating system were added directly into the HTML code as text rather than using "merge fields" that can be replaced by personalized data.
• Classification & Severity: The attacker isn't stealing passwords right away, their main goal is target validation. By using reply links and hidden trackers, they are testing if your email is active and if you will take the bait. Once confirmed, they can follow up with a scam.

Risk Overview

Danger Level- Medium

Category- Reconnaissance / Setup Phase

Main Trick- Pretending to be a trusted brand using a fake sender address to spy on the victim

Secondary Trick- Hiding random words to trick spam filters, plus using an invisible tracker to see if the email was opened

Key Takeaways & How to Stay Safe

Lock Down Email Spoofing: Organizations need to set their email protection systems to automatically block fake emails before they ever reach an employee's inbox. Leaving these settings optional gives attackers a free pass to impersonate trusted brands.

User Awareness: Always look closely at who really sent the message and where a reply will actually go, rather than trusting the friendly name shown at the top.

Disable Auto-Loading Images: Keep image loading turned off by default in your email app. Attackers hide invisible pictures in emails to secretly track when you open them, where you are, and what device you're using.

Look Beyond the Surface: Real security checks mean looking past the main email text. Checking the hidden email details is the only way to see the real server that sent the message, which scammers can't fake.

Disclaimer: This post is for educational and security research purposes. All personal details have been removed, and the sample comes from a public research database.