This is a continuation of Phishing Investigations, Part 6.
When I began investigating these emails, I did not expect the project to last this long.
The first messages appeared to come from someone familiar to me and claimed to contain photographs that I would recognize. I knew the person was real, but I also knew they did not send the messages.
That gave me a question to investigate: Why was someone using that name to contact me?
Over the course of this series, I preserved the original email files, examined their headers, compared timestamps, researched sender addresses and domains, studied the changing links, and searched for public information that might connect the campaign to something already known.
I never identified the person operating the campaign.
However, I learned much more than I expected.
It Was a Repeatable Campaign
The messages were not simply unrelated pieces of spam.
They repeatedly used familiar names, photographs, memories, and curiosity to get me to click the link. They were also written to look like replies to conversations I never had. Though, that seems pretty common with sales spam.
At one point, the campaign used a different familiar name while retaining the same general structure and technical patterns. This suggested that the name was a replaceable part of the lure rather than the true identity of the sender.
It also suggested that the campaign had access to some type of relationship information connecting me with people I know. I could not determine where that information came from, and I do not have enough evidence to blame any particular website, service, or data breach.
That remains an unanswered question.
The Timestamp Pattern
One of the most useful clues appeared in the fake reply text inside the messages.
The emails included a line claiming that the familiar person had written an earlier message but that earlier conversation did not exist in my mailbox.
When I compared the quoted time in the message body with the actual sending time in the email headers, the quoted time was two hours and seven minutes earlier.
In fact, in every message where I could reliably compare both times, the difference was 127 minutes.
The quoted time was part of the message body and could have been created or changed by the sender, so it was not trusted header information. However, the repeated offset became a useful campaign fingerprint.
This fingerprint is consistent with an automated system or reusable template generating fake conversation history. It did not reveal which tool was used or who operated it, but it helped connect messages that might otherwise have appeared unrelated.
The Links Changed
The earlier messages used links with a distinctive structure, including a repeated path and a nonstandard port.
Later messages used simpler links and different domains.
At first, this looked like a different campaign. However, several other features remained: the photograph-based lure, the familiar names, the fake reply format, and the repeated timestamp difference.
I believe that the web infrastructure changed or updated while the underlying campaign continued.
Unfortunately, all of the domains had stopped responding by the time I investigated them. Searches using threat-intelligence services, public scan results, DNS records, registration information, and search engines produced little useful evidence.
Where the Messages Appeared to Come From
The sender addresses belonged to unrelated schools, businesses, universities, and other legitimate-looking organizations in several countries.
Across the messages I examined, Microsoft-added cross-tenant fields repeatedly contained labels such as Internal, Hosted, and HOSTED. Many of the associated sender domains also used Microsoft-hosted email services.
This is more consistent with the messages passing through real Microsoft-hosted environments than with someone merely typing a forged address into the visible From field.
However, it does not prove that an attacker stole a particular employee’s password or signed directly into a mailbox.
A mailbox might have been compromised, but an application, service account, connector, or another authorized sending mechanism could also have been abused. Determining which explanation is correct would require internal sign-in, audit, application, and message-trace records that I do not have.
The evidence provides a useful direction, but not a complete answer.
The Searches That Went Nowhere
I searched each sender address in several ways.
I searched for the exact address, the username combined with its organization, and the address combined with terms such as “phishing.” I also searched distinctive phrases from the messages and researched the organizations connected with the sender domains.
Almost all of those searches produced nothing useful.
One address contained a name that led to possible public profiles, but there was not enough evidence to connect any person in those results with the mailbox or the messages. A matching name is not proof of identity, ownership, or involvement.
The lack of search results was also not proof that an address was fake. Employee, student, service, and internal accounts may never appear in public search engines.
Eventually, the lack of reliable results became a reason to stop searching.
What the Evidence Supports
After reviewing the collected messages, I believe the evidence supports the following conclusions:
- The messages were part of a repeatable phishing campaign rather than isolated spam.
- The campaign used names familiar to recipients as part of its social-engineering lure.
- Photographs and memories were used to create curiosity and encourage clicks.
- The messages fabricated earlier conversations to appear more trustworthy.
- The fake conversation timestamps repeatedly used the same 127-minute offset.
- The URL infrastructure changed while other campaign fingerprints remained.
- The messages appeared to travel through multiple unrelated Microsoft-hosted environments.
- The public sender and domain searches did not identify the attacker.
What I Still Cannot Say
Several important questions remain unanswered.
I do not know who operated the campaign.
I do not know where the relationship information came from.
I do not know exactly how the Microsoft-hosted sending environments were accessed or abused.
I also never recovered an active landing page, so I cannot say what would have happened after someone clicked a link. Credential theft is possible, but malware delivery, victim tracking, or another second-stage scam are also possible.
Knowing When to Close an Investigation
This may be the most important lesson I learned from the project.
An investigation does not always end by identifying an attacker. Sometimes it ends because the available evidence has been taken as far as it can reasonably go.
Going further would probably require information held by Microsoft, the affected organizations, hosting providers, registrars, or law enforcement.
So I am closing this investigation here.
I have kept the original emails and the indicators collected during the investigation in my private records. If another message from the campaign arrives, I will preserve the original email file and compare it with the existing evidence.
If the next suspicious site is still active when that happens, there may be another chapter to write.
For now, the case file is closed.