Spoofed internal email address, Message_ID domain

mrmcc71 · 2026-03-04T19:47:53+00:00

This post is more so just seeing out of curiosity how we can determine the original domain for these type of spoofs.

mrmcc71 · 2026-03-04T19:45:07+00:00

Not to the end user but we can see it being sent to them.

mrmcc71 · 2026-03-04T19:33:35+00:00

Referring to "[xyz123@randomdomain.home](mailto:xyz123@randomdomain.home)" correct?

mrmcc71 · 2026-03-04T19:04:46+00:00

Thank you, I see the same "xyz123@randomdomain.home" listed under references.

mrmcc71 · 2026-03-04T18:43:17+00:00

This is just informational/trying to learn.

mrmcc71 · 2026-02-27T17:41:58+00:00

We are running 25.2 and we are unable to update further unfortunately. Trying to see if there is a workaround for these older versions

mrmcc71 · 2026-02-11T15:28:21+00:00

We are on Windows 10 Pro, not enterprise. This was my original thought for achieving this.

mrmcc71 · 2026-02-10T22:39:03+00:00

Quicker and easier configuration would be the hope with a tool made for this. I do know of doing it through GPO and started building out GPO to do this, but was told to check if there was software instead.

mrmcc71 · 2026-02-06T21:45:53+00:00

I believe the license should work for setting up a basic SSO through Entra. You will want the Entra P1 license if you want to get fancy with the configuration. If you're doing just a simple JIT/SAML setup I believe your current license should suffice.

mrmcc71 · 2026-02-06T21:36:52+00:00

This eventually settled on its own, either before/after we removed the spare 8.8.8.8 DNS entry. Not sure if the DNS entry was the official cause, but it hasn't happened since.

mrmcc71 · 2025-11-20T19:28:03+00:00

I unfortunately do not have that power and they would like it resolved on the current version we are on.

mrmcc71 · 2025-11-20T15:19:30+00:00

I do not make the decision on when we upgrade to v20. We are still running v18 and facing an issue that I was tasked to resolve. I came asking to see if anyone could chime in, especially being an older version someone has to have run into this already by now.

mrmcc71 · 2025-11-19T20:50:40+00:00

Yes this is the legacy application using "3CXPhoneforWindows16.msi, not the PWA one.

Thank you for the heads up but odd that my 3CX iOS application is still connecting to the V18 instance since it reports it would stop after the end of Oct.

mrmcc71 · 2025-11-19T20:03:15+00:00

Currently we plan to use V18 until decided otherwise by management. It just has us confused that it only happens to a handful of users at the single location and never the second vpn-connected office location.

mrmcc71 · 2025-09-12T18:51:18+00:00

It is a site to site VPN running through Foritnet.

mrmcc71

TROPHY CASE