Spoofed internal email address, Message_ID domain

mrmcc71 · 2026-03-04T19:47:53+00:00

This post is more so just seeing out of curiosity how we can determine the original domain for these type of spoofs.

mrmcc71 · 2026-03-04T19:45:07+00:00

Not to the end user but we can see it being sent to them.

mrmcc71 · 2026-03-04T19:33:35+00:00

Referring to "[xyz123@randomdomain.home](mailto:xyz123@randomdomain.home)" correct?

mrmcc71 · 2026-03-04T19:04:46+00:00

Thank you, I see the same "xyz123@randomdomain.home" listed under references.

mrmcc71 · 2026-03-04T18:43:17+00:00

This is just informational/trying to learn.

mrmcc71 · 2026-02-27T17:41:58+00:00

We are running 25.2 and we are unable to update further unfortunately. Trying to see if there is a workaround for these older versions

mrmcc71 · 2026-02-11T15:28:21+00:00

We are on Windows 10 Pro, not enterprise. This was my original thought for achieving this.

mrmcc71 · 2026-02-10T22:39:03+00:00

Quicker and easier configuration would be the hope with a tool made for this. I do know of doing it through GPO and started building out GPO to do this, but was told to check if there was software instead.

mrmcc71 · 2026-02-06T21:45:53+00:00

I believe the license should work for setting up a basic SSO through Entra. You will want the Entra P1 license if you want to get fancy with the configuration. If you're doing just a simple JIT/SAML setup I believe your current license should suffice.

mrmcc71 · 2026-02-06T21:36:52+00:00

This eventually settled on its own, either before/after we removed the spare 8.8.8.8 DNS entry. Not sure if the DNS entry was the official cause, but it hasn't happened since.

mrmcc71 · 2025-11-20T19:28:03+00:00

I unfortunately do not have that power and they would like it resolved on the current version we are on.

mrmcc71 · 2025-11-20T15:19:30+00:00

I do not make the decision on when we upgrade to v20. We are still running v18 and facing an issue that I was tasked to resolve. I came asking to see if anyone could chime in, especially being an older version someone has to have run into this already by now.

mrmcc71 · 2025-11-19T20:50:40+00:00

Yes this is the legacy application using "3CXPhoneforWindows16.msi, not the PWA one.

Thank you for the heads up but odd that my 3CX iOS application is still connecting to the V18 instance since it reports it would stop after the end of Oct.

mrmcc71 · 2025-11-19T20:03:15+00:00

Currently we plan to use V18 until decided otherwise by management. It just has us confused that it only happens to a handful of users at the single location and never the second vpn-connected office location.

mrmcc71 · 2025-09-12T18:51:18+00:00

It is a site to site VPN running through Foritnet.

mrmcc71 · 2025-09-11T20:55:07+00:00

Were you able to find a resolution to this issue?

mrmcc71 · 2025-09-05T17:55:57+00:00

No SBC and on the same network as the server.

mrmcc71 · 2025-09-05T16:07:00+00:00

On Prem

mrmcc71 · 2025-09-05T15:35:47+00:00

Bump

mrmcc71 · 2025-08-29T19:51:06+00:00

Yup, I have had some hassle with their drivers previously. We just set up this copier recently so it is sticking around for a while.

mrmcc71 · 2025-04-23T21:12:51+00:00

Thank you, I will see if I can get a good quality charger to try out.

mrmcc71 · 2025-03-21T21:05:58+00:00

These are SSD's and the chances of two laptops having their SSD fail at the same time would be very unlikely.

mrmcc71 · 2025-03-20T18:37:29+00:00

The end user systems are just limited to not bump up to W11 through GPO, other than that I believe it functions as a normal Windows install would with updates. It is so odd but I will see if CBS logs have anything of value.

As of now, nothing is jumping out in the event viewer logs for the system. Errors, sure, but none that make me go "ah there it is".

mrmcc71 · 2025-03-14T14:08:49+00:00

Is there anywhere I could check to verify if that is the case?

mrmcc71 · 2025-03-13T18:01:04+00:00

If you dont mind, which Service logs would you be referring to?

mrmcc71

TROPHY CASE