Email sospette

Question

Buongiorno, mi sono arrivate più di 50 email in pochi minuti da ******@outlook.com, molte per una giacenza BRT che chiede di riprogrammare la spedizione e molte altre come quella che incollo di seguito, in cui cambia solo l'indirizzo email (come ******@live.it). Inoltre contengono un allegato in cui si dice:

            "Abbiamo rilevato attività insolite durante un recente accesso all'account Microsoft ******@live.it

Dettagli accesso

Paese/area geografica: Italy
Indirizzo IP: 35.171.134.57
Data: 2/16/2022-04:37:31 (GMT)
Piattaforma: Windows
Browser: Chrome

****Verifica le attività recenti

Grazie.

Il team dei conti [M S N]"

La mail arrivatami è la seguente:

          **Delivery has failed to these recipients or groups:**

******@live.it
A communication failure occurred during the delivery of this message. Please try to resend the message later. If the problem continues, contact your email admin.

Diagnostic information for administrators:

Generating server: PAXP193MB1501.EURP193.PROD.OUTLOOK.COM

******@live.it
Remote Server returned '550 5.5.0 Requested action not taken: mailbox unavailable (S2017062302).'

Original message headers:

ARC-Seal: i=1; a=rsa-sha256; s=arcselector9901; d=microsoft.com; cv=none;
 b=kHTh3V1Q3pbyJcH/QsQEmbdxh5/7lessOzde7iZuthf6T5Dvs2bYZsThPuQfdtJQJ38YMOcs95ILCl2P5XIQKLSwGYmBMLBdJXNzJfTGN21qrbaTRrooboyxz/U4vKJZkz6MyHdn8p6lmZI8o527Ek/Nabm9ezgACAJvsKzzhJrmQllsKHNQh6+OaRH9TH1ERKD3nJPYzWyEwVHvORb3DeJfqFDdg+G9yl24PL7C2jv62A8oH4qFGr5Ym10rAHFdGpZXhgRYvFllQve2ZRwR32n1V8+YRIVOC2VCjoXv1tP0OcXDMAHHfub1IXrVZHJ+y3uVcTEl9TV9Y7U+5zuAsg==
ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com;
 s=arcselector9901;
 h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1;
 bh=VgIq5AfovKJkYkpYuccEazd2B8nIRivvgEn8rmFIgGc=;
 b=gMx/R3mWuSvZVVs9b7Z7H91wMn+qNjwZG4v/p0kYvzFKYqrL1SzbnLHV9Y2OdFMs5pxHVS8PL7X2hJ9Kwqcr9N3ZV7ZC21yCHEA9eSmFlE0ZSH2eE/Efd8st8KJGovrpYynU6PrbUEwxwIgUhxcNdGHB4mxZ3yEZfl8knvRlMArImkx7EYlecqjn2VEV94X3PfWOMYakiPMMatpTPoSsDMwrcUg/f4sPdh7GvXfQ09m+yIc083WekhCdo0WwBg3ZC5QDQhCcHoN4dudOj46Bvi5sNs4rnVzmHQf9MOLt8V/pNZUeSbK3rlN48Vha+38c4O4wLBgVWtAHiJg2n+lBWA==
ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=none; dmarc=none;
 dkim=none; arc=none
Received: from PAXP193MB1727.EURP193.PROD.OUTLOOK.COM (2603:10a6:102:1c5::11)
 by PAXP193MB1501.EURP193.PROD.OUTLOOK.COM (2603:10a6:102:13e::15) with
 Microsoft SMTP Server (version=TLS1_2,
 cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.4975.15; Wed, 16 Feb
 2022 12:37:32 +0000
Received: from PAXP193MB1727.EURP193.PROD.OUTLOOK.COM
 ([fe80::2083:8db8:48a1:e9e6]) by PAXP193MB1727.EURP193.PROD.OUTLOOK.COM
 ([fe80::2083:8db8:48a1:e9e6%6]) with mapi id 15.20.4995.014; Wed, 16 Feb 2022
 12:37:32 +0000
X-COMMS-C: N
X-Attach-Flag: N
Date: Wed, 16 Feb 2022 04:37:31 -0800
Subject: [MSN_572521] Aggiorna i dettagli. 2/16/2022-04:37:31
Message-ID: <******@PAXP193MB1727.EURP193.PROD.OUTLOOK.COM>
References: <******@t-online.de>
From: (AE0DDE)e-Ticket M S N(C74754) <******@live.it>
To: ******@live.it
Content-Type: multipart/alternative;
 boundary="Apple-Mail=_8C90FAEDB1-EA78-F41D-07A8-E78610176CD"
X-TMN: [GIfbWSf6aK28ShWoI05ok9JJthJK86sn]
X-ClientProxiedBy: ZR0P278CA0176.CHEP278.PROD.OUTLOOK.COM
 (2603:10a6:910:45::21) To PAXP193MB1727.EURP193.PROD.OUTLOOK.COM
 (2603:10a6:102:1c5::11)
Return-Path: ******@live.it
X-Microsoft-Original-Message-ID: <******@t-online.de>
MIME-Version: 1.0
X-MS-Exchange-MessageSentRepresentingType: 1
X-MS-PublicTrafficType: Email
X-MS-Office365-Filtering-Correlation-Id: 0396150f-516a-4bad-fced-08d9f14919eb
X-MS-TrafficTypeDiagnostic: PAXP193MB1501:EE_
X-Microsoft-Antispam: BCL:0;
X-Microsoft-Antispam-Message-Info:
        maEghQYVJp18ZwR84bP83aD+Ea5VlPwYWfdmggWQ8FjppE/41bVEE7r6SCnZiU5ltL09XDYkubXjIlxqDoKjalQKpFQyRoOAHxF2kyf/rm+WF8z4HWvMov+agIbawV2+CqdC+lBWDmHRgucs5IZk8Iv7IDAkR3Bc/g2kWfIgfns2d1DYZVF5kPG2cUaxm2dOrSLQQXslFq1u8ZGPffZqToGytx03dvCv/+pXaBhE1vXvKXFICUiaIRsCQnFjMy5U793xZAM/1xDmshHI0hPxsX+mE/1xhym/tHy9YdZHuGlUw27JuS4qp70BVe8AEUxOv4Bs1vsNWV8ge54hvhNnST28hVcKGmRzpppPz9LHr6W5wVL+4iuJV1i4Kt3pjfNcYfCCTao1UIYupySPhaU82FhYWcX67gG6ePNWN1xyZxnGOt4mgTFD7oFYwbXjmCevOCF82U+DR9Vy/HLPz3WT/5oseIXGKG90bMQb+UU9ZKl0+imev+A3cO0RBaG+fogrY772EFE65NkZswC2nYW29IR/4UT1WYLoken3d9EWO9ywE4XWQznc5PqHIXDzy9gQ/RDqQkWhU/J+/68C5yARfg==
X-MS-Exchange-AntiSpam-MessageData-ChunkCount: 1
X-MS-Exchange-AntiSpam-MessageData-0:
      LiTxkR9ARqUHabVC4R0vI3nbU51twV4HXwMmYxzKlNNXkduJQlukWq+lBP8EIxza12tqnUhSzdvDNKv1s2klkGuYpqcJo7peEeYad3PVF8+QNCB95bML6mnU2jJ2Na+q2cCBMSeyVpin/xGTT/sYAqhm0OMdOpu/W2cYS8AJ46/RyTAgby3t+a74zZu+IwTqYcPhm6+S76bkFdybbrYuvlVTWbsvlfuX2JK/rF4/aD35h4lZXyu7XspeAtdPD0lXe2FZo+Yr35ldymC48ivoc/YexfzQ3t87w7QE3jy3+eD5ecpe5jOYjou/OFMTrJT6YCHzoDaBd0e8mt5N3Z8jRDTauaj4WLfze4gBuHEbfGfDE9fmxjfmJjAsBslW2ZusC0zj6C7EvXr2lg46MfDq9fDbn6Ml+bGc1mlx2b8fRExQTl0MDYhTP398z47pOWEmQhQZr1a2aucxTSK93F4SFeVAgIfh8pdzZt3r+YAw7tXK92I3/nRjPPXOrGecX+3Coqhr0cstWXBl/SUhd+05LG/U8hYSW1jn+jJB3Jw9/HplEBrJ9TEYB5jSjH7HPe+Bc64gy5EAiNRWaXGSA/PaYoUP/02hpG4ut2ec3XzPxTT0vALwtK75/R2SMSkcu2JINK6ZX0txGOy33KiF+HhH+A1eqpOf7WS0ZmRuIpUm2Q94bYkXScQA7LuMZsq6mmibi70O1k/v441ibAvCGaxX6mi89vqYPmuo3gISAK9Mu2dg3oWjbaqYWTUO4DC8KLss5D77Ddgd22l+96rll2ByyG9LiQb6FCpLU2kCutZPSaHyAOwVjE2FNQrZbxsGNkMznSxQfAxjxgoPPS1AgSNMtnsAD3Nfowp0uTSdki7r1LM98pT6MnwnYwLgXoklNn8NnjaolH+Y2v8NGAzKXHPlhhj94icL2tBkEzumvYnX69XUESUA9zdK1DPrbTG0oTZeihdDGL9wKLaRN2Qkj6kp+Q==
X-OriginatorOrg: sct-15-20-4755-11-msonline-outlook-80ceb.templateTenant
X-MS-Exchange-CrossTenant-Network-Message-Id: 0396150f-516a-4bad-fced-08d9f14919eb
X-MS-Exchange-CrossTenant-AuthSource: PAXP193MB1727.EURP193.PROD.OUTLOOK.COM
X-MS-Exchange-CrossTenant-AuthAs: Internal
X-MS-Exchange-CrossTenant-OriginalArrivalTime: 16 Feb 2022 12:37:32.1770
 (UTC)
X-MS-Exchange-CrossTenant-FromEntityHeader: Hosted
X-MS-Exchange-CrossTenant-Id: 84df9e7f-e9f6-40af-b435-aaaaaaaaaaaa
X-MS-Exchange-CrossTenant-RMS-PersistedConsumerOrg:
        00000000-0000-0000-0000-000000000000
X-MS-Exchange-Transport-CrossTenantHeadersStamped: PAXP193MB1501

Answer 1

Ciao,
Sono Nunzio, un utente esperto dei prodotti Microsoft, benvenuta in community.
Nei giorni scorsi c'è stato un attacco di Phishing, con cattura di email e password, è probabile che anche il tuo account sia stato colpito.
La prima cosa da fare, se non lo hai fatto già, è cambiare Password, di seguito la guida al cambio:
https://support.microsoft.com/it-it/help/402683...

Inoltre personalmente ti consiglio di abilitare l'autenticazione a due fattori:
https://support.microsoft.com/it-it/help/402858...

Controlla anche le attività recenti del tuo account per scoprire se ci sono stati accessi esterni, e soprattutto se continuano dopo aver cambiato password:
https://support.microsoft.com/it-it/help/13782/...

Verifica anche di non avere regole di posta o impostazioni "strane" accedi ad https://outlook.com, clicca sull'ingranaggio in alto a destra, quindi in basso su "Visualizza tutte le impostazioni di Outlook". Verifica se tra le impostazioni di Outlook (regole, inoltro, spam, ecc.), ci sono impostazioni che non riconosci, e modificale o eliminale.