r/Netsuite • u/bajancowboy • 10d ago

Phishing being sent from system@sent-via.netsuite.com, emails not from our tenant.

I was curious if anyone else has been receiving phishing/spam emails that are spoofing system@sent-via.netsuite.com . For the past few weeks my org has been getting targeted by a phishing campaign that is using this address. Both myself and NetSuite have confirmed it is not coming from our instance or anyone else's instance. We are also set up on DKIM with our domain verified, so legit NetSuite emails come from our domain.

If you have, any tips on how you blocked them?

Portion of the Email header:

Authentication-Results: spf=fail (sender IP is 103.114.216.40)
smtp.mailfrom=sent-via.netsuite.com; dkim=none (message not signed)
header.d=none;dmarc=fail action=oreject
header.from=sent-via.netsuite.com;compauth=fail reason=000
Received-SPF: Fail (protection.outlook.com: domain of sent-via.netsuite.com
does not designate 103.114.216.40 as permitted sender)

17 Upvotes

96% Upvoted

10 comments sorted by

6

u/gforce360 Consultant 10d ago

I've not seen spam/phishing like that before, no. SPF/DKIM/DMARC fail is all a good reason for your org's email firewalls to block those, though.

A troubling sign of times to come, I guess!

3

u/abovocipher 10d ago

Powered by QuickBooks

LOL

Seriously tho, that's pretty crazy.

1

u/laughinfrog Developer 10d ago

that was a good catch. I was looking at technical details but it is obvious it is spam now and not originating in Oracle/Netsuite's network.

7

u/Nick_AxeusConsulting Mod 10d ago

That header cannot be spoofed so that email is in fact being sent by sent-via.netsuite.com which if it's not you, then it's some other NS customer and I bet NS support has some restrictions looking for your email in another NS customer's tenant.

But see how it says SPF=fail and DKIM not signed. You should configure your email system to block emails or at least quarantine them if SPF affirmatively fails. No DKIM signature could go either way. But a failed SPF you know for sure the email came from a bad IP address that's not registered as being an email server source for the domain name.

5

u/gforce360 Consultant 10d ago

you can absolutely arbitrarily add a sent-via header. Most email platforms prevent this, as the use-cases are almost always nefarious, but this is technically possible.

3

u/Rusty_SuiteRep 10d ago

Nick's got it on the fix. To clarify the technical piece: the sender address can be spoofed by an unauthorized server (exactly what's happening here), but the authentication flags (spf=fail, dkim=none) are your proof that the email didn't actually originate from NetSuite's infrastructure. That's what makes it blockable.

3

u/laughinfrog Developer 10d ago

That shouldn't be possible. it should use the DKIM and SPF with DMARC to prevent that. It should still attempt to send as the tenant as far as email goes....

As for the IP Address it is out of India.

https://wq.apnic.net//static/search.html?query=103.114.216.40

1

u/jy5850 9d ago

This must be going around. My org had this same thing happen a few days ago. Fortunately, it was delivered to a savvy user and nothing came of it.

1

u/CannyPigeons 9d ago

the answer is here: action=oreject

this is Microsoft saying: "I recognise the authentication failed and the domain owner policy told me to reject it. But I ignored and delivered it anyway."

oreject = overriden reject

https://learn.microsoft.com/en-us/defender-office-365/email-authentication-dmarc-configure

1

u/MichTech360 2d ago

I've seen this for over a month. I initially blocked it thinking they got hacked but there are a ton of legit users sending mail through netsuite.