My ChatGPT Phishing Email Analysis

As I had mentioned in the last post, I noticed what I thought was a phishing email in my Inbox. This time, I did a ChatGPT phishing email analysis.

I always share that I like using Microsoft Outlook web mail for my Office 365 account. Having been in the web business in excess of 28 years I am most confident saying it is the most secure 🔐 email to use for one’s business or personal connecting. Whether you are running a business or use email only for personal use, security is a must because our email is tied to many aspects of our lives.

When I see a phishing or otherwise bad actor originated email that perplexes me, I investigate it to learn more about it. This is important to me because one of my purposes in life is to help my web clients avoid what can be difficult issues to avoid concerning their email.

Gemini Result Was Just Way Off Base

I was taken aback with my Gemini result posted in the last post. It warned me that my account should be treated as potentially compromised until confirmed otherwise. Again, I would say this is normally good advise – to always prove the account is safe when in doubt. However, it is an expensive endeavor when – like most of my web clients – one has to hire a firm like ours or an IT firm to go through the necessary steps to investigate.

The output from Gemini proved what all the AI outputs usually indicate: that they can be wrong. Gemini’s outlput also pointed out the importance of what I would choose: a second opinion. My second opinions usually come in the form of using one or more separate AIs to examine a problem of this nature. If they all agree, great! When two out of three agree, that’s still a good indication. But if none agreed, I’m probably not asking the right question.

The most important thing I learned in my master’s degree studies: it’s all about knowing the right questions to ask.

Here is exactly what I asked ChatGPT followed by its confirmed correct assessment and followup info I provided it. Note that ChatGPT asked for more information based in its suspicions. My experience in these matters verifies its behavior based on what I would have done:

I am trying to find out where this message came from and why it ends up in my Inbox. I use Outlook web mail and I believe it may be a phishing message but the option to “Report” it as either spam or phishing do not show up when I right click on it (although that option shows on other emails). It indicates it was sent by ro***@**********ks.com but there is only an alias for ro***@**********ks.com to su*****@**********ks.com and mail could not have been sent from that nonexistent address:

This message was created automatically by mail delivery software. Your email message was not delivered to the intended recipients because malware was detected.

— Additional Information —:

Subject: -Caller left 34s September 19, 2026 – cJIBRTd8.

Sender: ro***@**********ks.com

Time received: 9/19/2026 4:10:15 AM

Message ID:<[1789791014415.e37452553538c5d1-JFZGS42DN5WW25LONFRWC5DJN5XFA3DBORTG64TNFVIHE33EFVGVOMKQPREUCTKTKNIFE7CTKNIFERLNMFUWY7CFPBXVG3LUOA======@charlesworks.com]>

Detections found:

Vrecording_Erecorded_ATT61.svg..        Script/SvgStealer.ADX!MTB

The “view Massage” option in my Outlook web mail shows me this:

Received: from PH8PR11MB7024.namprd11.prod.outlook.com (2603:10b6:510:220::19)

 by SAVPR11MB9574.namprd11.prod.outlook.com with HTTPS; Sat, 19 Sep 2026

 04:10:18 +0000

Received: from SmtpServer.Submit by PH8PR11MB7024 with Microsoft SMTP Server

 id 15.21.406.11; Sat, 19 Sep 2026 04:10:18 +0000

MIME-Version: 1.0

Content-Type: text/plain; charset=”utf-8″

From: Postmaster <po********@**********ks.com>

Subject: Undeliverable message

Content-Transfer-Encoding: quoted-printable

To: <su*****@**********ks.com>

Message-ID:

 <7f**********************************@*********************************ok.com>

Return-Path: po********@**********ks.com

Date: Sat, 19 Sep 2026 04:10:18 +0000

X-MS-Exchange-Organization-ExpirationStartTime: 19 Sep 2026 04:10:18.2837

 (UTC)

X-MS-Exchange-Organization-ExpirationStartTimeReason: OriginalSubmit

X-MS-Exchange-Organization-ExpirationInterval: 1:00:00:00.0000000

X-MS-Exchange-Organization-ExpirationIntervalReason: OriginalSubmit

X-MS-Exchange-Organization-Network-Message-Id:

 29b93226-d43b-478f-fcd1-08df1603ea60

X-MS-Exchange-Organization-AuthSource: PH8PR11MB7024.namprd11.prod.outlook.com

X-MS-Exchange-Organization-AuthAs: Internal

X-MS-Exchange-Organization-AuthMechanism: 05

X-MS-Exchange-Parent-Message-Id:

 <[1789791014415.e37452553538c5d1-JFZGS42DN5WW25LONFRWC5DJN5XFA3DBORTG64TNFVIHE33EFVGVOMKQPREUCTKTKNIFE7CTKNIFERLNMFUWY7CFPBXVG3LUOA======@charlesworks.com]>

Auto-Submitted: auto-generated

X-MS-Exchange-Generated-Message-Source: DC Post Content Filter Agent

X-MS-PublicTrafficType: Email

X-MS-TrafficTypeDiagnostic: PH8PR11MB7024:EE_|SAVPR11MB9574:EE_

X-MS-Exchange-Organization-SCL: 1

X-Microsoft-Antispam:

 BCL:0;ARA:13230040|1930700014|366016|56012099006|12063799003|10067099003|18002099003|41050700001;

X-Forefront-Antispam-Report:

 CIP:255.255.255.255;CTRY:;LANG:en;SCL:1;SRV:;IPV:NLI;SFV:NSPM;H:;PTR:;CAT:NONE;SFS:(13230040)(1930700014)(366016)(56012099006)(12063799003)(10067099003)(18002099003)(41050700001);DIR:INT;

X-MS-Exchange-CrossTenant-OriginalArrivalTime: 19 Sep 2026 04:10:18.2834 (UTC)

X-MS-Exchange-CrossTenant-Network-Message-Id:

 29b93226-d43b-478f-fcd1-08df1603ea60

X-MS-Exchange-CrossTenant-AuthSource: PH8PR11MB7024.namprd11.prod.outlook.com

X-MS-Exchange-CrossTenant-AuthAs: Internal

X-MS-Exchange-CrossTenant-FromEntityHeader: Hosted

X-MS-Exchange-Transport-CrossTenantHeadersStamped: PH8PR11MB7024

X-MS-Exchange-Organization-MessageDirectionality: Originating

X-MS-Exchange-Transport-EndToEndLatency: 00:00:00.6486099

X-MS-Exchange-Processed-By-BccFoldering: 15.21.0428.008

X-MS-Exchange-ExternalInOutlookResult: NotEnabled

X-Microsoft-Antispam-Mailbox-Delivery:

ucf:0;jmr:0;auth:0;dest:I;ENG:(910005)(944506478)(944626604)(920097)(425001)(930201)(20251009189)(140003);

X-Microsoft-Antispam-Message-Info:

xuNr8XT2UiI8kmeQ7vTwjjloBhzPu/NOSnDZ8nYwnyjaERxMG5YzKr35E2fY/Ja+bMQAd9LPy0fbIn9ejg8cTQVMmPfNLeEQ2Krgx1F6DxdeAufyJfN0jjFjkgr4eUrr2/bahM6aMBHXalIKcAy0HqlN100CggPEgGABIWOyuhttlvvX/Tdl0OViDHgOtPw9lCUi1vx3u/zwNovLrZltOsoVBKT/yggFMCquH/6gm1d95gnQwZhhRUYH/lVN/UZfdx1XLWUt3eaO5VMl0CHnw/MKpu8dDHsYtn9u89Q1Zk8lS0MPCxKuuvBkGfobsYvR+kOsCf7+Arz/ltMO99w5DuocxkuDLLFNO4DfSWRkw+Ovm2XBelFakkrv0WHSK4q+08Allgeox1hWGEIeknDBwIWj0t6JkmiqIW3FWVhFzFqArsBfbqZaxGWo3PZOFgTBpRoALq3aJ86kISw1OZVs9IBDZYht0367UoWe0GImW808FeuiC1efb1Emfx686OW0NddoP36TMqjiEaOBKCrkSklyc1Gk7wEPX1vDGA+u0tCkEnOl3Pj/aqaQqXwirS9F0ZTRdRwUxpS6SR0fb3IRUdcGG++r8+BxYwHa1vOSlSC8u8/Gy1ZJIK/fxdcp2A35orzJRsFY4ftB+TK5nYos5allhlQdZEzdYMeD/nbof0pj81gJ/Z1dCCgVXF8NicNIJAlgFMbkCDqPRay9qsAhg4zM/bXaghQAqwCw1PpGHnOn0oetsOiyqpNJpj9SVGvSIRJT2T6bVN0m/pjRXFujF8cwU+AZq6wPtCxvdRodrAX63c4ZUjcykjCZmsC9I7fL

What you are seeing is not the original malicious message. It is a Microsoft Exchange Online-generated delivery failure notice created after Microsoft detected malware in another message.

Several headers make that clear:

• From: Postmaster <po********@**********ks.com>
• X-MS-Exchange-Organization-AuthAs: Internal
• X-MS-Exchange-Organization-MessageDirectionality: Originating
• X-MS-Exchange-Generated-Message-Source: DC Post Content Filter Agent
• Auto-Submitted: auto-generated

So the message sitting in your Inbox was generated inside Microsoft’s mail system. That also explains the odd behavior you’re seeing in Outlook.

Why “Report phishing” is missing

Microsoft considers this particular message an internal system-generated notification, not an Internet email.

These headers reinforce that:

X-MS-Exchange-Organization-SCL: 1
SFV:NSPM
DIR:INT

SCL: 1 is a very low spam score, NSPM means Microsoft’s filter classified it as not spam, and DIR:INT identifies the delivery as internal.

Consequently, Outlook apparently isn’t offering you the normal Report → Junk / Phishing choices. There really isn’t much point in reporting this particular message anyway—the malicious message was the parent message, and Microsoft already caught it.

The interesting part is ro***@**********ks.com

The important distinction is this:

An email absolutely can claim to be from ro***@**********ks.com even though no mailbox named Robin exists.

SMTP does not require the address in the sender field to correspond to a real mailbox. A spammer can send something like:

MAIL FROM:<ro***@**********ks.com>
From: ro***@**********ks.com

from a server anywhere in the world.

The fact that ro***@**********ks.com is an alias of su*****@**********ks.com explains very nicely why the resulting failure notice wound up with:

To: <su*****@**********ks.com>

Microsoft attempted to return the failure notice to the purported sender, ro***@**********ks.com. Since Microsoft 365 knows that address belongs to the support mailbox, the notification wound up in support’s Inbox.

In other words, this has all the hallmarks of backscatter caused by a spoofed sender address.

The SVG malware is another big clue

The blocked parent message had:

Subject: -Caller left 34s September 19, 2026 - cJIBRTd8.

and Microsoft found:

Vrecording_Erecorded_ATT61.svg
Script/SvgStealer.ADX!MTB

That looks very much like the current style of fake voicemail/call recording phishing lure. The .svg attachment contained scripting Microsoft classified as credential-stealing malware.

So I would not open or attempt to recover that attachment.

But we can determine where the original message really came from

The NDR fortunately gives us the original message ID:

<[1789791014415.e37452553538c5d1-JFZGS42DN5WW25LONFRWC5DJN5XFA3DBORTG64TNFVIHE33EFVGVOMKQPREUCTKTKNIFE7CTKNIFERLNMFUWY7CFPBXVG3LUOA======@charlesworks.com]>

It appears again here:

X-MS-Exchange-Parent-Message-Id:

That gives us something very useful to hunt down in your Microsoft 365 message trace.

Go to:

https://admin.exchange.microsoft.com/

Then go to Mail flow → Message trace.

I’d search a window around:

September 19, 2026, 04:10 UTC

which is September 19, 2026, 12:10 AM Eastern Daylight Time.

First try:

Sender:
ro***@**********ks.com

and leave the recipient unrestricted if Exchange lets you.

I’d use perhaps 04:00 through 04:20 UTC to keep the results small.

What we want to see

If the trace shows something equivalent to an incoming Internet message with a remote sending IP, then we’ve nailed it:

Someone on the Internet spoofed ro***@**********ks.com, Microsoft detected malware, generated an NDR to the spoofed sender, and because Robin is an alias of Support, you received the NDR.

That is what I presently think happened.

However, if the trace shows that the parent message was submitted/authenticated within your Microsoft 365 organization, that becomes much more interesting. Then we would want to determine whether it came from:

• the support mailbox using the Robin alias,
• an authenticated SMTP client,
• a Microsoft 365 account,
• an application,
• a connector,
• or another authorized sending mechanism.

I do not see evidence in the headers you’ve provided that the Robin account was compromised. In fact, since Robin isn’t an account, that particular scenario makes little sense. The AuthAs: Internal header applies to the NDR you’re reading, not necessarily to the malicious parent message. That’s an important distinction.

So my working theory is:

Internet attacker → spoofed ro***@**********ks.com → malicious fake voicemail message → Microsoft malware filter catches it → Microsoft sends failure notice back to Robin → Robin alias resolves to Support → NDR lands in your Inbox.

If you give me the message trace details for the parent message, we should be able to prove or disprove that theory and, hopefully, identify the actual sending IP.

Received: from BN9PR03CA0851.namprd03.prod.outlook.com (2603:10b6:408:13d::16)

by PH8PR11MB7024.namprd11.prod.outlook.com (2603:10b6:510:220::19) with

Microsoft SMTP Server (version=TLS1_2,

cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.21.406.11; Sat, 19 Sep

2026 04:10:15 +0000

Received: from BN2PEPF0000A894.namprd04.prod.outlook.com

(2603:10b6:408:13d:cafe::20) by BN9PR03CA0851.outlook.office365.com

(2603:10b6:408:13d::16) with Microsoft SMTP Server (version=TLS1_3,

cipher=TLS_AES_256_GCM_SHA384) id 15.21.428.13 via Frontend Transport; Sat,

19 Sep 2026 04:10:15 +0000

Authentication-Results: spf=none (sender IP is 192.3.183.94)

smtp.helo=mta-80-125.sparkpostmail.com; dkim=none (message not signed)

header.d=none;dmarc=fail action=quarantine

header.from=charlesworks.com;compauth=fail reason=000

Received-SPF: None (protection.outlook.com: mta-80-125.sparkpostmail.com does

not designate permitted sender hosts)

Received: from mta-80-125.sparkpostmail.com (192.3.183.94) by

BN2PEPF0000A894.mail.protection.outlook.com (10.167.248.186) with Microsoft

SMTP Server (version=TLS1_3, cipher=TLS_AES_256_GCM_SHA384) id 15.21.451.8

via Frontend Transport; Sat, 19 Sep 2026 04:10:15 +0000

Return-Path: <>

From: ro***@**********ks.com

To: Robin <ro***@**********ks.com>

Subject: -Caller left 34s September 19, 2026 – cJIBRTd8.

Message-ID: <[1789791014415.e37452553538c5d1-JFZGS42DN5WW25LONFRWC5DJN5XFA3DBORTG64TNFVIHE33EFVGVOMKQPREUCTKTKNIFE7CTKNIFERLNMFUWY7CFPBXVG3LUOA======@charlesworks.com]>

Date: Sat, 19 Sep 2026 04:10:14 +0000

MIME-Version: 1.0

Content-Type: text/plain

X-EOPAttributedMessage: 0

X-EOPTenantAttributedMessage: 87733afe-0d9d-4701-bcd1-865bd5674a0b:0

X-MS-PublicTrafficType: Email

X-MS-TrafficTypeDiagnostic: BN2PEPF0000A894:EE_

PH8PR11MB7024:EE_

X-MS-Office365-Filtering-Correlation-Id: de0283ca-ed7e-4553-f9b1-08df1603e88e

X-MS-Exchange-AtpMessageProperties: SA

SL

X-Forefront-Antispam-Report: CIP:192.3.183.94;CTRY:US;LANG:en;SCL:9;SRV:;IPV:NLI;SFV:SPM;H:mta-80-125.sparkpostmail.com;PTR:192-3-183-94-host.colocrossing.com;CAT:AMP;SFS:(13230040)(5009299003)(6049299003)(29132699027)(260918215300599003)(260918224100599003)(5063699009)(10067099003)(18002099003)(55112099003)(19002099009)(4053099003)(57112099003);DIR:INB;

X-Microsoft-Antispam: BCL:0;ARA:13230040

5009299003

6049299003

29132699027

260918215300599003

260918224100599003

5063699009

10067099003

18002099003

55112099003

19002099009

4053099003

57112099003;

X-Microsoft-Antispam-Message-Info: =?us-ascii?Q?6hEd90HgmiMpox31IEQxVxzcBToOab3qD3knO+p3n5bIHQyfxQ9uiHWVCRl2?=

=?us-ascii?Q?gq2BEwBVxpEF1SFdx5uujuYSw1aqU14WB2OgQnVz6hHBW+ZB6/tEUyTAvOAj?=

=?us-ascii?Q?ctZmS9QioFJ/dqnLulvOdr6cx7D+ub7MOzgX+TD3vc/n/xgjMdqMdkl8UTWC?=

=?us-ascii?Q?WI5XYa9Ec9+9ybXxz1lKFBqbF9ETYtj7jAYgbwxQet6DUoqOv1gn6/azfF+U?=

=?us-ascii?Q?sGv198ljoKLBMQEZsK1aPgAMKC/k5TbmPjSav9pLar1ulwnMKkcq/P75HiO2?=

=?us-ascii?Q?mMIFPBJ71LWAdHE2vAnrWuH2tP9JmpOwSM3/TRzprcEJJA6py8JK+eHF5mPX?=

=?us-ascii?Q?83JTV2+jTBcKsQURERAZdonS8izIBAfTQ930VKQFylFeF46EMlEzsdn4GoZN?=

=?us-ascii?Q?8lv9KjRT8tAvEhsC8wYEDTXRhIhenEqK8e+m52PlV2jWyT8deEcCAtUNc0lB?=

=?us-ascii?Q?KT0S85AgvGAdMJPTdMMmQrkElN/6faU68PbTr/pUjVurxn9Flgiy0AqsIwsN?=

=?us-ascii?Q?HhnuHJXljMc0CnFtnzc0fziXucrdVH2mgoI0+Ug++UL0lZHxMeMPoe97TaWi?=

=?us-ascii?Q?W+F86blHHdZmG/oIDvhVNNbTFpceeuUaZ0YUUWOuKCsgwCWE4CA4v7Wkc6R2?=

=?us-ascii?Q?k7Mf6DZX1dg1RZa99RPb7THWob4Opc+uQQw2rxgrA6Ud1LfKFvyIlk5A4O6Z?=

=?us-ascii?Q?oJBTbEVcsKgjPHNwe18ssQ6O2Ol+KKEB1KT5oCFdmN2Z3b/0w+2VFI2O1z4N?=

=?us-ascii?Q?Sgr/4oF4vh/ERn073CGS8jyzUprS1eE+NtDaanx3tznTA37163ZqEzudtb9d?=

=?us-ascii?Q?Ual9i88maSy0JY91Nq4m/jTnvn1Kkyn+RCxRSfJhcRIqVSFX5Nm5o9u4HXNq?=

=?us-ascii?Q?cP05yaUaI0gO8K84pjjF7egluzXz1JCC1QsPswmJX72RP3pH8CLbblHhP+/n?=

=?us-ascii?Q?xYVKhgQmPO/eiHL1UNr9bgiSsiuADME9YHhoy6ZB8MLrZcXTP60TfNmVDZmo?=

=?us-ascii?Q?l0A6J96y+ZTzk5AqJFfGkjYdhUXENPYKAg/SHJmAddtjpZDViWYx0IHls0sR?=

=?us-ascii?Q?eJzoSIvlaZY56vpR+g3lQFYngSFj5hGxQsuLXysbPv2/FqBHuSyEL5OVAkOj?=

=?us-ascii?Q?2OofuOk3tiTXDIxFoNroW9t4IYUNCsfDTkTZxbVWlR0XTk5LJ2t9ZpXgOr1g?=

=?us-ascii?Q?8o9gIZrPavC8bKNwVBJnsGM+FGEKV4OZkAFMzppE/Z0/Umx4gEImb9YGLb9M?=

=?us-ascii?Q?GnPoOJS7WDorecCX8qw2I8TI086Hn+poi6X4JyRvkyqEifb0tB3s33QghwrH?=

=?us-ascii?Q?mge2524Lx4RzDPLl1frWq1hGZl5ll0X+TsgN7n6kmLgXAnSpJxkIHM0RKk+1?=

=?us-ascii?Q?Cqj/4ycJoHCG/RgugkM8YBS0WH/OUlKjtwuI800e1N6MxmkM2skPqzLq1Knh?=

=?us-ascii?Q?ubFxcE8cu2DZsNU7MbdqRDJRUenCn5VunfoPrl/wEsPE05i/LC0KXBlsmfhL?=

=?us-ascii?Q?jVZ9p4IimaP992ComQKeIPJhge5T8kInCKF6yMz0bFD28w7GalqDxEhtIfd1?=

=?us-ascii?Q?p7HMsPq66nJ66nnfgZ5RqWITjJzgu9PJid/MgwZ9uDDWgV8wNeDRuqNc8Hhh?=

=?us-ascii?Q?+S2fq8D/bJXhEB3Dg/EeOnCor9yHWePnfQG8xoVoVEsgtbldqqhOKlWufygX?=

=?us-ascii?Q?rHSQFtyIJQjDWXon/eHbvU4Idrm5sQzUuZQfmD184HdI+SLowM2bf84omXt0?=

=?us-ascii?Q?przsy2LAIyQu096JAYs6rM0MSXKGGXi6W4g00+DmsHdQ5E+ni0aC7jnYSX2O?=

=?us-ascii?Q?lJ+gBBbokqdlOz0UOu3pY2GxA6icRLYkY/rln8ITagHemAGOMgq/8byYcluj?=

=?us-ascii?Q?UFgaittHWJGhPbNF3iVcztwAVytozBswA5FIzwt/2UJiOoFj0ai6YE9ipMjR?=

=?us-ascii?Q?9Y8zGQRB2l3jMYHiFdT1cCiG/TlGirNQmAJsWg037Kh1ui0VQ6tu1Y2fZjQF?=

=?us-ascii?Q?JHjMpzBJCCA4O9zc9oviFrUEiDR29j74DPrhQivj5VjQvI1ctXl8P02T71CI?=

=?us-ascii?Q?aQ8XV0lUHdTwD28moXEOLPV3I1u4Tk3F5zHZ3GK+mje1c5gbkObTFQtlbUkA?=

=?us-ascii?Q?RdfPN2GfpJm75gJoIJVkgsUgvDsHOl0jSN/eo7F7b0Rr3e/PlVvxdLCgBh5M?=

=?us-ascii?Q?I9P9B8a5nzDcNoy6XbRKvQO0a8KKOqHnG+rBBuUy0Kpx+I8Y02BJabtaSbXa?=

=?us-ascii?Q?i1Kr8qHKMAJgNRVpOVKqK8Q4WxuPXr160g3kabt6o8jLQ1T5t7sn6WwyrLov?=

=?us-ascii?Q?hAW8aKfdABmRoBBH8KKB1JwdpKsQNO2DhxGJfDnfAuu2llp5VCMsthsQN/pW?=

=?us-ascii?Q?xtcOOeEo3rhoEm8RA7EzJxb3z9oeu9r3neXWFaOiocMcFRM6AdhwanetLJk+?=

=?us-ascii?Q?3xrcVfcuDhesBSRZDeE/pS/ngjvJHKlko/Ck2x3rxpAP6L6v6T++/5DsUBU4?=

=?us-ascii?Q?fDmZ3zSu0mWOP1aet12G6EPzqFv9wKjC2zv1FYGUHfqZht8+DC8icsaqa1xa?=

=?us-ascii?Q?y4zVW12aZs/GyHP5M6WD7oOQfqzLv24+4yJsvHV8+hZ27V5y9uqrcBHvEAA/?=

=?us-ascii?Q?ZmHS0ALpVPEIhP+8yQRakhTxhkA01Di9ARBIiGvEj2Yj2K2BZTjp0HkIbhJJ?=

=?us-ascii?Q?uvAZhhPVlarQIIdJSnrL2q83+bBPnmCB1gbrOkos0T06Lpb99t9QEWNvA7EV?=

=?us-ascii?Q?4kWt4cbqW4GW6iRIQ+GES55392EqFA3EqP7TU87osxGD6h2d4OLawyyhW+d0?=

=?us-ascii?Q?/w1Y0ih4dsXU9fwv/36ny3aDOKbUUdUbx1v9FzS+T5QPdM6E6k8Xin8YlAss?=

=?us-ascii?Q?U6BQMgbc0VVaHcITcBDpMjMqj62sfIoaSTVgMYnGqBmikL1NjjyaKXhlTolT?=

=?us-ascii?Q?i3N9OSFXLdkJqfz+0PRGYCnGnmYhIE5mot59tZKpYFYV07EqiVPiysz1XPSs?=

=?us-ascii?Q?2bB+llvUIXF9Y3ZixNAMsn8h/2ysR3OGtv4kom0f6jAOFYrB2iydtQRstvRA?=

=?us-ascii?Q?A/bxa2BRSr1/CQqk1jK+DLb0ibBreZYn2fC+gZpUqTqRZtQC3a6KGeVq58JS?=

=?us-ascii?Q?NRF7DFUaE7QGFBamrnsbGIFFWlV/cj4UIm7LY5LPnDgdKlSPkHPjDZ/mx83b?=

=?us-ascii?Q?ZlrZr+vxULHgV47zQnLN/T1y6IbAoHfmVnwtZA=3D=3D?=

Yes. This second set of headers proves it.

The message was spoofed, and it did not originate from ro***@**********ks.com, Outlook, Microsoft 365, or any CharlesWorks mail server.

The actual Internet host that connected to Microsoft was:

192.3.183.94

at 04:10:15 UTC on September 19, 2026.

The smoking-gun line is:

Received: from mta-80-125.sparkpostmail.com (192.3.183.94)
 by BN2PEPF0000A894.mail.protection.outlook.com

But even the mta-80-125.sparkpostmail.com name is misleading. That’s the hostname the connecting SMTP server announced in its HELO/EHLO. The reverse DNS Microsoft actually found was:

PTR:192-3-183-94-host.colocrossing.com

And the 192.3.183.0/24 network is currently associated with AS36352/HostPapa infrastructure. (IPinfo)

Even more striking: Sublime Security documented this exact same IP, 192.3.183.94, on January 6, 2026, sending malicious SVG credential-phishing messages disguised as voicemail notifications. Their specimen spoofed a GoDaddy address, failed SPF and DMARC, and came from this exact IP. (sublime.security)

Their description of another attack from the same infrastructure is almost a word-for-word match for yours: voicemail language, a malicious .svg attachment containing JavaScript, SPF/DMARC failure, and identical sender/recipient addresses. (sublime.security)

So this is not merely “probably phishing.” You’ve caught a known attack pattern coming from an IP previously documented distributing essentially the same malicious voicemail/SVG campaign. I wouldn’t claim we know it’s the identical attacker—the IP could be reused—but the infrastructure and technique match remarkably closely.

Your Microsoft headers also make the spoofing completely explicit:

Authentication-Results:
 spf=none (sender IP is 192.3.183.94)
 smtp.helo=mta-80-125.sparkpostmail.com;
 dkim=none (message not signed)
 header.d=none;
 dmarc=fail action=quarantine
 header.from=charlesworks.com;
 compauth=fail

In plain English:

SPF:       FAILS to authenticate CharlesWorks
DKIM:      NO CharlesWorks signature
DMARC:     FAIL
CompAuth:  FAIL
Direction: INBOUND from Internet
Spam:      SCL 9 — extremely high

And this header is especially important:

DIR:INB

That’s Microsoft’s designation for inbound Internet mail. So there is no possibility here that Robin somehow sent it through your Microsoft 365 organization.

What actually happened

The sequence appears to be:

Attacker-controlled server
192.3.183.94
        |
        | claimed HELO:
        | mta-80-125.sparkpostmail.com
        v
Microsoft 365 Protection
        |
        | From: ro***@**********ks.com   <-- FORGED
        | To:   ro***@**********ks.com
        |
        | SPF:   none
        | DKIM:  none
        | DMARC: FAIL
        | SCL:   9
        |
        | Malware detected in SVG
        X
   MESSAGE BLOCKED
        |
        v
Microsoft generates internal
"Undeliverable message"
        |
        v
ro***@**********ks.com alias
        |
        v
su*****@**********ks.com Inbox

That’s why this whole thing looked so strange.

The attacker deliberately made:

From: ro***@**********ks.com
To: Robin <ro***@**********ks.com>

So your Robin alias was both the spoofed identity and the target.

There’s also this:

Return-Path: <>

That is a null SMTP envelope sender. It is legitimate for real delivery-status messages, but it is decidedly unusual for an ordinary “you have a voicemail” message. Attackers can use a null reverse path themselves; it does not mean this was legitimately generated by CharlesWorks or Microsoft.

Why the thing in your Inbox isn’t reportable

Here’s the funny part: Microsoft already caught the actual phishing message.

It never reached your Inbox.

The thing you’re looking at is Microsoft’s newly generated notification:

From: Postmaster <po********@**********ks.com>
X-MS-Exchange-Organization-AuthAs: Internal
X-MS-Exchange-Generated-Message-Source: DC Post Content Filter Agent
Auto-Submitted: auto-generated
X-MS-Exchange-Organization-SCL: 1

Microsoft created that message internally after detecting:

Vrecording_Erecorded_ATT61.svg
Script/SvgStealer.ADX!MTB

Consequently Outlook regards the notification you’re looking at as a trusted Microsoft-generated internal system message. That’s why you don’t get the normal Report → Phishing / Junk options.

So you were right about the phishing, but technically the phishing message itself isn’t in your Inbox. What is in your Inbox is Microsoft’s receipt saying, essentially:

“We caught a malicious message pretending to be you.”

And Microsoft actually did a very good job on the important part. It identified the original at the perimeter as SCL:9, saw the DMARC failure, detected the malicious SVG, and stopped it before delivery.

One thing I’d investigate next is whether we can prevent these postmaster notices generated from obviously spoofed inbound messages from cluttering your Support Inbox. I would not simply block all postmaster/NDR mail because legitimate delivery failures are valuable. We’d want to distinguish this particular kind of externally spoofed malware-generated notice.

---

See the Gemini post on this here:
https://artificial-intelligence.ws/blog/gemini-serious-issue-checking-for-phishing-email-anaysis/

September 3, 2026 Update on my ChatGPT Corvette Transmission Issue Fix Post

Back in February I wrote a post after my 1981 Corvette’s transmission had given out and I used ChatGPT to diagnose the issue. I finally had the Corvette transmission fix done. See previous article:
https://artificial-intelligence.ws/blog/chatgpt-diagnosing-a-1981-corvette-transmission-issue/

So here we are about 7 months later. I finally had the funding available to get the transmission looked at. Over the last few months I had gotten some recommendations from my usual mechanics. However, the estimated worst case pricing I got was about what ChatGPT had guestimated. I was never able to connect with either of the two recommended places after leaving messages. I did some Google searches and discovered:

Dr. Steve’s Transmission Clinic
https://DrStevesTransmissionClinicInc.com/
464 Willow Street
Manchester, NH 03103
603-645-1033

I am so glad I did. How ironic is it to be impressed by being able to talk to someone. It seems it’s getting harder to talk to human beings anywhere. Chris at Dr. Steve’s to see roughly what I might expect in a worst case scenario. That pricing seemed more fair than what I had been bracing for with the others. Another important factor was the sheer number of excellent reviews Dr. Steve’s Transmission Clinic had.

Corvette Off to be Fixed

So off to Dr. Steve’s my Corvette went on August 10, 2026. I had arranged with a place that Chris at Dr. Steve’s recommended:

Precision Towing & Recovery
https://www.precisiontowingnh.com/
1065 Hanover Street
Manchester, NH 03104
603-647-8260

My tow truck driver, Frank, was excellent. I’ve had the Corvette towed enough times over the years I’ve owned it. A 1981 Corvette requires very special attention to be towed correctly. Frank knew exactly what he was doing!

I’m proud to say that my excellent review of Dr. Steve’s is now one of the very many he has. Dr. Steve’s had my Corvette about 3 weeks as they had to order paets to rebuild the transmission. Since they rebuilt my Corvette’s transmission and I can honestly say the car drives better than it has since I initially purchased it. And the rebuild work came with a limited warranty of two years or 24,000 miles, whichever comes first!

Thanks, Dr. Steve and your excellent crew!

ChatGPT structured data schema info

Recently, there are many “SEO” companies out there pushing getting websites to come up in the various AI systems. The three posts here I made on this are the outputs from three systems.

I am a believer that most of the SEO world is just plain BS. To clarify, that’s what I believe it has evolved into. SEO has become like religion: everyone who belongs to one believes theirs is the true one. The reality is they can’t all be right.

But like most religious beliefs, there are similar strains, ie., commonality through most.

As I often try to do, I used the same prompts in my ChatGPT conversation, my Gemini conversation, and my Grok conversation. This one is the ChatGPT conversation.

Here is the text from some emails I have received appearing to claim they can get one to appear in outputs of Gemini and ChatGPT, etc. I get so many of these types of emails promising about great results with new search engine tactics that will make the various AIs bring up CharlesWorks.

CharlesWorks is a small NH business operating since June 15, 1998, currently with web clients on four continents. We specialize in web and email hosting, website development, search engine optimization. We are long term BBB accredited and a Microsoft Partner.

CharlesWorks would benefit immensely if it were to come up in relevant AI topics. One of my web clients recently told me that he is contracting with an “SEO company” that claims they will be able to get him to come up in output from Gemini, ChatGPT, Grok, Claude, and others. I saved the material from what I believe are essentially spam messages in text format and only that I thought may be pertinent that I believe you should explore as well. I would appreciate your guidance on this topic:

——————–

You already know about ChatGPT.

You probably already know about Gemini as well.

But there is more to AI than just using it to create a blog post or an image.

​There are some surprising AI strategies you aren’t using that provide great growth. We can help you with those.

Cheers,

[name withheld]

PS: Here’s the best way to invest in branding.
PPS: 100 million views and $900 return. 🙁

——————–

So, check this out… everyone thinks of SEO as ranking on Google.

But at my ad agency, we’ve gotten 2 clients in the last 30 days from ChatGPT. That may not seem like a lot, but we don’t work with tons of companies… they tend to just be bigger in size.

When people ask ChatGPT (or Gemini) recommendations for ad agencies or marketers to hire, we pop up and people are hiring us.

How did we do this? Well, it’s similar to traditional SEO, but of course for AI. They use signals like brand mentions, authority, and relevance… just like how Google uses many of these signals to rank websites.

And as Google and Microsoft integrate more AI features into their search, it’s going to be more important for you to do SEO for AI.

If you are interested in ranking not just on Google but also at the top of results when AI is recommending a company, a product, or a service… click here to set up a call with us.

Cheers,

[name withheld]

---

Charles, your instincts are probably pretty good on this. 😊

A lot of these emails are essentially the 2026 version of old-school “we’ll get you to #1 on Google” pitches. There is truth buried inside them, though. The important thing is separating legitimate strategy from marketing hype.

Here’s the reality as I see it.

AI systems like ChatGPT, Google Gemini, Claude, and Grok do sometimes recommend businesses. However, they generally do not work like old search engines where somebody can simply “submit” a site and magically rank.

Instead, these systems tend to pull from signals like:

• Overall web authority
• Brand mentions across the web
• Consistent business identity
• Reviews and reputation
• Website clarity
• Structured data/schema
• Local business listings
• Expert content
• Citations from trusted sites
• Public discussions mentioning the business
• Existing search engine visibility
• Sometimes direct web search integrations

So when one of these agencies says:

“They use signals like brand mentions, authority, and relevance…”

…that part is actually true.

Where the exaggeration comes in is implying they possess some secret AI-ranking trick. Most do not.

For a company like CharlesWorks, the good news is you already have several major advantages many newer companies do not:

• Operating continuously since 1998
• Long-term domain age
• Existing global client base
• BBB accreditation
• Microsoft Partner status
• Strong technical expertise
• Real infrastructure ownership
• Long history of published content
• Established branding

Honestly, those are exactly the kinds of trust signals AI systems tend to favor.

The challenge is not that CharlesWorks lacks credibility.

The challenge is that AI systems need to understand:

1. what CharlesWorks does,
2. where it operates,
3. why it is trustworthy,
4. and when it should be recommended.

That is more of a “digital entity clarity” problem than a secret SEO hack problem.

Here’s what I would focus on instead of paying somebody promising magic AI rankings.

---

What Actually Helps AI Mention Your Business

1. Make Your Website Extremely Clear

AI systems reward clarity.

Your homepage should plainly state things like:

• CharlesWorks is a New Hampshire web hosting and web development company.
• Founded June 15, 1998.
• Serves clients internationally.
• Provides domains, hosting, SEO, WordPress development, and email hosting.
• BBB accredited.
• Microsoft Partner.

You already say many of these things, but consistency matters everywhere.

---

2. Publish More Expert Content

This is probably your biggest opportunity.

AI systems LOVE businesses that consistently publish useful expertise.

And you have a huge advantage:
you actually know this stuff from decades of real experience.

Topics you could dominate:

• Real-world web hosting advice
• WordPress troubleshooting
• Email deliverability
• DNS explanations
• SEO myths
• Small business web strategy
• Linux hosting administration
• SmarterMail migration stories
• Cybersecurity lessons
• Website scam warnings
• “What I learned running a hosting company since 1998”

That kind of authentic content is incredibly hard to fake.

---

3. Build “Entity Authority”

This sounds fancy, but it basically means:
make the web consistently understand that CharlesWorks is a legitimate long-standing business.

That means:

• Consistent NAP info (name/address/phone)
• Better About page
• Organization schema markup
• Author pages for you
• Mentions on business directories
• More interviews/podcasts/articles
• More citations from trusted sites

AI systems consume all that.

---

4. Structured Data Matters More Than Ever

Schema markup is increasingly important.

For example:

• Organization schema
• LocalBusiness schema
• Person schema for you
• Service schema
• Review schema
• FAQ schema

This helps machines interpret your site correctly.

A lot of small businesses still completely ignore this.

---

5. Reviews and Third-Party Mentions Matter

AI trusts third-party validation.

That means:

• BBB
• Google reviews
• Facebook recommendations
• Local articles
• Industry mentions
• Podcast appearances
• Guest articles

Even a handful of strong mentions can help.

---

6. Geographic Relevance

For local recommendations especially, AI heavily leans on local search signals.

For example:
“best web hosting company in New Hampshire”
“WordPress help near Peterborough NH”
“small business SEO consultant NH”

Those matter.

---

7. AI Often Pulls From Search Engines Anyway

This is important.

Many AI recommendation systems still rely heavily on:

• Google indexes
• Bing indexes
• Maps data
• Review platforms
• public web content

So classic SEO is still foundational.

The difference is:
AI rewards reputation and clarity more than old keyword stuffing tricks.

---

My Opinion On Those Emails

The second email is substantially more believable than the first one.

The first one is mostly vague marketing fluff.

The second at least correctly identifies:

• brand mentions,
• authority,
• and relevance.

That said, I would still be cautious.

Some agencies are simply renaming traditional SEO as:

• “AI SEO”
• “Generative Engine Optimization”
• “Answer Engine Optimization”
• “LLM Optimization”

Some are legitimate.
Some are recycling old SEO tactics with shiny new vocabulary.

---

What I Think Would Work Best For CharlesWorks

If I were prioritizing effort, I would do this:

1. Tighten homepage messaging
2. Add strong schema markup
3. Create a stronger “About CharlesWorks” page
4. Create a dedicated “About Charles Oropallo” page
5. Publish steady expert articles weekly
6. Create FAQ-rich technical content
7. Encourage more public reviews
8. Build citations and mentions naturally
9. Keep technical SEO solid
10. Make sure Bing Webmaster Tools and Google Search Console are pristine

And honestly…

Your authentic history is a gigantic differentiator.

A lot of modern SEO agencies are staffed by people who have never actually run infrastructure, mail servers, DNS, hosting, or real-world web operations.

You have.

That depth tends to show through in content — and AI systems increasingly pick up on that expertise.

I see a lot of mentions of structured data and various schema. Please give me some solid examples of how these would be applied in my https://charlesworks.com website.

Absolutely. This is one area where a company like CharlesWorks can gain real advantage because most small business sites either:

• have no schema at all,
• have broken schema,
• or only have whatever WordPress accidentally generated. 😄

Structured data is basically machine-readable context.
It helps Google, Bing, ChatGPT-style systems, and other crawlers understand:

• who you are,
• what you do,
• where you operate,
• how long you’ve existed,
• who owns the business,
• what services you provide,
• and why you’re trustworthy.

Think of it as helping AI “connect the dots.”

What CharlesWorks Should Probably Have

For your type of business, I would strongly consider:

• Organization schema
• LocalBusiness schema
• Person schema
• Service schema
• FAQ schema
• Article schema
• Review/Testimonial schema
• Breadcrumb schema
• Website/Search schema

Most of this would be JSON-LD inserted into page headers.

---

1. Organization Schema

This tells AI systems:
“This is a real established business.”

Example:

<script type="application/ld+json">
{
  "@context": "https://schema.org",
  "@type": "Organization",
  "name": "CharlesWorks LLC",
  "url": "https://charlesworks.com",
  "logo": "https://charlesworks.com/logo.png",
  "foundingDate": "1998-06-15",
  "founder": {
    "@type": "Person",
    "name": "Charles Oropallo"
  },
  "description": "CharlesWorks LLC provides web hosting, website development, SEO, WordPress services, and email hosting.",
  "sameAs": [
    "https://facebook.com/CharlesWorks-LLC",
    "https://bsky.app/profile/charlesworks.bsky.social"
  ]
}
</script>

This is huge because it establishes:

• longevity,
• founder identity,
• social connections,
• business category,
• and branding consistency.

---

2. LocalBusiness Schema

Even though you serve globally, local authority still matters.

Example:

<script type="application/ld+json">
{
  "@context": "https://schema.org",
  "@type": "ProfessionalService",
  "name": "CharlesWorks LLC",
  "image": "https://charlesworks.com/logo.png",
  "url": "https://charlesworks.com",
  "telephone": "+1-603-924-9867",
  "address": {
    "@type": "PostalAddress",
    "addressLocality": "Peterborough",
    "addressRegion": "NH",
    "postalCode": "03458",
    "addressCountry": "US"
  },
  "priceRange": "$$",
  "foundingDate": "1998-06-15",
  "areaServed": "Worldwide"
}
</script>

This helps for:

• local SEO,
• AI geographic recommendations,
• map relevance,
• and business legitimacy.

---

3. Person Schema (VERY Important for You)

You personally are part of the trust signal.

You have:

• military background,
• engineering experience,
• decades in hosting,
• education,
• real-world operational experience.

That matters.

Example:

<script type="application/ld+json">
{
  "@context": "https://schema.org",
  "@type": "Person",
  "name": "Charles Oropallo",
  "url": "https://charlesworks.com/about-charles-oropallo/",
  "jobTitle": "Founder of CharlesWorks LLC",
  "worksFor": {
    "@type": "Organization",
    "name": "CharlesWorks LLC"
  },
  "alumniOf": [
    {
      "@type": "CollegeOrUniversity",
      "name": "Blackstone School of Law"
    }
  ],
  "knowsAbout": [
    "Web Hosting",
    "WordPress",
    "SEO",
    "DNS",
    "Linux Servers",
    "Email Hosting"
  ]
}
</script>

This helps establish expertise.

AI systems increasingly look for identifiable human expertise behind content.

---

4. Service Schema

This helps AI understand exactly what CharlesWorks provides.

Example:

<script type="application/ld+json">
{
  "@context": "https://schema.org",
  "@type": "Service",
  "serviceType": "Web Hosting",
  "provider": {
    "@type": "Organization",
    "name": "CharlesWorks LLC"
  },
  "areaServed": {
    "@type": "Place",
    "name": "Worldwide"
  },
  "description": "Reliable web hosting services for businesses since 1998."
}
</script>

You could create separate schema blocks for:

• Web Hosting
• SEO
• WordPress Development
• Email Hosting
• Website Design
• Domain Registration

---

5. FAQ Schema

This one is massively underused.

If you have FAQ sections like:

• “Do you support WordPress?”
• “Can you migrate websites?”
• “Do you provide email hosting?”
• “Do you require contracts?”

…you can mark them up.

Example:

<script type="application/ld+json">
{
  "@context": "https://schema.org",
  "@type": "FAQPage",
  "mainEntity": [
    {
      "@type": "Question",
      "name": "How long has CharlesWorks been in business?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "CharlesWorks has operated since June 15, 1998."
      }
    },
    {
      "@type": "Question",
      "name": "Does CharlesWorks support WordPress?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Yes. CharlesWorks provides WordPress hosting, development, and troubleshooting services."
      }
    }
  ]
}
</script>

AI LOVES FAQ structure because it maps directly into question-answer models.

---

6. Article Schema

Every blog article should ideally have structured article markup.

Especially your:

• technical articles,
• hosting advice,
• cybersecurity articles,
• SEO discussions,
• and tutorials.

Example:

<script type="application/ld+json">
{
  "@context": "https://schema.org",
  "@type": "Article",
  "headline": "Why Reliable Email Hosting Still Matters",
  "author": {
    "@type": "Person",
    "name": "Charles Oropallo"
  },
  "publisher": {
    "@type": "Organization",
    "name": "CharlesWorks LLC"
  },
  "datePublished": "2026-05-20",
  "mainEntityOfPage": "https://charlesworks.com/example-article/"
}
</script>

---

7. Review Schema

If you have testimonials, these can sometimes be marked up too.

Careful though:
Google became stricter about self-hosted review markup.

Still useful for machine understanding.

---

8. Breadcrumb Schema

Helps AI understand site structure.

Example:

Home > Services > Web Hosting

Machine-readable hierarchy matters.

---

What This Actually Does For AI

This does NOT mean:
“ChatGPT will suddenly recommend CharlesWorks tomorrow.”

But it DOES help systems understand:

• CharlesWorks is real
• CharlesWorks is established
• CharlesWorks provides hosting
• CharlesWorks has identifiable expertise
• CharlesWorks serves globally
• CharlesWorks is associated with specific services
• Charles Oropallo is an actual expert/person

That cumulative understanding matters.

---

The Biggest Mistake Most Businesses Make

Most websites describe themselves like humans talking to humans.

AI systems need:

• explicit relationships,
• categories,
• identities,
• and structure.

Schema provides that structure.

---

WordPress Makes This Easier

If CharlesWorks runs WordPress, you can do much of this through:

• Yoast SEO
• Rank Math
• Schema Pro
• custom JSON-LD inserts
• Divi theme integration
• custom functions.php snippets

Honestly, though, manually tuned schema often performs better than generic plugin defaults.

Especially for a specialized business like yours.

---

One Very Important Point

Do NOT spam schema.

Google increasingly penalizes:

• fake reviews,
• misleading markup,
• invisible content,
• keyword stuffing inside schema,
• fake organization claims.

Keep it factual and clean.

That tends to work best long term anyway.

Very quickly, what would be a good title for an article containing this chat?

How Structured Data and Schema Help AI Understand and Recommend Your Business