Hello,
In the past, we were told by Microsoft 365 to allow an IP range. We were told that we have to have 40.107.0.0/17 in our allowed list.
However, every 2-3 days we receive SPAM emails and when we investigate the issue on IronPort we notice that the spam came because it was in the allowed IP range. So the other day a spam email came to 2 people as below:
Person A Didn't get it as Ironport blocked the IP 40.107.243.60 as unknown. which is good.
Person B received the email because it came from 40.107.92.76 which falls under the allowed range of 40.107.0.0/17.
Could someone please explain why this happens all the time as the email comes from different IPs and why we were told to allow 40.107.0.0/17? also how come the scammer sends it from 40.107.92.76? do they spoof the IP to do so?