I have 2 e-mail accounts - one on GMail and other one on a popular mail provider in my country (O2). GMail has a secondary e-mail set for security - that is the O2. I started getting e-mails from GMail -> O2 a while ago, their content was a regular spam. Now comes the thing that makes me puzzle:

  • O2 is my daily/primary account

  • GMail I use really seldom, I would say 3 times a year (job-seeking purpose) but I check it from time to time

Therefore there is (should be) no place on the internet where my GMail address is written, neither stored (only safe (?) companies). I also have never input this one into any Internet forms/subscriptions etc. But spoofing itself is understandable. What's not is how did someone connect these two accounts? GMail has literally 5 contacts, from which 2 are my other accounts, 3 other are companies. I haven't experienced spoofing in any other of my e-mail accounts.

  • 3
    Not a particularly good title for this question, imo. – d0nut Mar 24 '16 at 17:46
  • Have you ever used chrome / google while logged in with that email's google account? Could be how ad / spam companies got it. – WorseDoughnut Mar 24 '16 at 17:47
  • 3
    Do you have both accounts on your smartphone? – Phil Lello Mar 24 '16 at 17:48
  • 4
    Google sells. You. As a commodity. – Deer Hunter Mar 24 '16 at 18:10
  • Thanks for response, 1) I don't have neither of them on the smartphone, 2) I don't really use chrome, but I can't exclude this possibility, 3) seriously do you think it came from Google "data management"? – adamczi Mar 24 '16 at 18:31

NOTE: In the context of network security, a spoofing attack is a situation in which one person or program successfully masquerades as another by falsifying data, thereby gaining an illegitimate advantage.

How you can you get your emailed spoofed (the easy way):

  1. The sender information shown in e-mails (the "From" field) can be spoofed easily. This technique is commonly used by spammers to hide the origin of their e-mails and leads to problems such as misdirected bounces (i.e. e-mail spam backscatter).
  2. E-mail address spoofing is done in quite the same way as writing a forged return address using snail mail. As long as the letter fits the protocol, (i.e. stamp, postal code) the SMTP protocol will send the message. It can be done using a mail server with telnet.
  3. Getting actively on website compromised by Beef framework or other malicious JavaScript.(not your case I think)
  4. Getting your email spoofed once will get it spoofed again.
  5. Adding your email in a form or in a service that can be easly compromised or that can post or share your data as he wants.
  6. Many companies in this world keep a browser at a lower version (to bypass HSTS) in order to fake certificate the connection. Yes the connection is still secure but they have the keys ... and how has the keys .. has the data.
  7. Humans... maybe the like your email and they want to use it and use it and use it again.
| improve this answer | |
  • I can't think of any of the cases you suggest, as I it's almost unused account. I could have forgotten something though. Thanks. – adamczi Mar 24 '16 at 19:09

Not the answer you're looking for? Browse other questions tagged or ask your own question.