1

I received the following email with the headers below. How are the spammers exploiting this method of tricking users that their account is hacked?

How can one prevent spammers from doing this with our email? It can be scary for the non-tech savvy like my grandma to get an email like this thinking her account is hacked.

Also what is the spammer doing exactly in the headers below? Does it show what application they are using to do this?

Return-Path: <film@zeroplusbd.com>
X-Original-To: xxx@xxx.com
Delivered-To: xxx@xxx.com
Received: from gateway5.unifiedlayer.com (gateway5.unifiedlayer.com [69.89.21.189])
 (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client
 certificate requested) by mail17i.protonmail.ch (Postfix) with ESMTPS id 420623000080
 for <xxx@xxx.com>; Wed,
  6 Mar 2019 19:25:57 +0000 (UTC)
Received: from cm4.websitewelcome.com (unknown [108.167.139.16]) by
 gateway5.unifiedlayer.com (Postfix) with ESMTP id AF51A20196C14 for <xxx@xxx.com>;
 Wed,
  6 Mar 2019 13:25:55 -0600 (CST)
Received: from uscentral427.accountservergroup.com ([174.136.12.171]) by cmsmtp with
 ESMTP id 1cAth7PiS5rNM1cAthzAVL; Wed, 06 Mar 2019 13:25:55 -0600
Received: from [87.252.183.184] (port=51959 helo=[184-183-252-87.filibe.net]) by
 uscentral427.accountservergroup.com with esmtpsa (TLSv1:ECDHE-RSA-AES256-SHA:256) (Exim
 4.91) (envelope-from <film@zeroplusbd.com>) id 1h1cAr-0024QG-EJ for xxx@xxxx.com;
 Wed, 06 Mar 2019 14:25:55 -0500
Authentication-Results: mail17i.protonmail.ch; dmarc=none (p=none dis=none)
 header.from=xxx.com
Authentication-Results: mail17i.protonmail.ch; spf=none smtp.mailfrom=film@zeroplusbd.com
Authentication-Results: mail17i.protonmail.ch; dkim=fail reason="key not found in DNS"
 (0-bit key) header.d=zeroplusbd.com header.i=@zeroplusbd.com header.b="kBI6UFVj"
X-Authority-Reason: nr=8
Dkim-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=zeroplusbd.com;
 s=default; h=From:MIME-Version:Content-Type:Message-ID:
 List-ID:Date:Subject:To:Sender:Reply-To:Cc:Content-Transfer-Encoding:
 Content-ID:Content-Description:Resent-Date:Resent-From:Resent-Sender:
 Resent-To:Resent-Cc:Resent-Message-ID:In-Reply-To:References:List-Help:
 List-Unsubscribe:List-Subscribe:List-Post:List-Owner:List-Archive;
 bh=oj1E+Py8RM4SW8xpzCQWMyx9GodmBpw8HrVQgEtGCkw=; b=kBI6UFVjOJ6gguimz80GscFl2T
 OLPs8fsRExWixOejYw4T4+itDQNQPEy7NT+RBH+D055aCgf2clk8w44DauK2Lye1uw9ZFP6tlwQ3F
 2kKxi3ea3Vaeo1ojR3yshBjGaj2Yit/5mas9dAQLKOlXfd7dVSthXl2hiza9XbMbP6WSUw2g/zdek
 /jnxnN410aiy7vES/sbKi4v5PyDPTe8kYSkcHVZrFIP9XpNLjrzXiw18lo97osS1pl3Oe9ySv3DVF
 WXOfdIxAhvZC7qp0o4329IO3oT+O8GGwiY2BAvH1L4JCrRK0y8An6I2ZAhii6XTEaoViKt3FVhESz 1PvGPDMA==;
To: xxx@xxx.com
X-Abuse-Reports-To: <abuse@mailer.zeroplusbd.com>
X-Mailer: Microsoft Outlook Express 6.00.2900.5843
Subject: pat
X-Aid: 3931138227
Date: Wed, 6 Mar 2019 20:25:52 +0100
List-Id: y2znb9cxhdkkp12r9ojihcp70vn50etc23e368dl
Message-Id: <0arrxg.5b0ydll3eiwf2wi@mail.zeroplusbd.com>
X-Complaints-To: <abuse@mail.zeroplusbd.com>
Content-Type: text/html
Mime-Version: 1.0
From: <xxx@xxx.com>
X-Sender: film@zeroplusbd.com
X-Antiabuse: This header was added to track abuse, please include it with any abuse report
X-Antiabuse: Primary Hostname - uscentral427.accountservergroup.com
X-Antiabuse: Original Domain - xxx.com
X-Antiabuse: Originator/Caller UID/GID - [47 12] / [47 12]
X-Antiabuse: Sender Address Domain - zeroplusbd.com
X-Bwhitelist: no
X-Source-Ip: 87.252.183.184
X-Source-L: No


----------


X-Exim-Id: 1h1cAr-0024QG-EJ
X-Source-Sender: ([184-183-252-87.filibe.net]) [87.252.183.184]:51959
X-Source-Auth: film@zeroplusbd.com
X-Email-Count: 244
X-Source-Cap: emVyb3BsdXM7aW1wbG9kZWk7dXNjZW50cmFsNDI3LmFjY291bnRzZXJ2ZXJncm91cC5jb20=
X-Local-Domain: yes
X-Spam-Flag: YES
X-Spam-Status: Yes, score=11.7 required=4.0 tests=BAYES_50,DKIM_INVALID,
 DKIM_SIGNED,FORGED_MUA_OUTLOOK,FORGED_OUTLOOK_TAGS,
 HEADER_FROM_DIFFERENT_DOMAINS,HTML_IMAGE_ONLY_04,HTML_MESSAGE,
 LOCALPART_IN_SUBJECT,MIME_HTML_MOSTLY,MPART_ALT_DIFF,RCVD_IN_BRBL autolearn=no
 autolearn_force=no version=3.4.2
X-Spam-Report: *
  4.0 BAYES_50 BODY: Bayes spam probability is 40 to 60% *
      [score: 0.4999] *
  0.0 HEADER_FROM_DIFFERENT_DOMAINS From and EnvelopeFrom 2nd level *
      mail domains are different *
  1.1 LOCALPART_IN_SUBJECT Local part of To: address appears in *
      Subject *
  0.4 MIME_HTML_MOSTLY BODY: Multipart message mostly text/html MIME *
  0.0 HTML_MESSAGE BODY: HTML included in message *
  0.8 MPART_ALT_DIFF BODY: HTML and text parts are different *
  1.2 HTML_IMAGE_ONLY_04 BODY: HTML: images with 0-400 bytes of words *
  0.1 DKIM_SIGNED Message has a DKIM or DK signature, not necessarily *
       valid *
  2.0 RCVD_IN_BRBL Received is listed in Barracuda RBL *
      bb.barracudacentral.org *
  0.1 FORGED_OUTLOOK_TAGS Outlook can't send HTML in this format *
  0.1 DKIM_INVALID DKIM or DK signature exists, but is not valid *
  1.9 FORGED_MUA_OUTLOOK Forged mail pretending to be from MS Outlook
X-Spam-Level: ***********
X-Spam-Checker-Version: SpamAssassin 3.4.2 (2018-09-13) on maili.protonmail.ch
X-Attached: 1551903952102.jpg
X-Pm-Origin: external
X-Pm-Content-Encryption: on-delivery
X-Pm-Transfer-Encryption: TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)


-----BEGIN PGP MESSAGE-----
Version: ProtonMail
Comment: https://protonmail.com

wcBMAwRosWm2Ti4BAQf/Ykwvv6atXqvoTqX+F4J6T2IriLr3Ol294QaLqwpZ
VRJuZ0g39DFmnWhHiZtPwo0WEr4Tvn4dg1g7wWTT8r/w5rJ7M2cukmKTdZR6
eRXtm0PDO2mWzoOo7ra6YsmrakB0asnTL1oA2DWi9u+TrXr/DyeYetnwqwQ1
TIrhG+HXuiFUTa8fxvvi3VHUNFI0fCIxxaZtHFGEH05wqGTxSgTiNYUJYeSE
cJcWpLm7X4cp/AiiJeFqmG0LrUB7qmJnonu/EbfxFIec2YBwcTDZmN1yw9BS
  • That's quite a long header. I assume the domain the spammer was attempting to impersonate was zeroplusdb.com is that correct? – Daisetsu Mar 7 '19 at 16:46
4
Authentication-Results: mail17i.protonmail.ch; dmarc=none (p=none dis=none) 
 header.from=xcubicle.com

The domain xcubicle.com doesn't have DMARC protecting it. This means anyone can send on behalf of the domain i.e. use it in the From: header.

DMARC doesn't work alone: SPF or DKIM or both are required first. DMARC can tell what the receiver should do if both SPF and DKIM fails for the domain used in the From header.

In this specific case From equals To i.e. the mail seems to be originated from the own mailbox. In order to prevent this DMARC needs to be both set (p=reject) and validated.

  • how and where do i do this? thanks for the help. – Patoshi パトシ Mar 7 '19 at 20:11
  • @Patoshiパトシ SPF and DMARC checking is done by the receiving email server. All major online email services have this inspection on by default (it's a major factor in the filter to send to Junk folders). – schroeder Mar 7 '19 at 20:28
  • im using protonmail as my mail service. yes it goes to spam, but theres no way to prevent ppl spoofing ur email address then? – Patoshi パトシ Mar 8 '19 at 15:35
  • Ask them to implement SPF+DKIM for your needs and add the related DNS records. – Esa Jokinen Mar 8 '19 at 15:36

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for?Browse other questions tagged or ask your own question.