0

TL;DR, I think this mail was sent by mail.okgroup.cz. Not sure though, I would like confirmation.

I just got a mail from my sister with no subject and only a link.

NOTE; That the email used in this mail is the ACTUAL mail of my sister.

I am using Outlook for my email (and I'm using it via Firefox)

When hovering over the little icon (where a picture of my sister is shown (now shows a question mark in the opened box, also giving me a "non-verified sender" tag)).

  • Should my sister be worried/ is my sisters email compromised?
  • Can i just ignore this mail?
  • What is going on?

I have recently gotten a lot of spam in my mailbox, But never like this.

After skimming through my mail, I found another one from my "sister", same mail structure, only a link.

HEADER:

(Geen onderwerp)  Dit bericht is geïdentificeerd als spam. Het wordt na 10 dagen verwijderd. Het bericht is geen spam  Opvolgen. My sisters name <My Sisters actual email> Vr 24-1-2020 00:13 My mail name

Suspicious link

My sister's name

Received: from DB8EUR05HT142.eop-eur05.prod.protection.outlook.com
 (2603:10a6:802:59::49) by VI1PR03MB4142.eurprd03.prod.outlook.com with HTTPS
 via VI1P195CA0096.EURP195.PROD.OUTLOOK.COM; Thu, 23 Jan 2020 23:13:01 +0000
Received: from DB8EUR05FT027.eop-eur05.prod.protection.outlook.com
 (2a01:111:e400:fc0f::38) by
 DB8EUR05HT142.eop-eur05.prod.protection.outlook.com (2a01:111:e400:fc0f::315)
 with Microsoft SMTP Server (version=TLS1_2,
 cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.2644.19; Thu, 23 Jan
 2020 23:13:01 +0000
Authentication-Results: spf=permerror (sender IP is 95.129.100.50)
 smtp.mailfrom=okklient.cz; live.nl; dkim=none (message not signed)
 header.d=none;live.nl; dmarc=fail action=none header.from=hotmail.com;
Received-SPF: PermError (protection.outlook.com: domain of okklient.cz used an
 invalid SPF mechanism)
Received: from mail.okgroup.cz (95.129.100.50) by
 DB8EUR05FT027.mail.protection.outlook.com (10.233.239.192) with Microsoft
 SMTP Server id 15.20.2665.18 via Frontend Transport; Thu, 23 Jan 2020
 23:13:00 +0000
X-IncomingTopHeaderMarker:
 OriginalChecksum:B2AAF034E39027F209C64FC43131BC6A85DB494CE4EA1CF63F6CF4BBAB69D399;UpperCasedChecksum:032C25CE4D6E9B0F87551C4D4146F4B4D120FFCD126100DE4F858E5673CC142E;SizeAsReceived:1121;Count:14
Received: from localhost (localhost [127.0.0.1])
    by mail.okgroup.cz (Postfix) with ESMTP id AC22372D
    for <*My email address*>; Fri, 24 Jan 2020 00:13:00 +0100 (CET)
X-Virus-Scanned: Debian amavisd-new at mail.okgroup.cz
Received: from mail.okgroup.cz ([127.0.0.1])
    by localhost (mail.okgroup.cz [127.0.0.1]) (amavisd-new, port 10024)
    with ESMTP id 0ziGSgz90EGB for <*My Email address*>;
    Fri, 24 Jan 2020 00:13:00 +0100 (CET)
Received: from mail.okgroup.cz (unknown [221.4.205.30])
    (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits))
    (No client certificate requested)
    by mail.okgroup.cz (Postfix) with ESMTPSA id 62C40655
    for <*My email address*>; Fri, 24 Jan 2020 00:12:59 +0100 (CET)
Content-transfer-encoding: 7bit
From: "*My sisters name*" <*My sisters Email*>
Content-type: text/plain; charset=us-ascii
Date: Fri, 24 Jan 2020 02:12:58 +0300
Message-Id: <0D7EBF3E-BEFC-4916-ED43-6A4A1904DAE2@okklient.cz>
Subject:
To: "*my Mail name*" <*My Email address*>
Reply-To: "*My sisters name*" <*My sisters email address*>
X-Mailer: iPhone Mail (15E216)
X-IncomingHeaderCount: 14
Return-Path: *firstpartofmysistersemailaddress*@okklient.cz
X-MS-Exchange-Organization-ExpirationStartTime: 23 Jan 2020 23:13:01.0431
 (UTC)
X-MS-Exchange-Organization-ExpirationStartTimeReason: OriginalSubmit
X-MS-Exchange-Organization-ExpirationInterval: 1:00:00:00.0000000
X-MS-Exchange-Organization-ExpirationIntervalReason: OriginalSubmit
X-MS-Exchange-Organization-Network-Message-Id:
 85c585a5-a260-4c64-92c6-08d7a059cac1
X-EOPAttributedMessage: 0
X-EOPTenantAttributedMessage: 84df9e7f-e9f6-40af-b435-aaaaaaaaaaaa:0
X-MS-Exchange-Organization-MessageDirectionality: Incoming
X-Forefront-Antispam-Report: EFV:NLI;
X-MS-Exchange-Organization-AuthSource:
 DB8EUR05FT027.eop-eur05.prod.protection.outlook.com
X-MS-Exchange-Organization-AuthAs: Anonymous
X-MS-PublicTrafficType: Email
X-MS-UserLastLogonTime: 1/23/2020 9:58:15 PM
X-MS-Office365-Filtering-Correlation-Id: 85c585a5-a260-4c64-92c6-08d7a059cac1
X-MS-TrafficTypeDiagnostic: DB8EUR05HT142:
X-MS-Exchange-EOPDirect: true
X-Sender-IP: 95.129.100.50
X-SID-PRA: *My sisters email address*
X-SID-Result: NONE
X-MS-Exchange-Organization-PCL: 2
X-Microsoft-Antispam: BCL:0;
X-OriginatorOrg: hotmail.com
X-MS-Exchange-CrossTenant-OriginalArrivalTime: 23 Jan 2020 23:13:00.9130
 (UTC)
X-MS-Exchange-CrossTenant-Network-Message-Id: 85c585a5-a260-4c64-92c6-08d7a059cac1
X-MS-Exchange-CrossTenant-Id: 84df9e7f-e9f6-40af-b435-aaaaaaaaaaaa
X-MS-Exchange-CrossTenant-FromEntityHeader: Internet
X-MS-Exchange-CrossTenant-RMS-PersistedConsumerOrg:
 00000000-0000-0000-0000-000000000000
X-MS-Exchange-Transport-CrossTenantHeadersStamped: DB8EUR05HT142
X-MS-Exchange-Transport-EndToEndLatency: 00:00:00.7923850
X-MS-Exchange-Processed-By-BccFoldering: 15.20.2644.026
X-Message-Flag: Flag for follow up
Keywords: Categorie Rood < this was a tag i attached to the mail, Not important
X-Microsoft-Antispam-Mailbox-Delivery:
    kl:0;dkl:0;rwl:0;ucf:0;jmr:0;ex:0;auth:0;dest:J;OFR:SpamFilterAuthJ;ENG:(5062000261)(5061607266)(5061608174)(4900115)(4920090)(6392002)(4950130)(4990090)(9140004);RF:JunkEmail;
X-Message-Info:
    qoGN4b5S4yoZj1tYlRsjA9pVh/kpy3YY8dFhfcbPMyUsx9US3V/zgFPa74wuRzpavqFSJpg7Mg6gKNgXfcEV5JTtQC4bgDkp8kZXi2IfFS+RDX3Uc4yiNG6pYPgX+XK3yeeWnj++kROH6WpVsaTwkzcHyukxl7YyyW4tqBmkSsYt9E88m8Tf+1zwxMvnC1AaRoMTyl24RU9/Mm86KN7BYg==
X-Message-Delivery: Vj0xLjE7dXM9MDtsPTA7YT0wO0Q9MjtHRD0yO1NDTD02
X-Microsoft-Antispam-Message-Info:
    =?us-ascii?Q?j7GzwzhoZPDrhcowLclpLRQ/5FyY/FeTBUmx/05CvTAc5OH1Z13+BMPGnXVG?=
 =?us-ascii?Q?w5gK2Nfbtt/CE+7oa9z30RTdidzxmdfV22Ohu78x1NUjjIT7fu5JA7Piy1Af?=
 =?us-ascii?Q?W64qUe9A8BF/mPUJ5ZOqTLcJzS52r1v1fFKCZcn5wv8SCQdSsTwN4XwugLzD?=
 =?us-ascii?Q?L6ennWJVCkLqk5yXSfxCHtl5EnuFAr0bJtYodrWYiURqZ9gbf/aoxNRbN/uM?=
 =?us-ascii?Q?P6IGTsqlBaMk0xdlbPleda46/nrcLuTBo0dboS2c2ettYKHcDwpjwfPMHs0S?=
 =?us-ascii?Q?Ggtbxuv5Hion7xx5uGKMiCoJaRUsYj/qzTbwZL2BsnPhLW18hSWNk+6O8DRI?=
 =?us-ascii?Q?ewczzVQ0Idozpz5CkRlk6dDed3Tf09XaB7MMpBlQEwvvaMNbtnZHFns0BRjK?=
 =?us-ascii?Q?1bOmQMN2/kXtyPauWvZdjSL2ot009hvqcZzChDTc9ENOjUvQN8BAcaueWVKr?=
 =?us-ascii?Q?nEmScmjLE2+w0QrTc8mUEkS5wc9lfJltBopp3yHxQamL62lmRYA1R7+lwnWP?=
 =?us-ascii?Q?qiN/WAbbFxPpOYxm7irlg+BrVtXhNEvn+UX77IpPc5FA9XiQ5dAHUTEfM3uE?=
 =?us-ascii?Q?Fp1YMuEZxoJ9FipR/NU2yfpTn5nbj28KqbH/z7DjNCd14wbE4znUyDmN5HWQ?=
 =?us-ascii?Q?bcPiLzj9gJDiwv0/tgnMqX3TFGAAVpwOsrq/Rm6ULYBDd2710tO3jY6kEsCK?=
 =?us-ascii?Q?W6CD8HsLrPmgC+iJXFnrWz4/2IZo3YRyIV9MWuBNfloLnX7zZ10Zl0fmTww/?=
 =?us-ascii?Q?YJ4y4pItLZUSC59/Puc9hUycZxz+FsncGKtZdHIWhvIpUtRDADbenQ8+K9B2?=
 =?us-ascii?Q?aBCJ2Wg1jLavlgg1DeRQCnPIpnnoew8QSEbdxI+wCQKKNuEzrBuO9IV8HcHt?=
 =?us-ascii?Q?SzLTmyv5xCYtBzddhfDLWaNoDaDcbPfmp/ZPRtxuDVvHBEFnN54a/9EKpQ68?=
 =?us-ascii?Q?7vhjMEDo//1hF+z4sL+uhUd8XIMrQ6YUhx3glF7hQFEhUeaRbdxAEZGzSroo?=
 =?us-ascii?Q?P6x5?=
MIME-Version: 1.0
Improve this question
2
  • @Schroeder; Thanks for editing the post (tho feels slightly odd, but i dont realy care), Tho the question was solved just before your edit went trough, so i apolygise for "Wasting" your time. – TechKitten Jan 24 '20 at 14:11
  • check the return path... if it doesn't match the from, that's a pretty big red flag. If they spoof the from they usually use a return path that's different so they can receive any replies or at least prevent the spoofed from getting any, "did you send this to me?" messages. – pcalkins Jan 24 '20 at 21:51
4

The mail address displayed by Outlook is just what is contained in the From: header, and can easily be forged. In fact, it is just one line of text in the top part of the message that is written by the sender (using low level tools, you can put anything there) and transported by all mail relays to the final recipient(s).

By examining all Received header lines, you can try to guess where this message followed the same relay chain as other true messages from your sister, but if you are not used to the SMTP protocol it can look rather cryptic...

Only if your sister finds the message in her Sent folder, il means that its mail account have been compromissed and she should change its password ASAP. Else it just means that someone has found its mail address somewhere and uses it at a mere label, and little if any can be done.

Improve this answer
5
  • I've asked my sis to check her mailboxes, and have posted the header in the post. – TechKitten Jan 24 '20 at 13:50
  • i think i can see who send it, but would like confirmation – TechKitten Jan 24 '20 at 13:50
  • @TechKitten: Hmm, we can say that this mail is likely to have passed through mail.okgroup.cz. Whether it actually came from somewhere else, hard to know... – Serge Ballesta Jan 24 '20 at 13:59
  • Thanks, In the future i now know how to doublecheck emails if needed. – TechKitten Jan 24 '20 at 14:08
  • 2
    Some attackers actually delete the message from their compromised accounts' Sent folders, so that is not diagnostic. – Adam Katz Feb 4 '20 at 17:48
0

Analyzing the message

When examining Received headers, the only ones you can trust are the ones added by your own email service's infrastructure. Among those, the only header of any consequence is the earliest (which will be the last in order as you read). To find it, determine your email domain's MX records and search for them. I'm guessing (since you redacted this info) that's DB8EUR05FT027.mail.protection.outlook.com in your case, so the key header is where this system received the connection from mail.okgroup.cz, as you suspected:

Received: from mail.okgroup.cz (95.129.100.50) by
 DB8EUR05FT027.mail.protection.outlook.com (10.233.239.192) with Microsoft
 SMTP Server id 15.20.2665.18 via Frontend Transport; Thu, 23 Jan 2020
 23:13:00 +0000

Therefore, you should be able to trust that header and everything above it, including the Authentication-Results header denoting that SPF (an anti-spoof system that allows a domain to authorize sending IPs) had a permanent error (which means the sending domain has probably improperly configured SPF) and that DKIM (an anti-spoof system that allows a domain to designate cryptographic keys to sign outgoing mail) was not configured.

The Authentication-Results header tells me your sister's email uses Hotmail, which definitely does not authorize okklient.cz to send on its behalf. Still, Hotmail does not have a DMARC policy of p=reject because too many users send through other infrastructures (older freemail providers like Hotmail are kind of locked into allowing this), so o365 didn't block the message as spoofed.

You can recreate this analysis by pasting the unredacted headers into a tool like G Suite Messageheader.

What does this say about the attack?

This sort of spam is increasingly common. It is a hallmark of Emotet for example, which infects a computer and sends mail to the victim's contacts.

We already know that the message was not sent from your sister's computer (unless she normally relays through okgroup.cz), so there's no direct evidence that she's infected, but somebody with both your and her email addresses was probably infected at some point in time (or else your contacts were harvested from some public resource, like a mailing list archive).

What should you do?

There isn't much you can do, unfortunately. Report the message as spam to your provider (I assume there's a "report spam" button) and to third parties like SpamCop (disclaimer, I work there). Since it didn't come from your sister's provider, you don't have to report it there (but it can't hurt).

If the set of people who have both your and your sister's email addresses is really small, you could reach out to them and encourage them to update their anti-virus software and then run a full virus scan on their systems. You and your sister should of course do this too.

Your sister, and that set of people if it's small enough, should change their email passwords just to be safe. If this happens again to you, you should change your password too. Use a password manager that generates a true random 11+ character password. Add two-factor authentication (2FA, MFA) to your account and advocate for that broadly.

Should you worry?

No, not really; this is sadly normal nowadays.

If this were targeted (which it is not!), if there were specific language targeting you (excluding a copy of an old email, which Emotet can do automatically), then you should worry because a human could be trying to compromise you in some specific manner, in which case you'd have to ask why; do you have some kind of access to resources, people, or money that might be worth something? Read more about that by searching for Business Email Compromise (BEC) or Advance-fee fraud (419).

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.