1

I (mostly) understand how a scammer can send an email from a spoofed account, all you need is an unsecured SMTP server.

But how is it possible, for a scammer to RESPOND and maintain an email conversation with the victim from the spoofed address? In this case, there was no "reply-to" and the domain is completely legitimate.

The only clue was that the mail address of the responder (scammer) was in some (not all) cases suffixed with a "1", i.e. [email protected] and [email protected].

My first thought was that the mail server at "legitdomain.com" was compromised, in which case pulling this off should be fairly simple since you can receive and respond to emails and create rules to redirect emails from target addresses so that the domain owner staff don't see them. You can also read incoming/outgoing emails to help with target selection, i.e. target a recently invoiced client that is about to make a payment and convince them that the banking details changed.

But is there a way to do this without having access to the mail server?

Improve this question
3
  • 5
    What makes you sure that the email is spoofed instead of the attacker controlling the used account? There is no need for this to control the mail server, it is sufficient to control the specific account.
    – Steffen Ullrich
    Commented Jun 22, 2021 at 18:02
  • 2
    I think you are using the term "spoofed" incorrectly. "Spoofing" is a specific technical term. If you can determine what exactly happened with the account, you might find that the answer is obvious. [email protected] is not necessarily "spoofed".
    – schroeder ♦
    Commented Jun 22, 2021 at 18:46
  • 2
    spoofing may not be the right term. if you mean they send by setting another email as a "from" address, you dont have to be a hacker for this. But this is too primitive & will be filtered/rejected/marked by the receiving server. However, possible they gained access to DNS, mail server, or they leverage wrong DNS records setup, using internationalized domain name (using intern characters that look like english ones), using lookalike domains (eg number 1 instead of letter l), using server IPs that was once allowed in spf etc but smb else got it now etc. These are not really spoofing though
    – Selay
    Commented Jul 18, 2022 at 3:04

1 Answer 1

Reset to default
2

There are two ways that this might be "spoofed":

  1. The first way is that the adversary actually has control of the mailserver or a compromised account. It's not uncommon for adversaries to try and hijack a legit email address as a means to send phishing attacks. During my time as a SOC analyst (I worked for a large medical university) we would often get phishing emails coming from real .edu addresses. The adversary would initally compromise some random account from another university, and then send phishing messages from those accounts as a means to add credibility to their asks. Part of my job was to call these other schools and tell them that they had a compromised account.

  2. The second option could be that they registered a domain that looks just like the real one. A trivial example would be something like m1crosoft.com. Some of these are so close and well crafted that it takes a trained eye to catch them. It's even harder if it's not a well-known brand in which case you may not know what the actual URL is--so you wouldn't know that "mycompnay.com" is actually a 'spoofed' version of my-comapny.com

Improve this answer
2
  • 1
    Thanks Tobin, given your response as well as the comments to the main post, it seems there is no glaringly obvious way for a scammer to "spoof" or "impersonate" an email address for both sending AND receiving of emails (without using reply-to). This leaves us with either a compromised server, compromised email account, or compromised individual. It's also not a case of a look-a-like domain. My reason for coming to this forum was to learn if there are other more advanced methods that I'm unaware of, manipulating MX records or something of that nature.
    – Matthys Du Toit
    Commented Jun 23, 2021 at 6:48
  • 1
    It takes a knowledgeable inspection of the email headers to determine where an email actually originated. Anyone can easily send an email that reads as "From: [email protected]" and directs you to reply to some other address.
    – ddyer
    Commented Jul 25, 2021 at 0:52

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .