0

I received a strange email from security@facebookmail.com. Sources on the internet seem to state that this is a Facebook-owned domain but I know the email is not legit because they do not address me by my first name, but instead by my email address. Also, I do not have a Facebook account with this particular email address.

Email screenshot

Scam emails like this typically include links to malicious websites. However, this one does not. The main action button of the email is a link to send an email to unrecognized.facebook.activity@gmail.com, which is obviously not a legit Facebook email address. All of the other buttons and links in the email also have a mailto: link to the same address, just with a different Subject.

If it matters, the email client I was using is Outlook.com.


I have 2 questions regarding this.

1. How did it pass SPF, DKIM and DMARC?

I know that this question was asked before:

How did this paypal spoof email pass SPF, DKIM and DMARC

How did a phishing email pass SPF, DKIM and DMARC?

However, in the first case, it was an actual legitimate email. In the second one, the address was From: Bank Of America <peopledevelopment@uber.com>, so there was no actual spoofing. In my case, it is facebook <security@facebookmail.com>. There are no special characters.

2. How does the scam work?

It does not seem that clicking the links will cause anything malicious, since it will just create a new email in the receiver’s email client.

I found a similar question: Trying to understand the point of this scam email

Over there, the answers mention that it might be a way to generate the email addresses of people who do click the buttons. I do not see how this might apply to my example because the link does not actually send the reply email, but just creates it locally on the email client.

For comparison, this is what I see when I inspect the main button:

Email scam button inspect


I tried to use the View Message Source feature on my email client, and found something interesting:

Received: from AM4PR0202MB2852.eurprd02.prod.outlook.com (2603:10a6:200:8e::8)
 by AS8PR02MB6583.eurprd02.prod.outlook.com with HTTPS; Mon, 17 Jan 2022
 21:06:19 +0000
Received: from MWHPR12CA0043.namprd12.prod.outlook.com (2603:10b6:301:2::29)
 by AM4PR0202MB2852.eurprd02.prod.outlook.com (2603:10a6:200:8e::8) with
 Microsoft SMTP Server (version=TLS1_2,
 cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.4888.9; Mon, 17 Jan
 2022 21:06:15 +0000
Received: from CO1NAM11FT028.eop-nam11.prod.protection.outlook.com
 (2603:10b6:301:2:cafe::f4) by MWHPR12CA0043.outlook.office365.com
 (2603:10b6:301:2::29) with Microsoft SMTP Server (version=TLS1_2,
 cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.4888.10 via Frontend
 Transport; Mon, 17 Jan 2022 21:06:14 +0000
Authentication-Results: spf=fail (sender IP is 31.192.237.146)
 smtp.mailfrom=facebookmail.com; dkim=none (message not signed)
 header.d=none;dmarc=fail action=oreject
 header.from=facebookmail.com;compauth=fail reason=000
Received-SPF: Fail (protection.outlook.com: domain of facebookmail.com does
 not designate 31.192.237.146 as permitted sender)
 receiver=protection.outlook.com; client-ip=31.192.237.146; helo=brave19.com;
Received: from brave19.com (31.192.237.146) by
 CO1NAM11FT028.mail.protection.outlook.com (10.13.175.214) with Microsoft SMTP
 Server id 15.20.4888.9 via Frontend Transport; Mon, 17 Jan 2022 21:06:13
 +0000

It seems that the email failed the SPF check? If so, how did the email end up in my inbox?

1 Answer 1

3

1. How did it pass SPF, DKIM and DMARC?

It doesn't. From the snippet you provide, SPF, DMARC and DKIM are either not present or fail. The email address has just been spoofed.

Authentication-Results: spf=fail (sender IP is 31.192.237.146)
 smtp.mailfrom=facebookmail.com; dkim=none (message not signed)
 header.d=none;dmarc=fail action=oreject
 header.from=facebookmail.com;compauth=fail reason=000
Received-SPF: Fail (protection.outlook.com: domain of facebookmail.com does
 not designate 31.192.237.146 as permitted sender)

2. How does this scam work?

My best guess is that they are hoping you have a facebook account on this email, and will try to report the activity by sending an email to them. Then they will try to phish credentials from you by asking you for your password for "verification purposes" or something. Of course, a savvy user will recognize this as phishing, but unknowing users might think it is legitimate, and fall for it.

1
  • I should have paid more attention to the authentication results. I just assumed that my email client would not have put the email in my Inbox if it failed all the checks...
    – hb20007
    Jan 17 at 22:41

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.