6

I received this email from what is supposedly Facebook today. Here's a screenshot: email

I was not aware I had credits or credits existed on Facebook and apparently I have $2.30 worth. It looks legitimate at first glance, the email address looks like all the other Facebook emails I get but I have a few reasons to believe this is fake and a phishing attempt.

  1. All of the links on the page, which I haven't clicked on by the way, when hovering over and getting a preview of the link in the bottom left corner, aren't actual URLs, just directories I think. The Facebook header link points to setting?tab=payments. The review your balance link is the same thing. The app center link is just appcenter. Perhaps a failed phishing attempt or the email team messed up, not something Facebook would do.

  2. The email style of the header, and background doesn't look anything like the legitimate emails I get from Facebook. To see what I mean, take a look at this email I got a couple days ago.two

As you can see, the top blue bar is a solid blue bar, unlike the gradiented bar on the first email. The background is white not grey like the first one. And it's not full width like the first one. The styles are similar but the first one looks a little older than the one I got a couple days ago which has a flatter look.

Is this email legitimate or is it some sort of failed phishing attempt?

Edit: here is the source code:

Delivered-To: myEmail@gmail.com
Received: by 10.64.208.67 with SMTP id mc3csp215958iec;
        Mon, 28 Jul 2014 11:18:02 -0700 (PDT)
X-Received: by 10.68.191.194 with SMTP id ha2mr5567506pbc.143.1406571481784;
        Mon, 28 Jul 2014 11:18:01 -0700 (PDT)
Return-Path: <notification+kr4mqmknaean@facebookmail.com>
Received: from mx-out.facebook.com (outmail021.prn2.facebook.com. [66.220.144.148])
        by mx.google.com with ESMTPS id bg5si3360342pdb.468.2014.07.28.11.18.01
        for <myEmail@gmail.com>
        (version=TLSv1 cipher=ECDHE-RSA-RC4-SHA bits=128/128);
        Mon, 28 Jul 2014 11:18:01 -0700 (PDT)
Received-SPF: pass (google.com: domain of notification+kr4mqmknaean@facebookmail.com designates 66.220.144.148 as permitted sender) client-ip=66.220.144.148;
Authentication-Results: mx.google.com;
       spf=pass (google.com: domain of notification+kr4mqmknaean@facebookmail.com designates 66.220.144.148 as permitted sender) smtp.mail=notification+kr4mqmknaean@facebookmail.com;
       dkim=pass header.i=@facebookmail.com;
       dmarc=pass (p=REJECT dis=NONE) header.from=facebookmail.com
Received: from facebook.com (f2hk/PLxoaEIT/fBlhT+zd5nnjzhUaEeZHCH61uLXXqwZpYsw2Ru1XBNzDHLgndM 10.103.99.61)
 by facebook.com with Thrift id 8297627c168311e4a87a0002c992c8ec-5c5fb400;
 Mon, 28 Jul 2014 11:18:01 -0700
X-Facebook: from 10.83.48.31 ([MTI3LjAuMC4x]) 
    by async.facebook.com with HTTP (ZuckMail);
Date: Mon, 28 Jul 2014 11:18:01 -0700
Return-Path: notification+kr4mqmknaean@facebookmail.com
To: Milo Gosnell <myEmail@gmail.com>
From: "Facebook" <notification+kr4mqmknaean@facebookmail.com>
Reply-to: noreply <noreply@facebookmail.com>
Subject: You have $2.30 in your Facebook account
Message-ID: <e97806d65a32ea0f70f0cadf5f5df3e6@async.facebook.com>
X-Priority: 3
X-Mailer: ZuckMail [version 1.00]
Errors-To: notification+kr4mqmknaean@facebookmail.com
X-Facebook-Notify: payment_credits_to_lc_balance; mailid=a409107G5af3188d358eG0G28eG21014dad
X-FACEBOOK-PRIORITY: 0
X-Auto-Response-Suppress: All
MIME-Version: 1.0
Content-Type: multipart/alternative;
    boundary="b1_e97806d65a32ea0f70f0cadf5f5df3e6"
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=facebookmail.com;
    s=s1024-2013-q3; t=1406571481;
    bh=be0apt2xjA3K0VqNAhrb4AJp1qqCmG/w36+vycpp3b0=;
    h=Date:To:From:Subject:MIME-Version:Content-Type;
    b=gvByiMKxQpl/GjtzE2LzNHOd+5W8bsyhfNbUTzr8H6s3HbLYShCJnW1nSWtJCzdpd
     srNFP6R7b7QkCsANFCq0wTLxHqnA0JsEyq6ys9ZviAX3SAAUxm8Gve1+KCpHWPYifX
     Eqa2Jjzo13vN73niZb3KQGxwMFKZOWbM+GTxhV5w=


--b1_e97806d65a32ea0f70f0cadf5f5df3e6
Content-Type: text/plain; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable


Hi Milo,

Facebook has changed from credits to local currency. You have $2.30 in =
your account. You can review your balance or use this money on apps or =
games in the App Center.

Thanks,

The Facebook Payments Team



=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D
This message was sent to myEmail@gmail.com. If you don't want to receive =
these emails from Facebook in the future, please follow the link below to =
unsubscribe.
https://www.facebook.com/o.php?k=3DAS3FhR4P3qzdS6JW&u=3D100000135460238&mi=
d=3Da409107G5af3188d358eG0G28eG21014dad
Facebook, Inc., Attention: Department 415, PO Box 10005, Palo Alto, CA =
94303


--b1_e97806d65a32ea0f70f0cadf5f5df3e6
Content-Type: text/html; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable

<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional =
//EN"><html><head><title>Facebook</title><meta http-equiv=3D"Content-Type" =
content=3D"text/html; charset=3Dutf-8" =
/><style>body{background:#e0e1e5;font-family:'Helvetica =
Neue',Helvetica,'Lucida Grande',tahoma,verdana,arial,sans-serif;font-weigh=
t:300}a{color:#333;text-decoration:none;white-space:nowrap =
!important}#email_table{width:100% !important}#email_content{padding:0 =
!important}#profile_pic =
img{border:0}*[class].usercard{background:#fff}@media all and =
(max-device-width: 720px){a{white-space:pre-wrap =
!important}table[bgcolor=3D"#e9eaed"]{background:transparent =
!important}*[id]#body_container{border-bottom:1px solid #e5e5e5 =
!important}table[width=3D"610"],*[id]#body_container,*[id]#cta_container{t=
able-layout:fixed}*[id]#cta_outer{border:none !important}*[id]#header_prof=
ile>table>tbody>tr>td:not(:nth-child(4)){display:none =
!important}*[id]#profile_name{display:none}*[id]#profile_pic{-moz-border-r=
adius:3px !important;-webkit-border-radius:3px =
!important;border-radius:3px !important;border-width:0 =
!important;overflow:hidden}*[id]#header_title{width:auto =
!important}*[id]#header_profile{width:24px}*[class].bio{display:none =
!important}*[id]#main_content{width:100%}*[class].content>div =
a{display:block;overflow:hidden;text-overflow:ellipsis;white-space:nowrap =
!important;width:160px}*[class].ext{padding-right:20px}*[class].image =
a{display:block;margin-left:20px}*[class].cta_btn,*[class].scnd_btn{displa=
y:block}*[id]#email_cta>tbody>tr>td[width=3D"100%"]{display:none}}@media =
all and (device-width: 720px){table[width=3D"610"],*[id]#body_container,*[=
id]#footer_container{width:340px}*[id]#email_filler td{height:12px =
!important}*[class].usercard{width:300px !important}}@media all and =
(max-device-width: =
480px){*[id]#cta_container>table>tbody>tr>td[height=3D"15"]{display:none =
!important}}@media all and (device-width: 320px){table[width=3D"610"],*[id=
]#body_container,*[id]#cta_container{min-width:400px;width:auto}center{pad=
ding:0 10px}*[class].content>div a{width:182px}}</style></head><body =
style=3D"margin:0;padding:0;" dir=3D"ltr"><table cellspacing=3D"0" =
cellpadding=3D"0" id=3D"email_table" =
style=3D"border-collapse:collapse;width:98%;" border=3D"0"><tr><td =
id=3D"email_content" style=3D"font-family:&#039;lucida =
grande&#039;,tahoma,verdana,arial,sans-serif;font-size:12px;padding:0px;ba=
ckground:#e0e1e5;"><table cellspacing=3D"0" cellpadding=3D"0" =
width=3D"100%" border=3D"0" =
style=3D"border-collapse:collapse;width:100%;"><tr><td =
style=3D"font-size:11px;font-family:LucidaGrande,tahoma,verdana,arial,sans=
-serif;padding:0;border-left:none;border-right:none;border-top:none;border=
-bottom:none;"><table cellspacing=3D"0" cellpadding=3D"0" width=3D"100%" =
style=3D"border-collapse:collapse;"><tr><td =
style=3D"padding:0;width:100%;"><span style=3D"color:#FFFFFF;display:none =
!important;font-size:1px;">Hi Milo, Facebook has changed from credits to =
local currency. You have $2.30 in your account. You can review your =
balance or use this money on apps or games in the App Center . Thanks, The =
Facebook Payments Team</span></td></tr><tr><td =
style=3D"padding:0;width:100%;"><table cellspacing=3D"0" cellpadding=3D"0" =
width=3D"100%" bgcolor=3D"#435E9C" style=3D"border-collapse:collapse;width=
:100%;background:#435E9C;background-image:-webkit-linear-gradient(top, =
#5c77b5, #435e9c);border-color:#0A1F4F;border-style:solid;border-width:0px =
0px 1px 0px;box-shadow:0 1px 1px rgba(0, 0, 0, 0.25);height:47px;" =
id=3D"header"><tr><td style=3D""><center><table cellspacing=3D"0" =
cellpadding=3D"0" width=3D"610" height=3D"44" =
style=3D"border-collapse:collapse;"><tr><td align=3D"left" =
id=3D"header_title" style=3D"width:100%;line-height:47px;"><table =
cellspacing=3D"0" cellpadding=3D"0" =
style=3D"border-collapse:collapse;"><td style=3D""><a =
href=3D"/settings?tab=3Dpayments" style=3D"color:#FFFFFF;text-decoration:n=
one;font-weight:bold;font-family:lucida grande,tahoma,verdana,arial,sans-s=
erif;vertical-align:baseline;font-size:20px;letter-spacing:-0.03em;text-al=
ign:left;text-shadow:0 1px 0 rgba(0, 0, 0, 0.24);"> facebook </a></td><td =
width=3D"10" style=3D"width:10px;"></td><td style=3D""><font =
color=3D"white" size=3D"3"><a =
style=3D"color:#ffffff;text-decoration:none;font-family:Helvetica =
Neue,Helvetica,Lucida Grande,tahoma,verdana,arial,sans-serif;font-size:16p=
x;font-weight:bold;text-shadow:0 -1px rgba(34, 59, 115, =
0.85);vertical-align:middle;" href=3D"/settings?tab=3Dpayments"></a></font=
></td></table></td></tr></table></center></td></tr></table></td></tr><tr><=
td style=3D"padding:0;width:100%;"><table cellspacing=3D"0" =
cellpadding=3D"0" width=3D"100%" bgcolor=3D"#e0e1e5" id=3D"table_color" =
style=3D"border-collapse:collapse;"><td style=3D""><table =
cellspacing=3D"0" cellpadding=3D"0" width=3D"100%" id=3D"email_filler" =
style=3D"border-collapse:collapse;"><td height=3D"19" =
style=3D"">&nbsp;</td></table><center><table cellspacing=3D"0" =
cellpadding=3D"0" width=3D"610" =
style=3D"border-collapse:collapse;"><tr><td align=3D"left" =
id=3D"body_container" style=3D"background-color:#ffffff;border-color:#c1c2=
c4;border-style:solid;display:block;border-width:1px;border-radius:5px;-we=
bkit-border-radius:5px;-moz-border-radius:5px;box-shadow:0 1px 1px rgba(0, =
0, 0, 0.10);overflow:hidden;"><table cellspacing=3D"0" cellpadding=3D"0" =
width=3D"100%" style=3D"border-collapse:collapse;"><td =
style=3D"padding:15px;"><table cellspacing=3D"0" cellpadding=3D"0" =
style=3D"border-collapse:collapse;width:100%;"><tr><td =
style=3D"font-size:11px;font-family:LucidaGrande,tahoma,verdana,arial,sans=
-serif;padding-bottom:10px;">Hi Milo,</td></tr><tr><td =
style=3D"font-size:11px;font-family:LucidaGrande,tahoma,verdana,arial,sans=
-serif;padding-top:10px;padding-bottom:10px;">Facebook has changed from =
credits to local currency. You have $2.30 in your account. You can <a =
href=3D"/settings?tab=3Dpayments" =
style=3D"color:#3b5998;text-decoration:none;">review your balance</a> or =
use this money on apps or games in the <a href=3D"/appcenter" =
style=3D"color:#3b5998;text-decoration:none;">App =
Center</a>.</td></tr><tr><td style=3D"font-size:11px;font-family:LucidaGra=
nde,tahoma,verdana,arial,sans-serif;padding-top:10px;">Thanks,<br />The =
Facebook Payments Team</td></tr></table></td></table></td></tr></table></c=
enter></td></table></td></tr><tr><td =
style=3D"padding:0;width:100%;"><table cellspacing=3D"0" cellpadding=3D"0" =
width=3D"100%" style=3D"border-collapse:collapse;" =
id=3D"footer_table"><tr><td style=3D""><center><table cellspacing=3D"0" =
cellpadding=3D"0" width=3D"610" =
style=3D"border-collapse:collapse;"><tr><td style=3D""><table =
cellspacing=3D"0" cellpadding=3D"0" width=3D"610" border=3D"0" =
id=3D"footer" style=3D"border-collapse:collapse;"><tr><td =
style=3D"font-size:12px;font-family:Helvetica Neue,Helvetica,Lucida =
Grande,tahoma,verdana,arial,sans-serif;padding:18px 0;border-left:none;bor=
der-right:none;border-top:none;border-bottom:none;color:#6a7180;font-weigh=
t:300;line-height:16px;text-align:center;border:none;">This message was =
sent to <a href=3D"mailto:myEmail&#064;gmail.com" =
style=3D"color:#6a7180;text-decoration:none;font-family:Helvetica =
Neue,Helvetica,Lucida Grande,tahoma,verdana,arial,sans-serif;font-weight:b=
old;">myEmail&#064;gmail.com</a>. If you don&#039;t want to receive these =
emails from Facebook in the future, please <a href=3D"https://www.facebook=
.com/o.php?k=3DAS3FhR4P3qzdS6JW&amp;u=3D100000135460238&amp;mid=3Da409107G=
5af3188d358eG0G28eG21014dad" =
style=3D"color:#6a7180;text-decoration:none;font-family:Helvetica =
Neue,Helvetica,Lucida =
Grande,tahoma,verdana,arial,sans-serif;font-weight:bold;">unsubscribe</a>. =
Facebook, Inc., Attention: Department 415, PO Box 10005, Palo Alto, CA =
94303</td></tr></table></td></tr></table></center></td></tr></table></td><=
/tr></table></td></tr></table><span style=3D"width:100%;"><img =
src=3D"https://www.facebook.com/email_open_log_pic.php?mid=3Da409107G5af31=
88d358eG0G28eG21014dad" style=3D"border:0;width:1px;height:1px;" =
/></span></td></tr></table></body></html>



--b1_e97806d65a32ea0f70f0cadf5f5df3e6--
  • Google facebookmail.com and you will find a lot of results questioning mails coming from this domain. – ComFreek Jul 28 '14 at 20:56
  • 3
    You may find this article or this article, and especially this question useful for differentiating between real facebook messages and phishing attempts. The first email appears to be a phishing scam but I can't be completely sure. I would suggest simply going to facebook.com and logging in to see if you actually have $2.30 in your acco – scribblemaniac Jul 28 '14 at 20:57
  • can you post the source code of the email? – tim Jul 28 '14 at 22:04
  • @tim I posted the source. – Milo Jul 28 '14 at 22:11
  • 1
    except for the two points you mentioned, I cannot find anything wrong with it (but I'm not a phishing expert; facebookmail.com definitely seems legit, and all the received fields seem to check out). When you log in to facebook, do you have $2.30 in your account? And you can always contact facebook (phish@fb.com), maybe they'll even reply – tim Jul 28 '14 at 22:47
7

I wouldn't put it past Facebook to "mess up".


From the headers, it appears that Google's servers saw the request as coming from IP address 66.220.144.148, which is indeed part of the facebookmail.com domain. The Google server verified the DKIM signature on the email, relatively to the public key found in the DNS as a TXT record for s1024-2013-q3._domainkey.facebookmail.com: this is a 1024-bit RSA key and, right now, the signature still matches. 1024-bit RSA are still beyond the technologically feasible (current breaking record is 768 bits), unless one invests a significant number of millions of dollars into building a dedicated machine, but it would be improbable that such an investment would be done for hacking into Facebook accounts.

Therefore it seems plausible that the email really exited from the machines associated with the facebookmail.com domain. It is documented that this domain really belongs to Facebook, and they really use it to send notifications to users. For instance, this article states that:

Confusingly, Facebook notifications come from the facebookmail.com domain and include a suspicious-looking sender's name. The long, complicated URL might also look suspicious, but this notification is a legit one from Facebook.

I totally agree with the "confusingly".

Now, that the email comes from Facebook does not mean that it is legit; it just means that if the email is fake, then the attacker compromised some machine within the Facebook internal network and sent the email from that machine.

As you notice, the email is weird; it does not "look like" a normal Facebook notification; moreover, the clickable links in the email are broken (since they are relative links, without a protocol or server part, they won't send you anywhere if you click on them -- if you read the email from a Webmail, they might send you on some page on that Webmail server, here Gmail.com...).

My overall assessment is that the email is not an attack, but a technical blunder from the people at Facebook, who were testing some prototype notification for something related to Facebook Game Payments, and triggered the system for the wrong account (yours, in this case).


Anyway, for all emails, the usual rule must be maintained: DO. NOT. CLICK.

If the email is legit, then you can log in the relevant site and see for yourself. You do not have to follow a clickable link from the email itself. The simple rule of never clicking on email links will keep you safe from phishing attempts.

protected by Community Dec 22 '15 at 17:54

Thank you for your interest in this question. Because it has attracted low-quality or spam answers that had to be removed, posting an answer now requires 10 reputation on this site (the association bonus does not count).

Would you like to answer one of these unanswered questions instead?

Not the answer you're looking for? Browse other questions tagged or ask your own question.