Stack Exchange Network

Stack Exchange network consists of 175 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange

Questions tagged [email-spoofing]

Email spoofing refers to the process of sending fraudulent emails that appears to be from someone that it is not.

0
votes
0answers
49 views

Suspicious spoof message through contact form pretending to be one of our employees

Yesterday we received this email message through the contact form of our website from a russian server: 9th of April - SPOOF MESSAGE: Name: John Surname: Smith EMail: pii-...
2
votes
1answer
115 views

How was I spoofed?

I am trying to figure out how we were spoofed for education purposes. The email came in perfectly with the user's email address and name. The only way we found out was the header information. Most ...
1
vote
1answer
82 views

Can an attacker discover email addresses without gaining server access?

Present situation: I am receiving emails at a few of my email addresses, different domain names, all housed on the same server. The emails ares spoofed (appear to be coming from each of the email ...
3
votes
2answers
119 views

Email verification by sending mail instead of receiving

I have an app whose main purpose is to help people track emails they send. In most user onboarding, The user is sent a secret URL via email. They validate by clicking a link to return the secret. ...
-1
votes
1answer
77 views

Google Apps From : email address, spoofed how?

We use google apps for business to host our business emails, using our own custom domain mysite.com. I view my emails via gmail.com I recently received an email from me@mysite.com to me@mysite.com ...
1
vote
2answers
158 views

How to extract intresting data from malicious e-mail header

Premise: I know pretty well how SMTP works, and how to read an e-mail header. I know what all the main fieds mean, but I couldn't know what to look for if I want to know if the mail is kind of ...
1
vote
1answer
36 views

Phishing/Spam using old MX record for direct sending which is circumventing Mimecast

We've been using Mimecast for email security for a few months now and there's been a dozen or so incidents where the phish/spam senders have utilized the old MX records to send directly to our Office ...
2
votes
1answer
52 views

Is there any tool or method to detect spoofed CCs?

One of our phishing scenarios during a pentest went like this: we send an email saying something along the lines of "As per the manager (CCd) please download the latest software included". Then we ...
2
votes
1answer
114 views

Why are my emails going to spam?

I have been trying to learn about phishing emails. I have read up quite a bit on it. I setup a domain somthing.tk (free domain), hosted a website on a VPS (Digital Ocean). Set up my own mail transfer ...
1
vote
1answer
86 views

Prevent spammers from faking emails being sent from you to someone else or yourself?

I received the following email with the headers below. How are the spammers exploiting this method of tricking users that their account is hacked? How can one prevent spammers from doing this with ...
1
vote
1answer
127 views

Bypassing OpenDMARC checks by forging Authentication-Results

In order to have mail exchanger MX servers to be able to deliver mail to the primary MX, both SPF and DMARC checks needs to be bypassed when the connection is made from a secondary MX. For SPF this is ...
114
votes
5answers
18k views

Why do phishing e-mails use faked e-mail addresses instead of the real one?

I read that you can write anything into the From: field of an e-mail. If that is true, then why are phishing e-mails trying to trick me with look-a-like addresses like service@amaz0n.com instead of ...
1
vote
1answer
95 views

Does google have access to all information on a Protonmail android app?

Gmail reads my emails so Protonmail becomes more appealing to me. It is more secure, is open source and they do not read your emails or give away your information to third parties. But, Protonmail ...
0
votes
2answers
68 views

How to find the source of business email account compromise

I have a gmail account example@gmail.com and I am sending emails to a lawyer with corporate email (I don't know the software they use). I am sending monthly bills to the lawyer for consulting fees. ...
1
vote
2answers
84 views

How are SPF records used in practice?

I always thought that receiving email servers check the "from" domain's SPF record to verify that the sending server is allowed to send email. For example, if I sent email from "atte@atte.com", the ...
1
vote
2answers
78 views

How can you use the information from Gmail's “Show Original” feature to check if an email really came from Google?

I received an email saying that someone logged into my Gmail account from an unknown device. How can I verify that this email (security alert) actually came from Google and not from a malicious source?...
0
votes
1answer
49 views

Gmail Contact List Safety

How can I know that my Gmail is spoofed or sending spams to other people I sent email to them before? I don't have clear signs of that especially my contact list is empty but I'm afraid this may ...
0
votes
0answers
31 views

Block/spam an email that doesn't match a rule

Is there anything we can put in place such to verify that if the sender's name = "John Doe" and the domain is not company.org (or legitimate verified SPF sender), then the message is marked as spam or ...
0
votes
1answer
66 views

Get original e-mail sender server to circumvent spoofing

I've posted this originally on SO, but it may as well be for here. As you know, with many e-mail services, you can get tricked into believing an e-mail has been sent from a different address. Using ...
1
vote
2answers
132 views

Why are email clients prevented from seeing the envelope?

Being able to compare the envelope values against the header field values is potentially useful for detecting fraudulent (e.g. spoofed) mail. However, email servers, when receiving mail over SMTP, ...
2
votes
2answers
170 views

Is it possible to defend against a backscatter attack?

Yesterday, some spammer on the other side of the world decided to send out a ton of phishing mails with my business mail address as both From address and envelope sender. The usual best practices are ...
0
votes
1answer
139 views

Bots trying to spoof encoded email links, but why?

I've setup an application for my client, that sends lists of job vacancies to subscribers every Monday morning. The emails use a custom link redirector service, to make the links email friendly, and ...
-2
votes
3answers
162 views

Two different IPV4 inside outlook email header

I am currently analysing an outlook email header. I am very confused because it has two ipv4 addresses x-originating from different locations. Usually there is an ipv4 towards the top of the header ...
0
votes
2answers
158 views

Check reputation of specific email address [closed]

I know that it's possible to check the reputation of email address domains, but what does the security community use to find information on the reputation of specific email addresseses? List of ways ...
0
votes
2answers
120 views

Spoofed email has appropriate alias but unknown email

My wife received a suspicious email where the "FROM" field contained my name, but the email appeared to be delivered from an E-Mail address that we do not recognize. The fact that the email used my ...
31
votes
1answer
8k views

Is it possible to fake 'received' field in the e-mail?

I've received some strange e-mail recently. The e-mail has different From and Reply-To fields. It has also To set to Undisclosed recipients but it's not crucial. At first I thought it's fake, but ...
1
vote
2answers
265 views

Can a custom return path make SPF redundant

My understanding is that SPF can be used to define a set of IP addresses that are permitted to send outbound emails on behalf of a domain. If a mail server that is not included in the set of permitted ...
2
votes
1answer
162 views

Is this phishing? How can I be sure? And what can be gained?

Yesterday I received an email that I assumed/hoped was legitimately from a prospective employer that I interviewed with several weeks ago. The timing of the email couldn't have made more sense as they ...
3
votes
2answers
130 views

Email/facebook account/internet protection service for private community

I apologize in advance for any inaccuracy. I am part of a yoga community which has no particular activity on the web or in the informatic sector. All we have that can be regarded as web-related is ...
2
votes
2answers
216 views

Is it safe to add IP address to SPF record

I am a programmer who manages online exchanges user also and i have been asked to add IP address to SPF record so that one of the application can hosted on Azure can send emails to user etc.. v=spf1 +...
3
votes
0answers
55 views

Find out who sent email with my IP?

Recently my contact list was shared through some emails recently sent from my account. I would like to find out who did this as it has caused me some financial loss. When I look at the email header, ...
1
vote
0answers
53 views

Phishing email linking to sharepoint address [duplicate]

Our organization got some sort of phishing email that contained an attachment which linked to sharepoint - ie. https://someaddress.sharepoint.com/:b:/... etc. The link takes you to that "sharepoint" ...
6
votes
2answers
935 views

Tracking click-through for organization-wide phishing email test [closed]

My organization wants to send out a test phishing email to all employees after a week of security awareness. I plan on drafting a basic HTML page and including a misspelled link to it in an email ...
1
vote
1answer
85 views

are some IP whois capable of going beyond proxies?

I received a suspicious email (suspicious body) coming from a legit person. The headers always show the legit adress as if the person in question has been hacked. But I wanted to go further and ...
0
votes
0answers
347 views

Fake Wordpress reset password email with an external X-Google-Original-From header

My employer owns a Wordpress blog and I have an account with it used to submit blog posts. I have recently received a few password reset emails that link to an external site. These emails appear to ...
2
votes
2answers
149 views

Can SPF be bypassed by using a shared email server?

As I understand it, SPF works by listing permitted SMTP server domains in the TXT DNS record of the domain you own. So if I own example.com and wish to permit a 3rd-party SMTP server at smtpexample....
3
votes
1answer
443 views

Received an email from a Bulgarian address trying to extort money

As the title says, I received an email from some Bulgarian email address saying that the sender has compromised my browser and thereby obtained control over my camera as well as gathering data on all ...
0
votes
1answer
120 views

How to tell ordinary spam from some abusing my mail?

From time to time I glance through my spam folder to gauge how the filters are working, and if they're catching any "ham." Most of the spam is really obvious, but I'm getting a few which made me ...
1
vote
1answer
94 views

Social Engineering Attack awareness using .doc and spoofed email

Need advise for our company experiment. We are planning to observe the security awareness among our staff. I have an idea but lacking of knowledge on how to do it. I want to create spoofed email and ...
4
votes
1answer
293 views

Reality Check: Create chaos at an office

An opportunity has arisen for me to perform a "real hacking attack" on a TV show. The target is to attack the TV headquarters and cause as much chaos as possible. The idea is to show how a business ...
4
votes
1answer
350 views

Does an email header/source contain sensitive information?

I think I received a phishing mail and I want to forward the email header/source to the company mentioned in the mail. Is there any sensitive information in the header or source, besides the email ...
9
votes
1answer
2k views

Why would PayPal send messages from another domain?

I have just received a message asking to consent to PayPal policy updates from the domain: https://epl.paypal-communication.com The actual link is full of trackers. Given the domain name, it sounds ...
0
votes
1answer
72 views

Email Address Spoofed

Starting this morning at 9:30 am I started receiving numerous emails in my AOL account thanking me for registering at their website and asking me to confirm my registration. I am not opening them at ...
2
votes
0answers
73 views

On a server I run, bogus incoming mail for a username which is my name. Should I be worried?

A server I run has a minimal public-facing mail exposure, running postfix on port 25 (no authentication on this port; IMAP is accessible by other means). In my mail logs it is not uncommon to find '...
0
votes
1answer
436 views

Fraud Email from Family Member [duplicate]

I got an email from what I thought is my family member, when I viewed the email it said it was from "heiner@heiner-starp.de" (no idea who this is). However the label that this email is under is my ...
0
votes
2answers
146 views

Which SPF quantifier applies when an SPF include is used?

An SPF record has several tags of which one can be the include tag, and the SPF record ends with a quantifier like +, ?, ~ or -. When an include tag is used, the included SPF record has it’s own SPF ...
1
vote
2answers
2k views

Do SPF records apply to all subdomains?

Does a SPF record apply only on the domain it’s setup for or also for all it’s subdomains? For example an SPF record that is configured for the domain example.com will set the policy for mails ending ...
58
votes
7answers
14k views

Email received regarding Security flaw in website

I received an email to techsupport@websitename.com (pretty generic email) saying that there was a security flaw in my website etc. etc My initial reaction was that this was a scam. (How/why did they ...
1
vote
1answer
152 views

How to disable email for a subdomain without using SPF

I am working on a tool that checks SPF records, and would like a way to be able to disable email from a testing subdomain, and its children, so that my test domains are not easy targets for spammers ...
0
votes
1answer
688 views

Tracing email sent from service?

I know an email was sent using the online service emkei.cz. Is there a way to find out who used that service to send the specific email I received?