Questions tagged [email-spoofing]
Email spoofing refers to the process of sending fraudulent emails that appears to be from someone that it is not.
210
questions
1
vote
2answers
90 views
How to check if a mail server is Enforced-STARTLS rather than Opportunistic-STARTTLS?
This article tells us that there are two types of STARTTLS: Opportunistic (i.e. optional STARTTLS) STARTTLS and Enforced STARTTLS, which works by the doctrine of "Encrypted connection or drop ...
0
votes
0answers
29 views
How to update the Return-Path that Facebook sends with?
Each facebook user gets legitimate facebook emails with a fixed
Return-Path: notification+ABC123@facebookmail.com
header. I.e., Bob will always get mails from ABC123, and Wilma from EFG456.
There is ...
0
votes
1answer
80 views
How can scammer actually reply from a spoofed email address?
I (mostly) understand how a scammer can send an email from a spoofed account, all you need is an unsecured SMTP server.
But how is it possible, for a scammer to RESPOND and maintain an email ...
1
vote
1answer
71 views
Questionable email from discord [duplicate]
I got a gmail from discord saying a new account had been registered and prompting me to click a verification link. Weirdly, I never made that account, and I already had a discord account under my ...
0
votes
1answer
54 views
Do email providers somehow validate/control “Send email as: ” feature?
I have a domain for a website that I'm going to deploy soon. I've registered a gmail account, and let's say it is myWebsite@gmail.com. In order to look more professional, I decided to use gmail's &...
0
votes
0answers
85 views
Spoofed email? “X-Source-Sender” and “Received” headers look dodgy
I got sent an email from someone in response to an over 2 year old exchange, and the contents of it look like spam to me.
Checking the headers the following looks normal:
Return-Path
Received & ...
0
votes
0answers
38 views
I received a phishing/spam email from Google Delivery Subsystem about an email I never sent. How? [duplicate]
Screenshot:
The text covered with red is exactly my email address except the end is @google.com instead of @gmail.com.
The suspicious link "Unsubscribe_click_here" is:
mailto:cr@burlondesti....
0
votes
0answers
56 views
Does SPF protect against spammers who control the initial MTA?
I understand that for most users, the Envelope-from address is the most difficult part of an email to spoof because (I assume) it is checked by the receiving MTA i.e. if you attempt to spoof the "...
1
vote
2answers
53 views
I have a custom domain for email. Do I need to configure DNS to prevent outgoing text messages with an address from my domain? [duplicate]
I own a custom domain that I use for e-mail. The mail server is configured with a catch-all that redirects messages to any user to my inbox. For the first time this afternoon, I received a benign &...
0
votes
0answers
29 views
How to track anonymous email sender (alternatives to IP tracking) [duplicate]
Are there any ways to get information on who is sending certain emails from an anonymous email address?
Besides the obvious IP solution, would there be any alternative such as embedding some kind of ...
0
votes
1answer
32 views
Spoofed DNS-Address in Spam mail header
There is a recent rise in Spam mails sent from seemingly legit german email-addresses according to the mail headers:
Received: from mx1.aok.de ([91.199.166.49])
But when I nslookup mx1.aok.de, I get ...
1
vote
1answer
59 views
php / email / iis
in a certain page I have a newsletter subscription form, where the user enters his e-mail address and then through PHP an authenticated e-mail is sent to myself with the user's information (e-mail ...
1
vote
1answer
69 views
Why can't mail clients verify an email was sent from the user and server it claims to be from?
Background
When I explain to my clients the security issues around email spoofing, I often explain that emails are like regular mail. Anyone can write Jon Doe on the return address, but that doesn't ...
1
vote
1answer
2k views
Amazon gift card phishing/spam — what's the point?
I recently received an email message with the subject "San Diego Site Leadership and Management Team sent you an Amazon Gift Card!", sent to my work address, apparently from "Amazon.com ...
1
vote
1answer
171 views
How could the content of an e-mail get leaked?
My Mother received an e-mail, from some unknown mail adress. The content of the mail, was:
"Hello you should look at this: ... " After this there was an old email correspondence with her ...
-1
votes
1answer
390 views
Where was this email sent from?
I have done the message header lookup but the problem is that the 1st result for the from field is blank, so I would like to know can someone with a bit more experience then the basic knowledge of ...
0
votes
3answers
105 views
Let user send an email to register to prevent outgoing mail abuse
Problem
Consider a standard sign-up form (user enters an email address, we send a confirmation link).
Even limiting that form per IP (or even globally per hour), I'm concerned about abuse:
Our real-...
1
vote
2answers
85 views
Anonymized posting mechanism for members-only-post mailing lists
Suppose you are administering a mailing list where only members/subscribers can post; but you want those members to be able to occasionally post some content to the list anonymously. (*)
Now, in an ...
18
votes
2answers
4k views
I received an “Undelivered Mail”, is my email address used maliciously?
I received an "Undelivered Mail Returned to Sender" email, which is quite suspicious.
The message is displayed in Thunderbird like this:
From: someRandomStuff my.name@mail.provider
Date: 24....
2
votes
1answer
88 views
Protecting against spoofed email in alias/phrase field
We have fully configured SPF, DKIM and DMARC policies (100% reject) for our email domain (e.g. spoofed.com), which is managed by gmail, but we have recently started seeing spear phishing emails with ...
24
votes
3answers
7k views
Reply to potentially spoofed email
A colleague recieved an unsolicited email along the lines below:
Dear Ms. Smith
please click on the following link to recieve Document X regarding
Project Y.
Yours,
Eve Nobody
eve.nobody@company.com
...
0
votes
1answer
355 views
Register an @yahoo.de email? [closed]
Years ago I created an account and put my reset email as example@yahoo.de by mistake, it should have been @yahoo.com.
Recently, I tried to access my old account but could not remember the password. ...
1
vote
2answers
89 views
What does it mean to get an email from someone with a different actual sender?
I got a strange email and I just want to confirm my suspicions.
For background, I have my own email server which I set up using iRedMail on a VPS. I have an acquaintance who most likely has me on ...
1
vote
3answers
88 views
What can I do to get rid of spam emails that come from different, randomized email addresses?
Here's an example of the address they're coming from:
I'm familiar with filtering settings, but how can I filter something that's different each time?
1
vote
2answers
91 views
Email sender spoofing check from receiver
I understand there are techniques to prevent someone from spoofing your domain in emails.
Is there any guarantee or check that the receiver can do to ensure the sender is authentic?
Gmail shows TLS ...
1
vote
1answer
72 views
Emails with links offering job
I am a designer. I have received several emails offering jobs. There is a link. I never click to links in emails. I look at the sender address and look at google to see if it could exist a real firm ...
0
votes
0answers
69 views
How do I run through the DKIM authentication?
I am currently reading on DKIM authentication for email and I would like to manually try to run through it (to facilitate my understanding of DKIM), but I would like to verify if it is possible to do ...
1
vote
2answers
6k views
Microsoft account security alert - Is this legit? [closed]
I've just received two emails in a row stating that "We detected something unusual about a recent sign-in for the Microsoft account" and "someone else might have accessed the Microsoft account..." (...
1
vote
0answers
48 views
Postfix maildrop -> pickup “from:” verification [duplicate]
I was surprised to notice that sending E-mail from local server account allow any user to send message with:
From: whatever@whateverdomain
This is a security issue, because it allow identity ...
0
votes
0answers
32 views
Saved email attachment not reflecting the actual sender of the email but the email of the person who received the email attachment as sender
I have come across certain scenarios which confuses me on how it is possible to manipulate email headers.
The person who received an email(A) from person (B), forwarded me (C) the email as Original ...
8
votes
1answer
3k views
Enforcing DMARC policy (reject) on an Office 365 tenant
The domain & tenant has SPF and DKIM properly configured and DMARC policy set to p=reject. Still, emails spoofed with the domain in the From header aren't rejected, but appear in the Junk Email ...
0
votes
2answers
142 views
Phishing emails - What do I look for?
I want to be able to spot a phishing email. What are the things to check when investigating and doing forensics on one?
There are some things I know to look for already but I want to get moer ...
0
votes
0answers
37 views
Do we need SPF when we have DKIM? [duplicate]
I always thought that to authenticate email we needed both SPF and DKIM (and DMARC). But email is confusing and recently I found myself asking why we can't do with just SPF or DKIM. I then discovered ...
1
vote
1answer
1k views
Possible Scam - reply address appears to be yours [closed]
Have received the following email which I believe to be a scam
Internet Crime Complaint Center (IC3)
In Partnership with:
Swiss National Fraud Relief Center (NFRC)
Case/Reference ID: IE3033900045
We ...
0
votes
1answer
78 views
emails were send from my own email address [closed]
A friend of mine has just received an email from my exactly own email adrress. What could this be and how do I stop it?
1
vote
1answer
74 views
How to test email spoofing with this php script? [closed]
I want to harden my SPF setting.
However I have trouble testing my SPF setting.
I want to be able send a test email to try out my new SPF settings.
Most of the resource on internet seems to be use ...
0
votes
0answers
48 views
Is there a way to block/filter spoofed emails Office 365/Exchange?
My company is currently a target of some social engineering attacks where company employees are being sent e-mails from the attacker pretending to be senior members of staff. They have the correct ...
1
vote
0answers
88 views
Is it possible to hijack specific e-mail with remote access? [closed]
I was recently presented with e-mails that look like they came from my e-mail and IP address but I didn't send them and never saw them. It is a back and forth correspondence with another gmail account....
8
votes
2answers
1k views
GMail Hack with 2-Factor Auth enabled
I have my business email on GMail. I use 2-factor authentication for access to said business email. I access my business email from 2 computers and 1 mobile Android device. I do not use Outlook or ...
2
votes
1answer
248 views
I received an phishing email from myself [duplicate]
So today when I was checking my spam folder on my outlook account, I noticed I had received an email from my own address.
The email looks like a typical scam:
Claims to have installed a RAT on my ...
0
votes
0answers
128 views
Logged in with a hacker's email address
I have an active account at ebay-kleinanzeigen.de (like Craigslist in the US).
Today I got a valid email from them that my email address was changed.
On my mac, I opened up my ebay-kleinanzeigen ...
3
votes
2answers
162 views
What prevents malicious servers from spoofing mail transfer agents and/or mail delivery agents?
An email system typically consists of multiple agents:
Mail user agent (MUA)
Mail submission agent (MSA)
Mail tranfer agent (MTA)
Mail delivery agent (MDA)
Evidently the 'middlemen' of this system ...
7
votes
1answer
1k views
How Concerning Is This X-CU-modified: FAKECU Text Attack?
A user clicked on the link of this email and entered their credentials, thinking the message was legitimate. However, the link didn't redirect to the fake site, and instead their mail client sent them ...
0
votes
2answers
17k views
Possible attack via Netflix; what action should I take, if any?
Late last night I received a "password reset" email from info@mailer.netflix.com.
It looked legit, but I had not requested a password reset. I checked my account's "recent account access" but saw ...
0
votes
0answers
61 views
How to detect a spoofed email with Outlook Web Access?
I am specifically asking about Outlook Web Access (browser based Outlook), and not for any other email service or program.
Within Outlook Web Access, is there a way to tell whether or not an email ...
-1
votes
1answer
476 views
Spam/Phishing detection when there is no MX record
While SPF/DKIM/DMARC are standard, foundational tools to help protect an email-sending domain from spoofing, what about domains that do not send emails?
How do spam or phishing filters treat emails ...
2
votes
3answers
939 views
SPF and Office 365 email accounts spoofing other Office 365 email accounts
After an incident, I have a question which answer's I cannot find.
I cannot provide the real headers as they come from a client.
Let’s consider a company which uses an Office365 tenant as mail server....
1
vote
1answer
666 views
I clicked a link in an email message. What should I do now?
I got a message that looked like an ad from Microsoft. At the end, there was a message saying "You can simply WIPE Out your email from Mailing List click here". I clicked. I got to a page this ...
5
votes
2answers
1k views
How did a phishing email pass SPF, DKIM and DMARC?
A friend received a spoofed email (from Bank of America using an uber.com address) which was correctly identified as 'spam' by Gmail. However, looking at the raw message it seems to have passed SPF, ...
2
votes
2answers
131 views
What is the reason for DMARC spec to not require specifically SPF or DKIM pass?
DMARC produces "pass" result if and only if at least one of SPF and DKIM checks pass. It has been noted that DKIM provides stronger protection of the two (if implemented properly). But, in order to ...
