Questions tagged [email-spoofing]
Email spoofing refers to the process of sending fraudulent emails that appears to be from someone that it is not.
170
questions
-1
votes
0answers
56 views
SendGrid emails ignoring SPF records for mass phishing attempts
Recently we have encountered 2 instances of mass phishing attempts from 2 accounts using SendGrid although the SPF is published as hard fail for both without SendGrid records and only for the mail ...
0
votes
0answers
48 views
How to detect a spoofed email with Outlook Web Access?
I am specifically asking about Outlook Web Access (browser based Outlook), and not for any other email service or program.
Within Outlook Web Access, is there a way to tell whether or not an email ...
1
vote
1answer
41 views
Spam/Phishing detection when there is no MX record
While SPF/DKIM/DMARC are standard, foundational tools to help protect an email-sending domain from spoofing, what about domains that do not send emails?
How do spam or phishing filters treat emails ...
2
votes
3answers
135 views
SPF and Office 365 email accounts spoofing other Office 365 email accounts
After an incident, I have a question which answer's I cannot find.
I cannot provide the real headers as they come from a client.
Let’s consider a company which uses an Office365 tenant as mail server....
1
vote
1answer
500 views
I clicked a link in an email message. What should I do now?
I got a message that looked like an ad from Microsoft. At the end, there was a message saying "You can simply WIPE Out your email from Mailing List click here". I clicked. I got to a page this ...
3
votes
2answers
227 views
How did a phishing email pass SPF, DKIM and DMARC?
A friend received a spoofed email (from Bank of America using an uber.com address) which was correctly identified as 'spam' by Gmail. However, looking at the raw message it seems to have passed SPF, ...
1
vote
1answer
65 views
What is the reason for DMARC spec to not require specifically SPF or DKIM pass?
DMARC produces "pass" result if and only if at least one of SPF and DKIM checks pass. It has been noted that DKIM provides stronger protection of the two (if implemented properly). But, in order to ...
1
vote
1answer
2k views
Bogus Instagram account using my email, never been verified, has over 1000 followers
This appears to be a phishing scam like I've never encountered before.
I received an email from security@mail.instagram.com to an email address I rarely use, but I noticed it because messages get ...
-1
votes
1answer
221 views
Received ransom email containing my password. How did they get my password?
Finally, even I got the fabled ransomware emails we've all heard about so much.
First, let's look at the facts before I get to my question:
I use Mozilla Thunderbird as my email client.
I was ...
0
votes
0answers
53 views
Suspicious spoof message through contact form pretending to be one of our employees
Yesterday we received this email message through the contact form of our website from a russian server:
9th of April - SPOOF MESSAGE:
Name: John
Surname: Smith
EMail: pii-...
2
votes
1answer
134 views
How was I spoofed?
I am trying to figure out how we were spoofed for education purposes. The email came in perfectly with the user's email address and name. The only way we found out was the header information. Most ...
1
vote
1answer
84 views
Can an attacker discover email addresses without gaining server access?
Present situation: I am receiving emails at a few of my email addresses, different domain names, all housed on the same server. The emails ares spoofed (appear to be coming from each of the email ...
3
votes
2answers
130 views
Email verification by sending mail instead of receiving
I have an app whose main purpose is to help people track emails they send.
In most user onboarding, The user is sent a secret URL via email. They validate by clicking a link to return the secret.
...
-1
votes
1answer
78 views
Google Apps From : email address, spoofed how?
We use google apps for business to host our business emails, using our own custom domain mysite.com.
I view my emails via gmail.com
I recently received an email from me@mysite.com to me@mysite.com ...
1
vote
2answers
190 views
How to extract intresting data from malicious e-mail header
Premise: I know pretty well how SMTP works, and how to read an e-mail header. I know what all the main fieds mean, but I couldn't know what to look for if I want to know if the mail is kind of ...
2
votes
1answer
61 views
Is there any tool or method to detect spoofed CCs?
One of our phishing scenarios during a pentest went like this: we send an email saying something along the lines of "As per the manager (CCd) please download the latest software included". Then we ...
2
votes
1answer
130 views
Why are my emails going to spam?
I have been trying to learn about phishing emails. I have read up quite a bit on it. I setup a domain somthing.tk (free domain), hosted a website on a VPS (Digital Ocean). Set up my own mail transfer ...
1
vote
1answer
173 views
Prevent spammers from faking emails being sent from you to someone else or yourself?
I received the following email with the headers below. How are the spammers exploiting this method of tricking users that their account is hacked?
How can one prevent spammers from doing this with ...
1
vote
1answer
244 views
Bypassing OpenDMARC checks by forging Authentication-Results
In order to have mail exchanger MX servers to be able to deliver mail to the primary MX, both SPF and DMARC checks needs to be bypassed when the connection is made from a secondary MX. For SPF this is ...
115
votes
5answers
18k views
Why do phishing e-mails use faked e-mail addresses instead of the real one?
I read that you can write anything into the From: field of an e-mail.
If that is true, then why are phishing e-mails trying to trick me with look-a-like addresses like service@amaz0n.com instead of ...
1
vote
1answer
103 views
Does google have access to all information on a Protonmail android app?
Gmail reads my emails so Protonmail becomes more appealing to me. It is more secure, is open source and they do not read your emails or give away your information to third parties. But, Protonmail ...
0
votes
2answers
72 views
How to find the source of business email account compromise
I have a gmail account example@gmail.com and I am sending emails to a lawyer with corporate email (I don't know the software they use). I am sending monthly bills to the lawyer for consulting fees.
...
2
votes
2answers
113 views
How are SPF records used in practice?
I always thought that receiving email servers check the "from" domain's SPF record to verify that the sending server is allowed to send email. For example, if I sent email from "atte@atte.com", the ...
1
vote
2answers
87 views
How can you use the information from Gmail's “Show Original” feature to check if an email really came from Google?
I received an email saying that someone logged into my Gmail account from an unknown device. How can I verify that this email (security alert) actually came from Google and not from a malicious source?...
0
votes
1answer
50 views
Gmail Contact List Safety
How can I know that my Gmail is spoofed or sending spams to other people I sent email to them before? I don't have clear signs of that especially my contact list is empty but I'm afraid this may ...
0
votes
0answers
33 views
Block/spam an email that doesn't match a rule
Is there anything we can put in place such to verify that if the sender's name = "John Doe" and the domain is not company.org (or legitimate verified SPF sender), then the message is marked as spam or ...
0
votes
1answer
74 views
Get original e-mail sender server to circumvent spoofing
I've posted this originally on SO, but it may as well be for here.
As you know, with many e-mail services, you can get tricked into believing an e-mail has been sent from a different address.
Using ...
1
vote
2answers
137 views
Why are email clients prevented from seeing the envelope?
Being able to compare the envelope values against the header field values is potentially useful for detecting fraudulent (e.g. spoofed) mail.
However, email servers, when receiving mail over SMTP, ...
2
votes
3answers
226 views
Is it possible to defend against a backscatter attack?
Yesterday, some spammer on the other side of the world decided to send out a ton of phishing mails with my business mail address as both From address and envelope sender.
The usual best practices are ...
0
votes
1answer
143 views
Bots trying to spoof encoded email links, but why?
I've setup an application for my client, that sends lists of job vacancies to subscribers every Monday morning.
The emails use a custom link redirector service, to make the links email friendly, and ...
-2
votes
3answers
190 views
Two different IPV4 inside outlook email header
I am currently analysing an outlook email header.
I am very confused because it has two ipv4 addresses x-originating from different locations. Usually there is an ipv4 towards the top of the header ...
0
votes
2answers
171 views
Check reputation of specific email address [closed]
I know that it's possible to check the reputation of email address domains, but what does the security community use to find information on the reputation of specific email addresseses?
List of ways ...
0
votes
2answers
126 views
Spoofed email has appropriate alias but unknown email
My wife received a suspicious email where the "FROM" field contained my name, but the email appeared to be delivered from an E-Mail address that we do not recognize.
The fact that the email used my ...
31
votes
1answer
8k views
Is it possible to fake 'received' field in the e-mail?
I've received some strange e-mail recently. The e-mail has different From and Reply-To fields. It has also To set to Undisclosed recipients but it's not crucial.
At first I thought it's fake, but ...
1
vote
2answers
376 views
Can a custom return path make SPF redundant
My understanding is that SPF can be used to define a set of IP addresses that are permitted to send outbound emails on behalf of a domain. If a mail server that is not included in the set of permitted ...
2
votes
1answer
169 views
Is this phishing? How can I be sure? And what can be gained?
Yesterday I received an email that I assumed/hoped was legitimately from a prospective employer that I interviewed with several weeks ago. The timing of the email couldn't have made more sense as they ...
3
votes
2answers
132 views
Email/facebook account/internet protection service for private community
I apologize in advance for any inaccuracy.
I am part of a yoga community which has no particular activity on the web or in the informatic sector.
All we have that can be regarded as web-related is ...
2
votes
2answers
289 views
Is it safe to add IP address to SPF record
I am a programmer who manages online exchanges user also and i have been asked to add IP address to SPF record so that one of the application can hosted on Azure can send emails to user etc..
v=spf1 +...
3
votes
2answers
156 views
Find out who sent email with my IP?
Recently my contact list was shared through some emails recently sent from my account. I would like to find out who did this as it has caused me some financial loss.
When I look at the email header, ...
1
vote
0answers
53 views
Phishing email linking to sharepoint address [duplicate]
Our organization got some sort of phishing email that contained an attachment which linked to sharepoint - ie. https://someaddress.sharepoint.com/:b:/... etc. The link takes you to that "sharepoint" ...
6
votes
2answers
958 views
Tracking click-through for organization-wide phishing email test [closed]
My organization wants to send out a test phishing email to all employees after a week of security awareness.
I plan on drafting a basic HTML page and including a misspelled link to it in an email ...
1
vote
1answer
85 views
are some IP whois capable of going beyond proxies?
I received a suspicious email (suspicious body) coming from a legit person.
The headers always show the legit adress as if the person in question has been hacked.
But I wanted to go further and ...
2
votes
2answers
228 views
Can SPF be bypassed by using a shared email server?
As I understand it, SPF works by listing permitted SMTP server domains in the TXT DNS record of the domain you own.
So if I own example.com and wish to permit a 3rd-party SMTP server at smtpexample....
4
votes
1answer
482 views
Received an email from a Bulgarian address trying to extort money
As the title says, I received an email from some Bulgarian email address saying that the sender has compromised my browser and thereby obtained control over my camera as well as gathering data on all ...
0
votes
1answer
132 views
How to tell ordinary spam from some abusing my mail?
From time to time I glance through my spam folder to gauge how the filters are working, and if they're catching any "ham." Most of the spam is really obvious, but I'm getting a few which made me ...
1
vote
1answer
95 views
Social Engineering Attack awareness using .doc and spoofed email
Need advise for our company experiment. We are planning to observe the security awareness among our staff. I have an idea but lacking of knowledge on how to do it. I want to create spoofed email and ...
4
votes
1answer
300 views
Reality Check: Create chaos at an office
An opportunity has arisen for me to perform a "real hacking attack" on a TV show. The target is to attack the TV headquarters and cause as much chaos as possible. The idea is to show how a business ...
4
votes
1answer
403 views
Does an email header/source contain sensitive information?
I think I received a phishing mail and I want to forward the email header/source to the company mentioned in the mail.
Is there any sensitive information in the header or source, besides the email ...
14
votes
1answer
3k views
Why would PayPal send messages from another domain?
I have just received a message asking to consent to PayPal policy updates from the domain:
https://epl.paypal-communication.com
The actual link is full of trackers. Given the domain name, it sounds ...
0
votes
1answer
73 views
Email Address Spoofed
Starting this morning at 9:30 am I started receiving numerous emails in my AOL account thanking me for registering at their website and asking me to confirm my registration. I am not opening them at ...
