Questions tagged [email-spoofing]

Email spoofing refers to the process of sending fraudulent emails that appears to be from someone that it is not.

Filter by
Sorted by
Tagged with
0 votes
0 answers
79 views

I have received an email with pictures from the gallery on my phone [closed]

I've two email addresses: [email protected] and [email protected]. Today, "red" received an email from "pink". I didn't send this email. The email contained four pictures that were ...
100xln2's user avatar
  • 101
0 votes
0 answers
35 views

How To Address Email Deliverability Problems When From Header Doesn't Match From Envelope?

So I'm using Active Campaign as a CRM and have configured DKIM, SPF, and a DMARC none policy. I am having one particular customer of mine that's not able to receive my emails despite them ...
Hunter Nelson's user avatar
0 votes
0 answers
31 views

Phishing mails to hidden Azure mailboxes

After some research, I couldn't find a clear answer: in Azure Cloud Domain, some users received phishing emails to hidden mailbox addresses. How can that be? How can those mailbox addresses be known ...
Loay's user avatar
  • 1
6 votes
2 answers
917 views

Spoofed email sent to me from my email address with SPF/DKIM/DMARC passing

I received an email earlier today on my work email address. The email came from the same address—mine—but I didn't send it. It was an email claiming that he was a professional hacker who had hacked my ...
PaulMcF87's user avatar
  • 161
1 vote
1 answer
64 views

SPF result using alias email address

I have received a threatening message in my email [email protected] from my other email address [email protected]. Note that [email protected] is an alias to [email protected]. Also, of course, I ...
Héctor's user avatar
  • 111
0 votes
1 answer
67 views

How can an email forwarding service send email with a "From" from a domain they don't control, and still pass SPF?

Let's say: [email protected] sends an email to [email protected]. Bob owns the domain bob.com but doesn't manage an emailing server. Instead he uses an email forwarding service (provided by his registrar /...
Basj's user avatar
  • 963
1 vote
1 answer
60 views

With selfhosting email server, selfsigned certificate, does it make a difference with PGP mail, What can be leaked?

If we are self hosting our own email server with mydomain.com with a self sign CA for S/MIME. What are some possible ways that our email content can get leaked? Then if we use PGP email, does it make ...
user294265's user avatar
0 votes
1 answer
457 views

Still able to spoof emails with strict DMARC, SPF and DKIM enabled

Despite setting up strict DMARC, SPF, and having DKIM enabled, I am still easily able to spoof the "From" address. I can easily do this with PHPMailer on my Mac and even with some free 3rd ...
Ian W's user avatar
  • 101
0 votes
1 answer
133 views

What is the most secure way to send email now? PGP or S/MIME, Given both parties willing to learn the technical parts

What is the most secure way and privacy-focused to send email now (current tech)? PGP or S/MIME, Given both parties willing to learn the technical parts? Use case, both of parties use third party ...
user294265's user avatar
0 votes
1 answer
150 views

Spoofed forwarded email? Help with analyzing of DMARC report

Why did this email get forwarded successfully? An XML report is below: I simply cannot understand the delivery status, a transcript follows: This email has been automatically forwarded. Despite the ...
Vlastimil Burián's user avatar
0 votes
1 answer
170 views

Spoof email is using my domain name email address but target almost only my contact list with credible content body

Since yesterday, one of my work email addresses is used to send spoof emails with phishing attachments. SPF and DKIM was configured on my domain name but not DMARC, but since yesterday in the evening, ...
morfane's user avatar
1 vote
0 answers
65 views

Impersonating phishing incident [closed]

An email has been circulated with the username of our organization, with some internal users and also to the customers. Observed that IP 40.92.46.74, which is Microsoft one. We have been using our ...
Nani's user avatar
  • 111
1 vote
0 answers
94 views

Malicious Mass Email Attack Occurred, Do I Still Have Problem?

I'm using Apache Airflow and I was troubleshooting built-in smtp setup. A mass email occurred on "[email protected]". It was used as a "From:" email in a mass email attack. ...
python_mainly's user avatar
1 vote
1 answer
454 views

I am receiving spam from my own email. Is my Gmail account hacked? [duplicate]

I cannot determine if my Gmail account is hacked. I am receiving spam from [email protected] which is identical to my own Gmail address [email protected] except for the dot before the @. How is that ...
number8989898989's user avatar
0 votes
0 answers
26 views

I clicked what looked like an Amazon email, but it (maybe) was from an Amazon affiliate. Ended up at Amazon.com anyway. Can I safely investigate? [duplicate]

In a case of clicking too fast, I clicked on a picture that looked like it was from Amazon. However this was not the case. I did end up at Amazon, but I'm aware that other things could've taken place ...
Moochcar's user avatar
0 votes
2 answers
210 views

Should I take action if I receive a phishing email that passes all email sender checks?

I received an email that passed all the email sender checks (spf, dkim, dmarc), and the sent-from domain is a legitimate domain from a legitimate company. However, the email content itself was ...
Esteban's user avatar
  • 133
16 votes
3 answers
3k views

"Undelivered Mail" I never sent (after registration on website)

I created an online account and received the usual welcome email. In addition, however, an "Undelivered Mail Returned to Sender" email appeared in my inbox one second later. I am the ...
S. G.'s user avatar
  • 163
2 votes
1 answer
242 views

Spoofed email: whose fault is it?

My relative received an email from a bill they were expecting to pay. So they paid said bill. Only problem is: it was a spoofed email, and the real bill only came in later. I checked the email on the ...
Bersan's user avatar
  • 133
0 votes
0 answers
26 views

Spam mail from own mailserver, but there is no outgoing mail in postfix log? [duplicate]

Today I received a phishing mail from my own (valid) sender address ([email protected]). I checked the e-mail header and see the mail was received by my valid mailserver. Received: from mail.example....
nils50122's user avatar
1 vote
2 answers
401 views

Why are @microsoft.com e-mail address not protected against spoofing

I got a lot of phishing attempts that appear to come from an actual microsoft.com e-mail address (see I need some verification about unusual login emails) I though this was odd, since I had hoped that ...
Hilmar's user avatar
  • 121
1 vote
0 answers
60 views

Bypassing Office365 Server Send As Denial [closed]

I am trying to send an e-mail via Windows Powershell ISE using Office365's hosting server, on behalf of another user which is specified in FROM part of the code using. But when I try to do this, I get:...
KontrCode's user avatar
2 votes
1 answer
399 views

How many times need e-mail headers be signed with DKIM to mitigate DKIM header injection attacks?

Many people have written about DKIM header injection attacks. [1] The suggestion to mitigate it is to oversign headers and to rotate any DKIM keys that were previously used to sign e-mails where not ...
adrelanos's user avatar
  • 744
4 votes
1 answer
919 views

Can you rule out the possibility that an email is spoofed despite passing SPF, DKIM, and DMARC?

Excuse my ignorance. I'm just a beginner trying to fill in the knowledge gaps that I have on how email system in general works, so this might seem a silly question to some or even all of you. Is there ...
Crito's user avatar
  • 43
7 votes
1 answer
1k views

Can DMARC's SPF alignment be spoofed?

IP addresses can be spoofed. The Envelope-From and Header-From addresses can be spoofed as well. But is it possible to spoof all three at the same time to send a forged email that passes both SPF and ...
hilltothesouth's user avatar
0 votes
1 answer
100 views

DMARC falsely reports impersonation

I have set up DMARC for some months now and I am using dmarc-visualizer to parse the reports. Overall I am happy so we can advance towards BIMI, but before switching to quarantine or reject on DMARC, ...
Alex's user avatar
  • 1
0 votes
2 answers
193 views

How can I receive a (spam) email from an unknown email address?

When you receive an email, most email programs will display the sender as a name (chosen by the sender) and hide the actual email address behind it. Spam emails often abuse this by sending mails from ...
quarague's user avatar
  • 183
1 vote
0 answers
25 views

Email supposedly from the future mentioning fairly recent password [duplicate]

Just got an email that mentioned, in very broken english, having hacked my email etc. and actually managed to list my current password of that email account. The mail was, apparently, send by that ...
ZarrTax's user avatar
  • 11
0 votes
0 answers
89 views

How am I receiving emails addressed to an address not associated with my account?

I currently have a g-mail address ([email protected]). I recently received a message addressed to [email protected]. Looking at the header I see my correct address in the Delivered-To: field but in the ...
JohnSmith's user avatar
0 votes
1 answer
2k views

How does this scam email from a seemingly legit domain work?

I received a strange email from [email protected]. Sources on the internet seem to state that this is a Facebook-owned domain but I know the email is not legit because they do not address me ...
hb20007's user avatar
  • 105
0 votes
2 answers
81 views

Business Email Compromise emails sent to personal email accounts

I am using Google workspace to handle my domain emails. At a certain point, employees started to receive spoofing emails to their @mydomain.com addresses. I blocked these emails and it worked. However,...
Eng7's user avatar
  • 101
37 votes
2 answers
21k views

How did this paypal spoof email pass SPF, DKIM and DMARC

This mail that got through has me stumped. It appeared to me as being from PayPal <[email protected]> in my Inbox. I happened to look at the original and it says SPF, DKIM and DMARC ...
ianw's user avatar
  • 401
3 votes
2 answers
166 views

Do password autofill extensions securely validate the site they are autofilling?

I had a situation where I clicked an email link send to me by a financial institution. The link first sent me to their login page where my chrome password extension automatically filled in my username ...
noslenkwah's user avatar
0 votes
1 answer
591 views

What's The Best PHP Encryption For Email Addresses?

I'm storing a list of email addresses and other not personally identifiable information for a mailing list in a database. Since it's for a project related to cryptocurrency, I believe that the ...
azoundria's user avatar
  • 753
0 votes
1 answer
703 views

Vulnerability : Missing SPF - is this a scam?

I got an email with the following: I am just looking at your SPF records then found following. SPF Records missing safe check which can allow me to send mail and phish easily any victim. PoC: <?...
pee2pee's user avatar
  • 287
15 votes
3 answers
8k views

Can an email be doctored to appear from a different sender on an earlier date?

Could someone doctor an email to make it appear that it was sent from a different sender at an earlier date? For example, could someone who knows my email address make it appear that I had emailed ...
user avatar
1 vote
0 answers
165 views

Potential Western Union Scam - Account Registration

In recent weeks I have seen a handful of senior employees in my organization receive a confirmation email from Wester Union for a new account creation. The issue is that none of these users have ...
Joe's user avatar
  • 172
0 votes
2 answers
180 views

Are e-mails that have a name slightly different from the web page legitimate e-mails?

I usually receive e-mails from an organization called Change.org, that is a site for create on-line petitions (it's site is https://www.change.org/). The thing is, they send me e-mails with ...
user267666's user avatar
1 vote
2 answers
580 views

Do fowarded emails retain DMARC protection?

Assume I ask someone to create a filter in their Gmail account that automatically forwards certain emails to my inbox. If the original email was protected with DMARC, would the forwarded email also be ...
Bradford Griggs's user avatar
-1 votes
2 answers
209 views

Is it Safe to Rely on Gmail API to Reward Users for Placing Orders on Merchant Sites?

I have an application that rewards users for placing orders with certain merchants. In order to verify that the order was actually placed and delivered, a user is required to grant us read access to a ...
Bradford Griggs's user avatar
3 votes
3 answers
3k views

How to check if a mail server is using Enforced-STARTTLS rather than Opportunistic-STARTTLS?

This article tells us that there are two types of STARTTLS: Opportunistic (i.e. optional STARTTLS) STARTTLS and Enforced STARTTLS, which works by the doctrine of "Encrypted connection or drop ...
user75058's user avatar
0 votes
1 answer
698 views

How can scammer actually reply from a spoofed email address?

I (mostly) understand how a scammer can send an email from a spoofed account, all you need is an unsecured SMTP server. But how is it possible, for a scammer to RESPOND and maintain an email ...
Matthys Du Toit's user avatar
1 vote
1 answer
193 views

Questionable email from discord [duplicate]

I got a gmail from discord saying a new account had been registered and prompting me to click a verification link. Weirdly, I never made that account, and I already had a discord account under my ...
donut_man's user avatar
0 votes
1 answer
139 views

Do email providers somehow validate/control "Send email as: " feature?

I have a domain for a website that I'm going to deploy soon. I've registered a gmail account, and let's say it is [email protected]. In order to look more professional, I decided to use gmail's &...
Noob's user avatar
  • 101
0 votes
0 answers
1k views

Spoofed email? "X-Source-Sender" and "Received" headers look dodgy

I got sent an email from someone in response to an over 2 year old exchange, and the contents of it look like spam to me. Checking the headers the following looks normal: Return-Path Received & ...
Brett's user avatar
  • 279
0 votes
0 answers
109 views

I received a phishing/spam email from Google Delivery Subsystem about an email I never sent. How? [duplicate]

Screenshot: The text covered with red is exactly my email address except the end is @google.com instead of @gmail.com. The suspicious link "Unsubscribe_click_here" is: mailto:cr@burlondesti....
SpaceMonkey's user avatar
0 votes
0 answers
123 views

Does SPF protect against spammers who control the initial MTA?

I understand that for most users, the Envelope-from address is the most difficult part of an email to spoof because (I assume) it is checked by the receiving MTA i.e. if you attempt to spoof the "...
David Scholefield's user avatar
0 votes
2 answers
123 views

I have a custom domain for email. Do I need to configure DNS to prevent outgoing text messages with an address from my domain? [duplicate]

I own a custom domain that I use for e-mail. The mail server is configured with a catch-all that redirects messages to any user to my inbox. For the first time this afternoon, I received a benign &...
zneak's user avatar
  • 207
0 votes
0 answers
40 views

How to track anonymous email sender (alternatives to IP tracking) [duplicate]

Are there any ways to get information on who is sending certain emails from an anonymous email address? Besides the obvious IP solution, would there be any alternative such as embedding some kind of ...
user2348684's user avatar
0 votes
1 answer
124 views

Spoofed DNS-Address in Spam mail header

There is a recent rise in Spam mails sent from seemingly legit german email-addresses according to the mail headers: Received: from mx1.aok.de ([91.199.166.49]) But when I nslookup mx1.aok.de, I get ...
user77029's user avatar
1 vote
1 answer
124 views

php / email / iis

in a certain page I have a newsletter subscription form, where the user enters his e-mail address and then through PHP an authenticated e-mail is sent to myself with the user's information (e-mail ...
MirrorMirror's user avatar

1
2 3 4 5