Questions tagged [email-spoofing]
Email spoofing refers to the process of sending fraudulent emails that appears to be from someone that it is not.
0
votes
0answers
49 views
Suspicious spoof message through contact form pretending to be one of our employees
Yesterday we received this email message through the contact form of our website from a russian server:
9th of April - SPOOF MESSAGE:
Name: John
Surname: Smith
EMail: pii-...
2
votes
1answer
115 views
How was I spoofed?
I am trying to figure out how we were spoofed for education purposes. The email came in perfectly with the user's email address and name. The only way we found out was the header information. Most ...
1
vote
1answer
82 views
Can an attacker discover email addresses without gaining server access?
Present situation: I am receiving emails at a few of my email addresses, different domain names, all housed on the same server. The emails ares spoofed (appear to be coming from each of the email ...
3
votes
2answers
119 views
Email verification by sending mail instead of receiving
I have an app whose main purpose is to help people track emails they send.
In most user onboarding, The user is sent a secret URL via email. They validate by clicking a link to return the secret.
...
-1
votes
1answer
77 views
Google Apps From : email address, spoofed how?
We use google apps for business to host our business emails, using our own custom domain mysite.com.
I view my emails via gmail.com
I recently received an email from me@mysite.com to me@mysite.com ...
1
vote
2answers
158 views
How to extract intresting data from malicious e-mail header
Premise: I know pretty well how SMTP works, and how to read an e-mail header. I know what all the main fieds mean, but I couldn't know what to look for if I want to know if the mail is kind of ...
1
vote
1answer
36 views
Phishing/Spam using old MX record for direct sending which is circumventing Mimecast
We've been using Mimecast for email security for a few months now and there's been a dozen or so incidents where the phish/spam senders have utilized the old MX records to send directly to our Office ...
2
votes
1answer
52 views
Is there any tool or method to detect spoofed CCs?
One of our phishing scenarios during a pentest went like this: we send an email saying something along the lines of "As per the manager (CCd) please download the latest software included". Then we ...
2
votes
1answer
114 views
Why are my emails going to spam?
I have been trying to learn about phishing emails. I have read up quite a bit on it. I setup a domain somthing.tk (free domain), hosted a website on a VPS (Digital Ocean). Set up my own mail transfer ...
1
vote
1answer
86 views
Prevent spammers from faking emails being sent from you to someone else or yourself?
I received the following email with the headers below. How are the spammers exploiting this method of tricking users that their account is hacked?
How can one prevent spammers from doing this with ...
1
vote
1answer
127 views
Bypassing OpenDMARC checks by forging Authentication-Results
In order to have mail exchanger MX servers to be able to deliver mail to the primary MX, both SPF and DMARC checks needs to be bypassed when the connection is made from a secondary MX. For SPF this is ...
114
votes
5answers
18k views
Why do phishing e-mails use faked e-mail addresses instead of the real one?
I read that you can write anything into the From: field of an e-mail.
If that is true, then why are phishing e-mails trying to trick me with look-a-like addresses like service@amaz0n.com instead of ...
1
vote
1answer
95 views
Does google have access to all information on a Protonmail android app?
Gmail reads my emails so Protonmail becomes more appealing to me. It is more secure, is open source and they do not read your emails or give away your information to third parties. But, Protonmail ...
0
votes
2answers
68 views
How to find the source of business email account compromise
I have a gmail account example@gmail.com and I am sending emails to a lawyer with corporate email (I don't know the software they use). I am sending monthly bills to the lawyer for consulting fees.
...
1
vote
2answers
84 views
How are SPF records used in practice?
I always thought that receiving email servers check the "from" domain's SPF record to verify that the sending server is allowed to send email. For example, if I sent email from "atte@atte.com", the ...
1
vote
2answers
78 views
How can you use the information from Gmail's “Show Original” feature to check if an email really came from Google?
I received an email saying that someone logged into my Gmail account from an unknown device. How can I verify that this email (security alert) actually came from Google and not from a malicious source?...
0
votes
1answer
49 views
Gmail Contact List Safety
How can I know that my Gmail is spoofed or sending spams to other people I sent email to them before? I don't have clear signs of that especially my contact list is empty but I'm afraid this may ...
0
votes
0answers
31 views
Block/spam an email that doesn't match a rule
Is there anything we can put in place such to verify that if the sender's name = "John Doe" and the domain is not company.org (or legitimate verified SPF sender), then the message is marked as spam or ...
0
votes
1answer
66 views
Get original e-mail sender server to circumvent spoofing
I've posted this originally on SO, but it may as well be for here.
As you know, with many e-mail services, you can get tricked into believing an e-mail has been sent from a different address.
Using ...
1
vote
2answers
132 views
Why are email clients prevented from seeing the envelope?
Being able to compare the envelope values against the header field values is potentially useful for detecting fraudulent (e.g. spoofed) mail.
However, email servers, when receiving mail over SMTP, ...
2
votes
2answers
170 views
Is it possible to defend against a backscatter attack?
Yesterday, some spammer on the other side of the world decided to send out a ton of phishing mails with my business mail address as both From address and envelope sender.
The usual best practices are ...
0
votes
1answer
139 views
Bots trying to spoof encoded email links, but why?
I've setup an application for my client, that sends lists of job vacancies to subscribers every Monday morning.
The emails use a custom link redirector service, to make the links email friendly, and ...
-2
votes
3answers
162 views
Two different IPV4 inside outlook email header
I am currently analysing an outlook email header.
I am very confused because it has two ipv4 addresses x-originating from different locations. Usually there is an ipv4 towards the top of the header ...
0
votes
2answers
158 views
Check reputation of specific email address [closed]
I know that it's possible to check the reputation of email address domains, but what does the security community use to find information on the reputation of specific email addresseses?
List of ways ...
0
votes
2answers
120 views
Spoofed email has appropriate alias but unknown email
My wife received a suspicious email where the "FROM" field contained my name, but the email appeared to be delivered from an E-Mail address that we do not recognize.
The fact that the email used my ...
31
votes
1answer
8k views
Is it possible to fake 'received' field in the e-mail?
I've received some strange e-mail recently. The e-mail has different From and Reply-To fields. It has also To set to Undisclosed recipients but it's not crucial.
At first I thought it's fake, but ...
1
vote
2answers
265 views
Can a custom return path make SPF redundant
My understanding is that SPF can be used to define a set of IP addresses that are permitted to send outbound emails on behalf of a domain. If a mail server that is not included in the set of permitted ...
2
votes
1answer
162 views
Is this phishing? How can I be sure? And what can be gained?
Yesterday I received an email that I assumed/hoped was legitimately from a prospective employer that I interviewed with several weeks ago. The timing of the email couldn't have made more sense as they ...
3
votes
2answers
130 views
Email/facebook account/internet protection service for private community
I apologize in advance for any inaccuracy.
I am part of a yoga community which has no particular activity on the web or in the informatic sector.
All we have that can be regarded as web-related is ...
2
votes
2answers
216 views
Is it safe to add IP address to SPF record
I am a programmer who manages online exchanges user also and i have been asked to add IP address to SPF record so that one of the application can hosted on Azure can send emails to user etc..
v=spf1 +...
3
votes
0answers
55 views
Find out who sent email with my IP?
Recently my contact list was shared through some emails recently sent from my account. I would like to find out who did this as it has caused me some financial loss.
When I look at the email header, ...
1
vote
0answers
53 views
Phishing email linking to sharepoint address [duplicate]
Our organization got some sort of phishing email that contained an attachment which linked to sharepoint - ie. https://someaddress.sharepoint.com/:b:/... etc. The link takes you to that "sharepoint" ...
6
votes
2answers
935 views
Tracking click-through for organization-wide phishing email test [closed]
My organization wants to send out a test phishing email to all employees after a week of security awareness.
I plan on drafting a basic HTML page and including a misspelled link to it in an email ...
1
vote
1answer
85 views
are some IP whois capable of going beyond proxies?
I received a suspicious email (suspicious body) coming from a legit person.
The headers always show the legit adress as if the person in question has been hacked.
But I wanted to go further and ...
0
votes
0answers
347 views
Fake Wordpress reset password email with an external X-Google-Original-From header
My employer owns a Wordpress blog and I have an account with it used to submit blog posts. I have recently received a few password reset emails that link to an external site.
These emails appear to ...
2
votes
2answers
149 views
Can SPF be bypassed by using a shared email server?
As I understand it, SPF works by listing permitted SMTP server domains in the TXT DNS record of the domain you own.
So if I own example.com and wish to permit a 3rd-party SMTP server at smtpexample....
3
votes
1answer
443 views
Received an email from a Bulgarian address trying to extort money
As the title says, I received an email from some Bulgarian email address saying that the sender has compromised my browser and thereby obtained control over my camera as well as gathering data on all ...
0
votes
1answer
120 views
How to tell ordinary spam from some abusing my mail?
From time to time I glance through my spam folder to gauge how the filters are working, and if they're catching any "ham." Most of the spam is really obvious, but I'm getting a few which made me ...
1
vote
1answer
94 views
Social Engineering Attack awareness using .doc and spoofed email
Need advise for our company experiment. We are planning to observe the security awareness among our staff. I have an idea but lacking of knowledge on how to do it. I want to create spoofed email and ...
4
votes
1answer
293 views
Reality Check: Create chaos at an office
An opportunity has arisen for me to perform a "real hacking attack" on a TV show. The target is to attack the TV headquarters and cause as much chaos as possible. The idea is to show how a business ...
4
votes
1answer
350 views
Does an email header/source contain sensitive information?
I think I received a phishing mail and I want to forward the email header/source to the company mentioned in the mail.
Is there any sensitive information in the header or source, besides the email ...
9
votes
1answer
2k views
Why would PayPal send messages from another domain?
I have just received a message asking to consent to PayPal policy updates from the domain:
https://epl.paypal-communication.com
The actual link is full of trackers. Given the domain name, it sounds ...
0
votes
1answer
72 views
Email Address Spoofed
Starting this morning at 9:30 am I started receiving numerous emails in my AOL account thanking me for registering at their website and asking me to confirm my registration. I am not opening them at ...
2
votes
0answers
73 views
On a server I run, bogus incoming mail for a username which is my name. Should I be worried?
A server I run has a minimal public-facing mail exposure, running postfix on port 25 (no authentication on this port; IMAP is accessible by other means). In my mail logs it is not uncommon to find '...
0
votes
1answer
436 views
Fraud Email from Family Member [duplicate]
I got an email from what I thought is my family member, when I viewed the email it said it was from "heiner@heiner-starp.de" (no idea who this is). However the label that this email is under is my ...
0
votes
2answers
146 views
Which SPF quantifier applies when an SPF include is used?
An SPF record has several tags of which one can be the include tag, and the SPF record ends with a quantifier like +, ?, ~ or -.
When an include tag is used, the included SPF record has it’s own SPF ...
1
vote
2answers
2k views
Do SPF records apply to all subdomains?
Does a SPF record apply only on the domain it’s setup for or also for all it’s subdomains?
For example an SPF record that is configured for the domain example.com will set the policy for mails ending ...
58
votes
7answers
14k views
Email received regarding Security flaw in website
I received an email to techsupport@websitename.com (pretty generic email) saying that there was a security flaw in my website etc. etc
My initial reaction was that this was a scam. (How/why did they ...
1
vote
1answer
152 views
How to disable email for a subdomain without using SPF
I am working on a tool that checks SPF records, and would like a way to be able to disable email from a testing subdomain, and its children, so that my test domains are not easy targets for spammers ...
0
votes
1answer
688 views
Tracing email sent from service?
I know an email was sent using the online service emkei.cz. Is there a way to find out who used that service to send the specific email I received?
