Questions tagged [email-spoofing]
Email spoofing refers to the process of sending fraudulent emails that appears to be from someone that it is not.
186
questions
0
votes
0answers
39 views
How to deal with Registered Envelope Service (CRES) if you are not using this service
First of all, I am not using CRES, but many of our clients use it. I want to know the best approach to manage all communications with our clients that use CRES.
I want to avoid using CRES webmail ...
0
votes
0answers
34 views
How do I run through the DKIM authentication?
I am currently reading on DKIM authentication for email and I would like to manually try to run through it (to facilitate my understanding of DKIM), but I would like to verify if it is possible to do ...
1
vote
2answers
650 views
Microsoft account security alert - Is this legit? [closed]
I've just received two emails in a row stating that "We detected something unusual about a recent sign-in for the Microsoft account" and "someone else might have accessed the Microsoft account..." (...
0
votes
0answers
25 views
Postfix maildrop -> pickup “from:” verification [duplicate]
I was surprised to notice that sending E-mail from local server account allow any user to send message with:
From: whatever@whateverdomain
This is a security issue, because it allow identity ...
0
votes
0answers
30 views
Saved email attachment not reflecting the actual sender of the email but the email of the person who received the email attachment as sender
I have come across certain scenarios which confuses me on how it is possible to manipulate email headers.
The person who received an email(A) from person (B), forwarded me (C) the email as Original ...
5
votes
1answer
490 views
Enforcing DMARC policy (reject) on an Office 365 tenant
The domain & tenant has SPF and DKIM properly configured and DMARC policy set to p=reject. Still, emails spoofed with the domain in the From header aren't rejected, but appear in the Junk Email ...
0
votes
2answers
116 views
Phishing emails - What do I look for?
I want to be able to spot a phishing email. What are the things to check when investigating and doing forensics on one?
There are some things I know to look for already but I want to get moer ...
0
votes
0answers
36 views
Do we need SPF when we have DKIM? [duplicate]
I always thought that to authenticate email we needed both SPF and DKIM (and DMARC). But email is confusing and recently I found myself asking why we can't do with just SPF or DKIM. I then discovered ...
1
vote
1answer
1k views
Possible Scam - reply address appears to be yours [closed]
Have received the following email which I believe to be a scam
Internet Crime Complaint Center (IC3)
In Partnership with:
Swiss National Fraud Relief Center (NFRC)
Case/Reference ID: IE3033900045
We ...
0
votes
1answer
69 views
emails were send from my own email address [closed]
A friend of mine has just received an email from my exactly own email adrress. What could this be and how do I stop it?
1
vote
1answer
54 views
How to test email spoofing with this php script? [closed]
I want to harden my SPF setting.
However I have trouble testing my SPF setting.
I want to be able send a test email to try out my new SPF settings.
Most of the resource on internet seems to be use ...
0
votes
0answers
46 views
Is there a way to block/filter spoofed emails Office 365/Exchange?
My company is currently a target of some social engineering attacks where company employees are being sent e-mails from the attacker pretending to be senior members of staff. They have the correct ...
1
vote
0answers
81 views
Is it possible to hijack specific e-mail with remote access? [closed]
I was recently presented with e-mails that look like they came from my e-mail and IP address but I didn't send them and never saw them. It is a back and forth correspondence with another gmail account....
8
votes
2answers
1k views
GMail Hack with 2-Factor Auth enabled
I have my business email on GMail. I use 2-factor authentication for access to said business email. I access my business email from 2 computers and 1 mobile Android device. I do not use Outlook or ...
2
votes
1answer
156 views
I received an phishing email from myself [duplicate]
So today when I was checking my spam folder on my outlook account, I noticed I had received an email from my own address.
The email looks like a typical scam:
Claims to have installed a RAT on my ...
0
votes
0answers
118 views
Logged in with a hacker's email address
I have an active account at ebay-kleinanzeigen.de (like Craigslist in the US).
Today I got a valid email from them that my email address was changed.
On my mac, I opened up my ebay-kleinanzeigen ...
3
votes
2answers
114 views
What prevents malicious servers from spoofing mail transfer agents and/or mail delivery agents?
An email system typically consists of multiple agents:
Mail user agent (MUA)
Mail submission agent (MSA)
Mail tranfer agent (MTA)
Mail delivery agent (MDA)
Evidently the 'middlemen' of this system ...
7
votes
1answer
1k views
How Concerning Is This X-CU-modified: FAKECU Text Attack?
A user clicked on the link of this email and entered their credentials, thinking the message was legitimate. However, the link didn't redirect to the fake site, and instead their mail client sent them ...
0
votes
2answers
7k views
Possible attack via Netflix; what action should I take, if any?
Late last night I received a "password reset" email from info@mailer.netflix.com.
It looked legit, but I had not requested a password reset. I checked my account's "recent account access" but saw ...
0
votes
0answers
54 views
How to detect a spoofed email with Outlook Web Access?
I am specifically asking about Outlook Web Access (browser based Outlook), and not for any other email service or program.
Within Outlook Web Access, is there a way to tell whether or not an email ...
0
votes
1answer
172 views
Spam/Phishing detection when there is no MX record
While SPF/DKIM/DMARC are standard, foundational tools to help protect an email-sending domain from spoofing, what about domains that do not send emails?
How do spam or phishing filters treat emails ...
2
votes
3answers
634 views
SPF and Office 365 email accounts spoofing other Office 365 email accounts
After an incident, I have a question which answer's I cannot find.
I cannot provide the real headers as they come from a client.
Letās consider a company which uses an Office365 tenant as mail server....
1
vote
1answer
659 views
I clicked a link in an email message. What should I do now?
I got a message that looked like an ad from Microsoft. At the end, there was a message saying "You can simply WIPE Out your email from Mailing List click here". I clicked. I got to a page this ...
5
votes
2answers
610 views
How did a phishing email pass SPF, DKIM and DMARC?
A friend received a spoofed email (from Bank of America using an uber.com address) which was correctly identified as 'spam' by Gmail. However, looking at the raw message it seems to have passed SPF, ...
2
votes
2answers
107 views
What is the reason for DMARC spec to not require specifically SPF or DKIM pass?
DMARC produces "pass" result if and only if at least one of SPF and DKIM checks pass. It has been noted that DKIM provides stronger protection of the two (if implemented properly). But, in order to ...
1
vote
1answer
35k views
Bogus Instagram account using my email, never been verified, has over 1000 followers
This appears to be a phishing scam like I've never encountered before.
I received an email from security@mail.instagram.com to an email address I rarely use, but I noticed it because messages get ...
-1
votes
1answer
402 views
Received ransom email containing my password. How did they get my password?
Finally, even I got the fabled ransomware emails we've all heard about so much.
First, let's look at the facts before I get to my question:
I use Mozilla Thunderbird as my email client.
I was ...
2
votes
1answer
140 views
How was I spoofed?
I am trying to figure out how we were spoofed for education purposes. The email came in perfectly with the user's email address and name. The only way we found out was the header information. Most ...
1
vote
1answer
85 views
Can an attacker discover email addresses without gaining server access?
Present situation: I am receiving emails at a few of my email addresses, different domain names, all housed on the same server. The emails ares spoofed (appear to be coming from each of the email ...
3
votes
2answers
140 views
Email verification by sending mail instead of receiving
I have an app whose main purpose is to help people track emails they send.
In most user onboarding, The user is sent a secret URL via email. They validate by clicking a link to return the secret.
...
-1
votes
1answer
82 views
Google Apps From : email address, spoofed how?
We use google apps for business to host our business emails, using our own custom domain mysite.com.
I view my emails via gmail.com
I recently received an email from me@mysite.com to me@mysite.com ...
1
vote
2answers
328 views
How to extract intresting data from malicious e-mail header
Premise: I know pretty well how SMTP works, and how to read an e-mail header. I know what all the main fieds mean, but I couldn't know what to look for if I want to know if the mail is kind of ...
2
votes
1answer
74 views
Is there any tool or method to detect spoofed CCs?
One of our phishing scenarios during a pentest went like this: we send an email saying something along the lines of "As per the manager (CCd) please download the latest software included". Then we ...
3
votes
1answer
220 views
Why are my emails going to spam?
I have been trying to learn about phishing emails. I have read up quite a bit on it. I setup a domain somthing.tk (free domain), hosted a website on a VPS (Digital Ocean). Set up my own mail transfer ...
1
vote
1answer
507 views
Prevent spammers from faking emails being sent from you to someone else or yourself?
I received the following email with the headers below. How are the spammers exploiting this method of tricking users that their account is hacked?
How can one prevent spammers from doing this with ...
1
vote
1answer
709 views
Bypassing OpenDMARC checks by forging Authentication-Results
In order to have mail exchanger MX servers to be able to deliver mail to the primary MX, both SPF and DMARC checks needs to be bypassed when the connection is made from a secondary MX. For SPF this is ...
116
votes
5answers
18k views
Why do phishing e-mails use faked e-mail addresses instead of the real one?
I read that you can write anything into the From: field of an e-mail.
If that is true, then why are phishing e-mails trying to trick me with look-a-like addresses like service@amaz0n.com instead of ...
1
vote
1answer
108 views
Does google have access to all information on a Protonmail android app?
Gmail reads my emails so Protonmail becomes more appealing to me. It is more secure, is open source and they do not read your emails or give away your information to third parties. But, Protonmail ...
0
votes
2answers
80 views
How to find the source of business email account compromise
I have a gmail account example@gmail.com and I am sending emails to a lawyer with corporate email (I don't know the software they use). I am sending monthly bills to the lawyer for consulting fees.
...
2
votes
2answers
177 views
How are SPF records used in practice?
I always thought that receiving email servers check the "from" domain's SPF record to verify that the sending server is allowed to send email. For example, if I sent email from "atte@atte.com", the ...
1
vote
2answers
145 views
How can you use the information from Gmail's “Show Original” feature to check if an email really came from Google?
I received an email saying that someone logged into my Gmail account from an unknown device. How can I verify that this email (security alert) actually came from Google and not from a malicious source?...
0
votes
1answer
51 views
Gmail Contact List Safety
How can I know that my Gmail is spoofed or sending spams to other people I sent email to them before? I don't have clear signs of that especially my contact list is empty but I'm afraid this may ...
0
votes
1answer
100 views
Get original e-mail sender server to circumvent spoofing
I've posted this originally on SO, but it may as well be for here.
As you know, with many e-mail services, you can get tricked into believing an e-mail has been sent from a different address.
Using ...
1
vote
2answers
221 views
Why are email clients prevented from seeing the envelope?
Being able to compare the envelope values against the header field values is potentially useful for detecting fraudulent (e.g. spoofed) mail.
However, email servers, when receiving mail over SMTP, ...
2
votes
3answers
376 views
Is it possible to defend against a backscatter attack?
Yesterday, some spammer on the other side of the world decided to send out a ton of phishing mails with my business mail address as both From address and envelope sender.
The usual best practices are ...
1
vote
1answer
170 views
Bots trying to spoof encoded email links, but why?
I've setup an application for my client, that sends lists of job vacancies to subscribers every Monday morning.
The emails use a custom link redirector service, to make the links email friendly, and ...
-2
votes
3answers
357 views
Two different IPV4 inside outlook email header
I am currently analysing an outlook email header.
I am very confused because it has two ipv4 addresses x-originating from different locations. Usually there is an ipv4 towards the top of the header ...
0
votes
2answers
223 views
Check reputation of specific email address [closed]
I know that it's possible to check the reputation of email address domains, but what does the security community use to find information on the reputation of specific email addresseses?
List of ways ...
0
votes
2answers
138 views
Spoofed email has appropriate alias but unknown email
My wife received a suspicious email where the "FROM" field contained my name, but the email appeared to be delivered from an E-Mail address that we do not recognize.
The fact that the email used my ...
31
votes
1answer
9k views
Is it possible to fake 'received' field in the e-mail?
I've received some strange e-mail recently. The e-mail has different From and Reply-To fields. It has also To set to Undisclosed recipients but it's not crucial.
At first I thought it's fake, but ...
