Questions tagged [email-spoofing]
Email spoofing refers to the process of sending fraudulent emails that appears to be from someone that it is not.
179
questions
0
votes
1answer
62 views
emails were send from my own email address [closed]
A friend of mine has just received an email from my exactly own email adrress. What could this be and how do I stop it?
1
vote
1answer
47 views
How to test email spoofing with this php script? [closed]
I want to harden my SPF setting.
However I have trouble testing my SPF setting.
I want to be able send a test email to try out my new SPF settings.
Most of the resource on internet seems to be use ...
0
votes
0answers
45 views
Is there a way to block/filter spoofed emails Office 365/Exchange?
My company is currently a target of some social engineering attacks where company employees are being sent e-mails from the attacker pretending to be senior members of staff. They have the correct ...
1
vote
0answers
79 views
Is it possible to hijack specific e-mail with remote access? [closed]
I was recently presented with e-mails that look like they came from my e-mail and IP address but I didn't send them and never saw them. It is a back and forth correspondence with another gmail account....
8
votes
2answers
1k views
GMail Hack with 2-Factor Auth enabled
I have my business email on GMail. I use 2-factor authentication for access to said business email. I access my business email from 2 computers and 1 mobile Android device. I do not use Outlook or ...
2
votes
1answer
114 views
I received an phishing email from myself [duplicate]
So today when I was checking my spam folder on my outlook account, I noticed I had received an email from my own address.
The email looks like a typical scam:
Claims to have installed a RAT on my ...
0
votes
0answers
117 views
Logged in with a hacker's email address
I have an active account at ebay-kleinanzeigen.de (like Craigslist in the US).
Today I got a valid email from them that my email address was changed.
On my mac, I opened up my ebay-kleinanzeigen ...
3
votes
2answers
106 views
What prevents malicious servers from spoofing mail transfer agents and/or mail delivery agents?
An email system typically consists of multiple agents:
Mail user agent (MUA)
Mail submission agent (MSA)
Mail tranfer agent (MTA)
Mail delivery agent (MDA)
Evidently the 'middlemen' of this system ...
7
votes
1answer
1k views
How Concerning Is This X-CU-modified: FAKECU Text Attack?
A user clicked on the link of this email and entered their credentials, thinking the message was legitimate. However, the link didn't redirect to the fake site, and instead their mail client sent them ...
0
votes
2answers
3k views
Possible attack via Netflix; what action should I take, if any?
Late last night I received a "password reset" email from info@mailer.netflix.com.
It looked legit, but I had not requested a password reset. I checked my account's "recent account access" but saw ...
0
votes
0answers
52 views
How to detect a spoofed email with Outlook Web Access?
I am specifically asking about Outlook Web Access (browser based Outlook), and not for any other email service or program.
Within Outlook Web Access, is there a way to tell whether or not an email ...
0
votes
1answer
111 views
Spam/Phishing detection when there is no MX record
While SPF/DKIM/DMARC are standard, foundational tools to help protect an email-sending domain from spoofing, what about domains that do not send emails?
How do spam or phishing filters treat emails ...
2
votes
3answers
479 views
SPF and Office 365 email accounts spoofing other Office 365 email accounts
After an incident, I have a question which answer's I cannot find.
I cannot provide the real headers as they come from a client.
Let’s consider a company which uses an Office365 tenant as mail server....
1
vote
1answer
653 views
I clicked a link in an email message. What should I do now?
I got a message that looked like an ad from Microsoft. At the end, there was a message saying "You can simply WIPE Out your email from Mailing List click here". I clicked. I got to a page this ...
4
votes
2answers
403 views
How did a phishing email pass SPF, DKIM and DMARC?
A friend received a spoofed email (from Bank of America using an uber.com address) which was correctly identified as 'spam' by Gmail. However, looking at the raw message it seems to have passed SPF, ...
2
votes
2answers
92 views
What is the reason for DMARC spec to not require specifically SPF or DKIM pass?
DMARC produces "pass" result if and only if at least one of SPF and DKIM checks pass. It has been noted that DKIM provides stronger protection of the two (if implemented properly). But, in order to ...
1
vote
1answer
25k views
Bogus Instagram account using my email, never been verified, has over 1000 followers
This appears to be a phishing scam like I've never encountered before.
I received an email from security@mail.instagram.com to an email address I rarely use, but I noticed it because messages get ...
-1
votes
1answer
321 views
Received ransom email containing my password. How did they get my password?
Finally, even I got the fabled ransomware emails we've all heard about so much.
First, let's look at the facts before I get to my question:
I use Mozilla Thunderbird as my email client.
I was ...
0
votes
0answers
63 views
Suspicious spoof message through contact form pretending to be one of our employees
Yesterday we received this email message through the contact form of our website from a russian server:
9th of April - SPOOF MESSAGE:
Name: John
Surname: Smith
EMail: pii-...
2
votes
1answer
138 views
How was I spoofed?
I am trying to figure out how we were spoofed for education purposes. The email came in perfectly with the user's email address and name. The only way we found out was the header information. Most ...
1
vote
1answer
85 views
Can an attacker discover email addresses without gaining server access?
Present situation: I am receiving emails at a few of my email addresses, different domain names, all housed on the same server. The emails ares spoofed (appear to be coming from each of the email ...
3
votes
2answers
134 views
Email verification by sending mail instead of receiving
I have an app whose main purpose is to help people track emails they send.
In most user onboarding, The user is sent a secret URL via email. They validate by clicking a link to return the secret.
...
-1
votes
1answer
82 views
Google Apps From : email address, spoofed how?
We use google apps for business to host our business emails, using our own custom domain mysite.com.
I view my emails via gmail.com
I recently received an email from me@mysite.com to me@mysite.com ...
1
vote
2answers
239 views
How to extract intresting data from malicious e-mail header
Premise: I know pretty well how SMTP works, and how to read an e-mail header. I know what all the main fieds mean, but I couldn't know what to look for if I want to know if the mail is kind of ...
2
votes
1answer
70 views
Is there any tool or method to detect spoofed CCs?
One of our phishing scenarios during a pentest went like this: we send an email saying something along the lines of "As per the manager (CCd) please download the latest software included". Then we ...
3
votes
1answer
209 views
Why are my emails going to spam?
I have been trying to learn about phishing emails. I have read up quite a bit on it. I setup a domain somthing.tk (free domain), hosted a website on a VPS (Digital Ocean). Set up my own mail transfer ...
1
vote
1answer
387 views
Prevent spammers from faking emails being sent from you to someone else or yourself?
I received the following email with the headers below. How are the spammers exploiting this method of tricking users that their account is hacked?
How can one prevent spammers from doing this with ...
1
vote
1answer
501 views
Bypassing OpenDMARC checks by forging Authentication-Results
In order to have mail exchanger MX servers to be able to deliver mail to the primary MX, both SPF and DMARC checks needs to be bypassed when the connection is made from a secondary MX. For SPF this is ...
116
votes
5answers
18k views
Why do phishing e-mails use faked e-mail addresses instead of the real one?
I read that you can write anything into the From: field of an e-mail.
If that is true, then why are phishing e-mails trying to trick me with look-a-like addresses like service@amaz0n.com instead of ...
1
vote
1answer
108 views
Does google have access to all information on a Protonmail android app?
Gmail reads my emails so Protonmail becomes more appealing to me. It is more secure, is open source and they do not read your emails or give away your information to third parties. But, Protonmail ...
0
votes
2answers
77 views
How to find the source of business email account compromise
I have a gmail account example@gmail.com and I am sending emails to a lawyer with corporate email (I don't know the software they use). I am sending monthly bills to the lawyer for consulting fees.
...
2
votes
2answers
150 views
How are SPF records used in practice?
I always thought that receiving email servers check the "from" domain's SPF record to verify that the sending server is allowed to send email. For example, if I sent email from "atte@atte.com", the ...
1
vote
2answers
116 views
How can you use the information from Gmail's “Show Original” feature to check if an email really came from Google?
I received an email saying that someone logged into my Gmail account from an unknown device. How can I verify that this email (security alert) actually came from Google and not from a malicious source?...
0
votes
1answer
51 views
Gmail Contact List Safety
How can I know that my Gmail is spoofed or sending spams to other people I sent email to them before? I don't have clear signs of that especially my contact list is empty but I'm afraid this may ...
0
votes
0answers
35 views
Block/spam an email that doesn't match a rule
Is there anything we can put in place such to verify that if the sender's name = "John Doe" and the domain is not company.org (or legitimate verified SPF sender), then the message is marked as spam or ...
0
votes
1answer
90 views
Get original e-mail sender server to circumvent spoofing
I've posted this originally on SO, but it may as well be for here.
As you know, with many e-mail services, you can get tricked into believing an e-mail has been sent from a different address.
Using ...
1
vote
2answers
206 views
Why are email clients prevented from seeing the envelope?
Being able to compare the envelope values against the header field values is potentially useful for detecting fraudulent (e.g. spoofed) mail.
However, email servers, when receiving mail over SMTP, ...
2
votes
3answers
316 views
Is it possible to defend against a backscatter attack?
Yesterday, some spammer on the other side of the world decided to send out a ton of phishing mails with my business mail address as both From address and envelope sender.
The usual best practices are ...
1
vote
1answer
169 views
Bots trying to spoof encoded email links, but why?
I've setup an application for my client, that sends lists of job vacancies to subscribers every Monday morning.
The emails use a custom link redirector service, to make the links email friendly, and ...
-2
votes
3answers
267 views
Two different IPV4 inside outlook email header
I am currently analysing an outlook email header.
I am very confused because it has two ipv4 addresses x-originating from different locations. Usually there is an ipv4 towards the top of the header ...
0
votes
2answers
204 views
Check reputation of specific email address [closed]
I know that it's possible to check the reputation of email address domains, but what does the security community use to find information on the reputation of specific email addresseses?
List of ways ...
0
votes
2answers
133 views
Spoofed email has appropriate alias but unknown email
My wife received a suspicious email where the "FROM" field contained my name, but the email appeared to be delivered from an E-Mail address that we do not recognize.
The fact that the email used my ...
31
votes
1answer
9k views
Is it possible to fake 'received' field in the e-mail?
I've received some strange e-mail recently. The e-mail has different From and Reply-To fields. It has also To set to Undisclosed recipients but it's not crucial.
At first I thought it's fake, but ...
1
vote
2answers
464 views
Can a custom return path make SPF redundant
My understanding is that SPF can be used to define a set of IP addresses that are permitted to send outbound emails on behalf of a domain. If a mail server that is not included in the set of permitted ...
2
votes
1answer
187 views
Is this phishing? How can I be sure? And what can be gained?
Yesterday I received an email that I assumed/hoped was legitimately from a prospective employer that I interviewed with several weeks ago. The timing of the email couldn't have made more sense as they ...
3
votes
2answers
139 views
Email/facebook account/internet protection service for private community
I apologize in advance for any inaccuracy.
I am part of a yoga community which has no particular activity on the web or in the informatic sector.
All we have that can be regarded as web-related is ...
2
votes
2answers
382 views
Is it safe to add IP address to SPF record
I am a programmer who manages online exchanges user also and i have been asked to add IP address to SPF record so that one of the application can hosted on Azure can send emails to user etc..
v=spf1 +...
3
votes
2answers
160 views
Find out who sent email with my IP?
Recently my contact list was shared through some emails recently sent from my account. I would like to find out who did this as it has caused me some financial loss.
When I look at the email header, ...
1
vote
0answers
54 views
Phishing email linking to sharepoint address [duplicate]
Our organization got some sort of phishing email that contained an attachment which linked to sharepoint - ie. https://someaddress.sharepoint.com/:b:/... etc. The link takes you to that "sharepoint" ...
6
votes
2answers
1k views
Tracking click-through for organization-wide phishing email test [closed]
My organization wants to send out a test phishing email to all employees after a week of security awareness.
I plan on drafting a basic HTML page and including a misspelled link to it in an email ...
