Questions tagged [email-spoofing]
Email spoofing refers to the process of sending fraudulent emails that appears to be from someone that it is not.
248
questions
0
votes
0
answers
79
views
I have received an email with pictures from the gallery on my phone [closed]
I've two email addresses: [email protected] and [email protected].
Today, "red" received an email from "pink".
I didn't send this email.
The email contained four pictures that were ...
- 101
0
votes
0
answers
35
views
How To Address Email Deliverability Problems When From Header Doesn't Match From Envelope?
So I'm using Active Campaign as a CRM and have configured DKIM, SPF, and a DMARC none policy. I am having one particular customer of mine that's not able to receive my emails despite them ...
- 101
0
votes
0
answers
31
views
Phishing mails to hidden Azure mailboxes
After some research, I couldn't find a clear answer: in Azure Cloud Domain, some users received phishing emails to hidden mailbox addresses. How can that be? How can those mailbox addresses be known ...
- 1
6
votes
2
answers
917
views
Spoofed email sent to me from my email address with SPF/DKIM/DMARC passing
I received an email earlier today on my work email address. The email came from the same address—mine—but I didn't send it.
It was an email claiming that he was a professional hacker who had hacked my ...
- 161
1
vote
1
answer
64
views
SPF result using alias email address
I have received a threatening message in my email [email protected] from my other email address [email protected]. Note that [email protected] is an alias to [email protected].
Also, of course, I ...
- 111
0
votes
1
answer
67
views
How can an email forwarding service send email with a "From" from a domain they don't control, and still pass SPF?
Let's say:
[email protected] sends an email to [email protected].
Bob owns the domain bob.com but doesn't manage an emailing server. Instead he uses an email forwarding service (provided by his registrar /...
- 963
1
vote
1
answer
60
views
With selfhosting email server, selfsigned certificate, does it make a difference with PGP mail, What can be leaked?
If we are self hosting our own email server with mydomain.com with a self sign CA for S/MIME. What are some possible ways that our email content can get leaked?
Then if we use PGP email, does it make ...
- 17
0
votes
1
answer
457
views
Still able to spoof emails with strict DMARC, SPF and DKIM enabled
Despite setting up strict DMARC, SPF, and having DKIM enabled, I am still easily able to spoof the "From" address. I can easily do this with PHPMailer on my Mac and even with some free 3rd ...
- 101
0
votes
1
answer
133
views
What is the most secure way to send email now? PGP or S/MIME, Given both parties willing to learn the technical parts
What is the most secure way and privacy-focused to send email now (current tech)? PGP or S/MIME, Given both parties willing to learn the technical parts?
Use case, both of parties use third party ...
- 17
0
votes
1
answer
150
views
Spoofed forwarded email? Help with analyzing of DMARC report
Why did this email get forwarded successfully? An XML report is below:
I simply cannot understand the delivery status, a transcript follows:
This email has been automatically forwarded. Despite the ...
- 1,687
0
votes
1
answer
170
views
Spoof email is using my domain name email address but target almost only my contact list with credible content body
Since yesterday, one of my work email addresses is used to send spoof emails with phishing attachments. SPF and DKIM was configured on my domain name but not DMARC, but since yesterday in the evening, ...
- 1
1
vote
0
answers
65
views
Impersonating phishing incident [closed]
An email has been circulated with the username of our organization, with some internal users and also to the customers. Observed that IP 40.92.46.74, which is Microsoft one. We have been using our ...
- 111
1
vote
0
answers
94
views
Malicious Mass Email Attack Occurred, Do I Still Have Problem?
I'm using Apache Airflow and I was troubleshooting built-in smtp setup. A mass email occurred on "[email protected]". It was used as a "From:" email in a mass email attack.
...
1
vote
1
answer
454
views
I am receiving spam from my own email. Is my Gmail account hacked? [duplicate]
I cannot determine if my Gmail account is hacked. I am receiving spam from [email protected] which is identical to my own Gmail address [email protected] except for the dot before the @. How is that ...
0
votes
0
answers
26
views
I clicked what looked like an Amazon email, but it (maybe) was from an Amazon affiliate. Ended up at Amazon.com anyway. Can I safely investigate? [duplicate]
In a case of clicking too fast, I clicked on a picture that looked like it was from Amazon. However this was not the case. I did end up at Amazon, but I'm aware that other things could've taken place ...
- 1
0
votes
2
answers
210
views
Should I take action if I receive a phishing email that passes all email sender checks?
I received an email that passed all the email sender checks (spf, dkim, dmarc), and the sent-from domain is a legitimate domain from a legitimate company. However, the email content itself was ...
- 133
16
votes
3
answers
3k
views
"Undelivered Mail" I never sent (after registration on website)
I created an online account and received the usual welcome email. In addition, however, an "Undelivered Mail Returned to Sender" email appeared in my inbox one second later. I am the ...
- 163
2
votes
1
answer
242
views
Spoofed email: whose fault is it?
My relative received an email from a bill they were expecting to pay. So they paid said bill.
Only problem is: it was a spoofed email, and the real bill only came in later.
I checked the email on the ...
- 133
0
votes
0
answers
26
views
Spam mail from own mailserver, but there is no outgoing mail in postfix log? [duplicate]
Today I received a phishing mail from my own (valid) sender address ([email protected]).
I checked the e-mail header and see the mail was received by my valid mailserver.
Received: from mail.example....
1
vote
2
answers
401
views
Why are @microsoft.com e-mail address not protected against spoofing
I got a lot of phishing attempts that appear to come from an actual microsoft.com e-mail address (see I need some verification about unusual login emails)
I though this was odd, since I had hoped that ...
- 121
1
vote
0
answers
60
views
Bypassing Office365 Server Send As Denial [closed]
I am trying to send an e-mail via Windows Powershell ISE using Office365's hosting server, on behalf of another user which is specified in FROM part of the code using. But when I try to do this, I get:...
- 31
2
votes
1
answer
399
views
How many times need e-mail headers be signed with DKIM to mitigate DKIM header injection attacks?
Many people have written about DKIM header injection attacks. [1] The suggestion to mitigate it is to oversign headers and to rotate any DKIM keys that were previously used to sign e-mails where not ...
- 744
4
votes
1
answer
919
views
Can you rule out the possibility that an email is spoofed despite passing SPF, DKIM, and DMARC?
Excuse my ignorance. I'm just a beginner trying to fill in the knowledge gaps that I have on how email system in general works, so this might seem a silly question to some or even all of you.
Is there ...
- 43
7
votes
1
answer
1k
views
Can DMARC's SPF alignment be spoofed?
IP addresses can be spoofed. The Envelope-From and Header-From addresses can be spoofed as well. But is it possible to spoof all three at the same time to send a forged email that passes both SPF and ...
- 479
0
votes
1
answer
100
views
DMARC falsely reports impersonation
I have set up DMARC for some months now and I am using dmarc-visualizer to parse the reports.
Overall I am happy so we can advance towards BIMI, but before switching to quarantine or reject on DMARC, ...
- 1
0
votes
2
answers
193
views
How can I receive a (spam) email from an unknown email address?
When you receive an email, most email programs will display the sender as a name (chosen by the sender) and hide the actual email address behind it. Spam emails often abuse this by sending mails from ...
- 183
1
vote
0
answers
25
views
Email supposedly from the future mentioning fairly recent password [duplicate]
Just got an email that mentioned, in very broken english, having hacked my email etc. and actually managed to list my current password of that email account. The mail was, apparently, send by that ...
- 11
0
votes
0
answers
89
views
How am I receiving emails addressed to an address not associated with my account?
I currently have a g-mail address ([email protected]). I recently received a message addressed to [email protected]. Looking at the header I see my correct address in the Delivered-To: field but in the ...
- 61
0
votes
1
answer
2k
views
How does this scam email from a seemingly legit domain work?
I received a strange email from [email protected]. Sources on the internet seem to state that this is a Facebook-owned domain but I know the email is not legit because they do not address me ...
- 105
0
votes
2
answers
81
views
Business Email Compromise emails sent to personal email accounts
I am using Google workspace to handle my domain emails. At a certain point, employees started to receive spoofing emails to their @mydomain.com addresses. I blocked these emails and it worked.
However,...
- 101
37
votes
2
answers
21k
views
How did this paypal spoof email pass SPF, DKIM and DMARC
This mail that got through has me stumped. It appeared to me as being from PayPal <[email protected]> in my Inbox. I happened to look at the original and it says SPF, DKIM and DMARC ...
- 401
3
votes
2
answers
166
views
Do password autofill extensions securely validate the site they are autofilling?
I had a situation where I clicked an email link send to me by a financial institution. The link first sent me to their login page where my chrome password extension automatically filled in my username ...
- 273
0
votes
1
answer
591
views
What's The Best PHP Encryption For Email Addresses?
I'm storing a list of email addresses and other not personally identifiable information for a mailing list in a database. Since it's for a project related to cryptocurrency, I believe that the ...
- 753
0
votes
1
answer
703
views
Vulnerability : Missing SPF - is this a scam?
I got an email with the following:
I am just looking at your SPF records then found following. SPF Records missing safe check which can allow me to send mail and phish easily any victim.
PoC:
<?...
- 287
15
votes
3
answers
8k
views
Can an email be doctored to appear from a different sender on an earlier date?
Could someone doctor an email to make it appear that it was sent from a different sender at an earlier date? For example, could someone who knows my email address make it appear that I had emailed ...
user267895
1
vote
0
answers
165
views
Potential Western Union Scam - Account Registration
In recent weeks I have seen a handful of senior employees in my organization receive a confirmation email from Wester Union for a new account creation. The issue is that none of these users have ...
- 172
0
votes
2
answers
180
views
Are e-mails that have a name slightly different from the web page legitimate e-mails?
I usually receive e-mails from an organization called Change.org, that is a site for create on-line petitions (it's site is https://www.change.org/).
The thing is, they send me e-mails with ...
1
vote
2
answers
580
views
Do fowarded emails retain DMARC protection?
Assume I ask someone to create a filter in their Gmail account that automatically forwards certain emails to my inbox. If the original email was protected with DMARC, would the forwarded email also be ...
- 141
-1
votes
2
answers
209
views
Is it Safe to Rely on Gmail API to Reward Users for Placing Orders on Merchant Sites?
I have an application that rewards users for placing orders with certain merchants. In order to verify that the order was actually placed and delivered, a user is required to grant us read access to a ...
- 141
3
votes
3
answers
3k
views
How to check if a mail server is using Enforced-STARTTLS rather than Opportunistic-STARTTLS?
This article tells us that there are two types of STARTTLS: Opportunistic (i.e. optional STARTTLS) STARTTLS and Enforced STARTTLS, which works by the doctrine of "Encrypted connection or drop ...
- 31
0
votes
1
answer
698
views
How can scammer actually reply from a spoofed email address?
I (mostly) understand how a scammer can send an email from a spoofed account, all you need is an unsecured SMTP server.
But how is it possible, for a scammer to RESPOND and maintain an email ...
- 109
1
vote
1
answer
193
views
Questionable email from discord [duplicate]
I got a gmail from discord saying a new account had been registered and prompting me to click a verification link. Weirdly, I never made that account, and I already had a discord account under my ...
- 11
0
votes
1
answer
139
views
Do email providers somehow validate/control "Send email as: " feature?
I have a domain for a website that I'm going to deploy soon. I've registered a gmail account, and let's say it is [email protected]. In order to look more professional, I decided to use gmail's &...
- 101
0
votes
0
answers
1k
views
Spoofed email? "X-Source-Sender" and "Received" headers look dodgy
I got sent an email from someone in response to an over 2 year old exchange, and the contents of it look like spam to me.
Checking the headers the following looks normal:
Return-Path
Received & ...
- 279
0
votes
0
answers
109
views
I received a phishing/spam email from Google Delivery Subsystem about an email I never sent. How? [duplicate]
Screenshot:
The text covered with red is exactly my email address except the end is @google.com instead of @gmail.com.
The suspicious link "Unsubscribe_click_here" is:
mailto:cr@burlondesti....
- 101
0
votes
0
answers
123
views
Does SPF protect against spammers who control the initial MTA?
I understand that for most users, the Envelope-from address is the most difficult part of an email to spoof because (I assume) it is checked by the receiving MTA i.e. if you attempt to spoof the "...
- 1,844
0
votes
2
answers
123
views
I have a custom domain for email. Do I need to configure DNS to prevent outgoing text messages with an address from my domain? [duplicate]
I own a custom domain that I use for e-mail. The mail server is configured with a catch-all that redirects messages to any user to my inbox. For the first time this afternoon, I received a benign &...
- 207
0
votes
0
answers
40
views
How to track anonymous email sender (alternatives to IP tracking) [duplicate]
Are there any ways to get information on who is sending certain emails from an anonymous email address?
Besides the obvious IP solution, would there be any alternative such as embedding some kind of ...
- 101
0
votes
1
answer
124
views
Spoofed DNS-Address in Spam mail header
There is a recent rise in Spam mails sent from seemingly legit german email-addresses according to the mail headers:
Received: from mx1.aok.de ([91.199.166.49])
But when I nslookup mx1.aok.de, I get ...
- 15
1
vote
1
answer
124
views
php / email / iis
in a certain page I have a newsletter subscription form, where the user enters his e-mail address and then through PHP an authenticated e-mail is sent to myself with the user's information (e-mail ...
- 113