Questions tagged [email]

Related to email protocols, clients, servers, content, and message format.

Filter by
Sorted by
Tagged with
0
votes
2answers
198 views

Do spammers use legitimate email marketing companies?

Every so often I will find myself on a mailing list that I know I didn't sign up for. This always gets me very cautious and I treat the junk mail as hostile spam - don't click, just delete and ignore. ...
0
votes
1answer
67 views

How to send emails with Thunderbird without revealing my internal and external IP address?

I have noticed this issue while using Google's Gmail with Thunderbird. When I send an email from Gmail's web front end at https://mail.google.com/ my internal and external IP address are not included ...
1
vote
0answers
55 views

Cutting down phishing attacks from AmazonSES

I am trying to work on cutting down on the amount of spam, phishing and just malicious emails coming trough via AmazonSES burners. Has anyone devised a method or certain IOCs to block on? Thanks
0
votes
0answers
46 views

Trace Unauthorized login into My Gmail and Facebook Account

I have experienced an unauthorized login into my Gmail and Facebook account, while I was logging into the accounts and doing school assignments. Suddenly, I got an email from Facebook about "...
2
votes
0answers
43 views

DMARC rua indicates mail send from competitorDomain.com for ourDomain.com, is this (potentially) mallicous?

We've received several rua reports indicating that one of our direct competitors is sending emails with our domain in the mail from headers. I do not have access to the actual emails sources, and I ...
-5
votes
2answers
277 views

A safer way to read emails on Android devices

I've been trying to think of a safer way to check the email on an Android device. Android devices are generally very insecure, and therefore they should not be trusted for anything serious. Here are ...
3
votes
2answers
7k views

Getting about 6-7 spam emails every minute

About several hours ago I started getting A LOT of spam e-mails, 6 per minute on average. I have no idea what went wrong. This is the e-mail address that I'm using for years and I was very careful in ...
0
votes
0answers
38 views

Logging email with account activation links [closed]

What is the security risk of this web application: There is a "create account" function. An activation link is sent by email. The content of the message containing the activation link is ...
0
votes
0answers
68 views

How to determine if a PC is safe after receiving a suspicious email message

I was checking my gmail account spam folder and I noticed an email sent by a known sender. I thought it was flagged as spam by mistake so I opened it. Then I realized the content is the same as ...
3
votes
1answer
1k views

Getting subscribers on website from nowhere?

I have a weird question and I hope I am asking in the right place. Recently I checked some statistics on my website after a while and noticed that the number of email subscribers had jumped from about ...
6
votes
2answers
2k views

Does Mozilla Thunderbird leak any personally identifying data?

I know that Windows Live Mail leaks your computer name. Does Thunderbird have any leaks like this? If so, to prevent them? Edit: I mean email headers. Are there any other privacy issues with ...
0
votes
1answer
83 views

How was the hacker able to get my Instagram tag through Facebook when they weren’t linked?

All of this happened on 18th November 2020 A person I know sent me a phishing link of Facebook then Google, I entered my credentials however as soon as I found out that its a phishing link, I turned ...
3
votes
1answer
85 views

Should users be allowed to to login with the same email when an email change is requested but not completed?

I've found a very similar question: Should users be allowed to log in with the same password when a password change is requested but not changed?. But the key difference here is that requesting an ...
1
vote
0answers
43 views

Odd storage.googleapis.com link in spam email [duplicate]

I have accidentally clicked on a link in a spam mail (sent to my gmail, wasn't sent to junk folder) and it opened the link in a new firefox tab. hxxps://hm_vqh3bo6.storage.googleapis.com/24476060.html ...
3
votes
1answer
116 views

Nonprofit organizations asking me to email them a photo of my driver's license

Recently I've had two nonprofit organizations ask me to email them a photo of my driver's license. No money is changing hands, and both of these are legitimate and well-known nonprofits. Organization ...
-1
votes
0answers
26 views

Identifying the spam source on my Centos6.9 smtp sendmail server [migrated]

The server has also httpd with PHP services running I did read the guide here: https://a1websitepro.com/find-track-filthy-spammer-block/ I did install EXIM My client complains they never had this ...
0
votes
1answer
75 views

Is hacking email with simjacking a concern if you don't have 2FA for the email?

I've been doing some reading on simjacking lately, mainly around how one may be compromised. One common tidbit I read is that you can access your email and your other financial services if you have ...
1
vote
2answers
43 views

I have a custom domain for email. Do I need to configure DNS to prevent outgoing text messages with an address from my domain? [duplicate]

I own a custom domain that I use for e-mail. The mail server is configured with a catch-all that redirects messages to any user to my inbox. For the first time this afternoon, I received a benign &...
6
votes
1answer
6k views

How is it possible that this spam mail came from Google Forms without revealing their sender address?

I got just this typical spam email, but this one seemed odd. It came from Google Forms, which apparently can send emails too, however you have to sign in to Google Forms to use it, and it uses the ...
0
votes
0answers
26 views

How to track anonymous email sender (alternatives to IP tracking) [duplicate]

Are there any ways to get information on who is sending certain emails from an anonymous email address? Besides the obvious IP solution, would there be any alternative such as embedding some kind of ...
5
votes
3answers
2k views

Is a safelinks.protection.outlook.com link phishing?

Received an email which contain the below hyperlink https://nam02.safelinks.protection.outlook.com/?url=http*3A*2F*2Factuallysale.com*2F&data=02*7C01*7C*7C548d20ace3ec4747fe1008d7d7d8b597*...
4
votes
3answers
8k views

Do SPF records apply to all subdomains?

Does a SPF record apply only on the domain it’s setup for or also for all it’s subdomains? For example an SPF record that is configured for the domain example.com will set the policy for mails ending ...
74
votes
8answers
10k views

Why is email often used as the ultimate verification?

In many services, email can be used to reset the password, or do something that is sensitive. Sensitive data is also quite often sent to you by email, e.g. long links that enable access to your ...
1
vote
1answer
200 views

Where can I find sample DMARC failure reports?

I want to automate ingestion of DMARC failure reports, both aggregate and forensic. Unfortunately, I don't have a mailbox set up to collect them yet. Does anyone know where I can find sample DMARC ...
2
votes
2answers
260 views

Any recipient can modify an order confirmation mail, right? Does this ever matter?

I have boldly stated that there is no way to 'write protect' an e-mail, but want to be sure of my ground. Surely, if Joe Bloggs receives an e-mail from me (or my e-commerce site or a web application ...
0
votes
2answers
452 views

Is this login flow via an authenticated email account safe?

I want to have users log in by entering an email, and then proving that they control that email. I only care that they do control the email, and so want to avoid add another password to the process if ...
0
votes
0answers
56 views

Is it a good idea to use a domain based e-mail accounts to register to financial services?

I normally use my personal email (e.g. @gmail or @yahoo) to create online financial accounts such as online wallets, bank accounts, stock market, and etc. I am currently planning to create an online ...
2
votes
3answers
96 views

Reading locally-stored emails sent encrypted

As far as I know, when Alice sends an encrypted email using PGP to Bob then the email will be encrypted using Bob's public key. Only Bob can decrypt it (as long as no one else has Bob's private key). ...
1
vote
1answer
113 views

SPF/DMARC for shared email provider (gmail) - how did this email pass SPF?

We recently received an email from a self described "white hat hacker" purporting to be from our own organization. According to the mail headers, spf, dmarc, dkim and arc all passed okay and ...
71
votes
6answers
23k views

Is gmail-to-gmail still insecure? Why?

I have always heard that email is an insecure method of communication; I assume this has something to do with the email protocol itself. But when sending an email from one Gmail account to another, ...
0
votes
1answer
54 views

Can just clicking on a malicious link lead to hacking of my device? [duplicate]

I was not sure about it and I got some answers from internet but didn't get the logical reasoning behind it. If I just click on a malicious link it might open a new tab, or it might download something....
7
votes
4answers
387 views

Addressing unsubscribe link leakage when an email is forwarded

Since newsletters are often forwarded (and in fact successful ones encourage it!), what's the conventional wisdom on the security of unsubscribe links? It's common practice to provide an unsubscribe ...
0
votes
1answer
72 views

Finding all the subdomains and registered email addresses? [closed]

Could you please explain, how to find all of the existed subdomains of a domain address and registered email addresses of these subdomains? I found a website called snov.io but it only shows some of ...
1
vote
1answer
317 views

DMARC and SPF are setup for my non-www domain but doesn't work for www

My website is up and running on www.example.com and I am sending automated emails from my email address support@example.com. DMARC and SPF seem to setup accordingly: _dmarc : v=DMARC1;p=none;pct=100;...
1
vote
1answer
59 views

Can a spam email full of junk characters be dangerous?

Recently, I've been receiving emails from JP MORGAN CHASE that are blatant phishing attempts. Out of curiosity I have opened them a few times, and they're just completely full of absolute junk ...
0
votes
2answers
135 views

Is it standard practice to hide where links point in a legitimate email?

Someone in our family recently requested a password change for a website (Costco). Soon after requesting, they received an email with the standard "click the link below to reset", followed ...
7
votes
0answers
129 views

PGP security with Thunderbird 78 email client

I have a query regarding best practise of using PGP to sign emails with Thunderbird 78. Thunderbird 78 took an existing system by Enigmail and brought it "in-house" to be built into the ...
73
votes
13answers
15k views

Why is a link in an email more dangerous than a link from a web search?

Everyone knows of the common cybersecurity tips to be careful when you open links in an email. But every day we look for something on the Internet, clicking links which the search engine shows us, and ...
0
votes
1answer
67 views

What usually happens to the symmetric (session) key after decrypting an email? Can the key be recovered if changing private keys?

I've been preparing for a CISSP exam and was reading about applied cryptography in regard to email. It's my understanding that the popular schemes (PGP,S/Mime) use a combination of asymmetric and ...
2
votes
2answers
77 views

What to make of inconsistent TFA/2FA verification emails from AOL

My parents use AOL (there's no point trying to migrate them at this stage) with two factor authentication. My father let me know that he recently received an identity log in verification email that ...
4
votes
2answers
393 views

Using a separate email address for each contact

A lot of the people I exchange emails with use services such as Google Mail. Recently it occurred to me that Google must maintain a social graph based on who exchanges emails with whom. It bogs me ...
0
votes
1answer
235 views

How to workaround Thunderbird 78's lack of support for encrypted mailing lists?

As of Thunderbird 78, the support for PGP plugins such as Enigmail has been dropped in favour of a native implementation of pgp in Thunderbird's core. But some features of Enigmail are still missing. ...
1
vote
0answers
45 views

Strange cyrus/imaps Logins without valid password

I found apparently successful logins from a foreign ip-address to our cyrus-imap server: Nov 24 08:16:20 server-1 cyrus/imaps[12101]: starttls: TLSv1.2 with cipher ECDHE-RSA-AES256-SHA (256/256 bits ...
14
votes
2answers
14k views

Is e-mail a direct vector for XSS

I'm curious if there is a way to execute XSS via email. I am not talking about using e-mail as a way to deliver a link that has reflected XSS in it. I'm talking about sending an email from example....
0
votes
1answer
60 views

Why can't mail clients verify an email was sent from the user and server it claims to be from?

Background When I explain to my clients the security issues around email spoofing, I often explain that emails are like regular mail. Anyone can write Jon Doe on the return address, but that doesn't ...
0
votes
1answer
135 views

Force specific encryption cipher for S/MIME mails

I have a number of contacts who can only decrypt 3DES, when it comes to S/MIME encrypted mails. I'm aware that this is by far not ideal, but better than no encryption at all. My problem is, that I ...
1
vote
0answers
38 views

How secure is email now? [duplicate]

When I did my degree ~20 years ago, the contents of an email were described as being "as secure as a postcard". Since then, HTTPs has become standard for web browsing and the absence of ...
0
votes
1answer
717 views

What exactly is a “Combo List”, and why is this site providing them for free?

After asking for e-mail lists the other day, I got linked to this: https://combo-list.com/ This is a very strange "blog" which appears to be regularly publishing (or linking to, rather) ...
0
votes
1answer
91 views

Checking system integrity after clicking scam email link on Linux

Earlier today, my mother opened an email thinking it was from my sister-inlaw, then clicked on the shortened link. The link loaded a page of fairly nonsensical text. The source of the page had no ...
2
votes
1answer
160 views

How can Google know that a Microsoft e-mail account is “not safe”?

Recently, I was forced to log in to my Gmail account with a browser to keep using it. Then, Gmail noted that the "alternate e-mail address", my 1999 Hotmail one, which I had long ago ...

1
2 3 4 5
32