Skip to main content
212 votes

Someone is using my (or has the same) email

Is it a scam? First of all, make sure that you actually got the letter from a court. This might very well be a scam - it sure sounds like one. Do this to verify that the letter is real: Make sure ...
Anders's user avatar
  • 65.7k
184 votes
Accepted

Why do phishing e-mails use faked e-mail addresses instead of the real one?

While one could create a mail with @amazon.com as SMTP envelope and/or From field of the mail header, the mail would likely be blocked since this domain is protected with Sender Policy Framework (SPF),...
Steffen Ullrich's user avatar
145 votes

Someone is using my (or has the same) email

(Assuming US) No court is going to pre-emptively demand a settlement of $20K for a misdemeanor(!!!) before you've even had a chance to testify. Furthermore, threats are a criminal matter; this isn't a ...
Ivan's user avatar
  • 6,338
103 votes
Accepted

Email received regarding Security flaw in website

TL;DR: It's probably well-intentioned and not a scam, but just poorly written. I don't know of any kind of scam that would be based on this. Certainly there have been attempts to extort website ...
David's user avatar
  • 16.1k
61 votes
Accepted

Reply to potentially spoofed email

You are focused on the person existing and not the account. Consider that Eve exists, did not send the email, but someone with access to her account did, and has entered an email rule to prevent your ...
schroeder's user avatar
  • 131k
57 votes
Accepted

Is it possible to fake 'received' field in the e-mail?

It is possible to add arbitrary fields to the mail and this includes Received headers. But, any proper mail transport server will add a new Received header on top of the mail which means that, ...
Steffen Ullrich's user avatar
35 votes

Email received regarding Security flaw in website

Does not appear to be a scam, though it might be a type of mass-mailing due to lack of details. Maybe some guy needs money, runs Nessus on a bunch of sites and is now angling for a small reward from ...
Tom's user avatar
  • 10.6k
31 votes

Can an email be doctored to appear from a different sender on an earlier date?

Yes, there are a bunch of different ways to forge emails. Almost the entire contents of the email your receive is sent as data over SMTP, and as such, the headers are just as forgeable as the body: ...
bk2204's user avatar
  • 9,574
31 votes
Accepted

"Undelivered Mail" I never sent (after registration on website)

It looks like the web service in question has configured their system to forward the welcome emails to an internal address on their end, but misconfigured their system such that the From: line is the ...
AJAr's user avatar
  • 2,402
27 votes

Reply to potentially spoofed email

If you don't know Eve, I see no reason to follow up. If you do business with the company she claims to represent, you could reach out to a regular contact you use at that business. Don't try to engage ...
Adam Katz's user avatar
  • 11.9k
25 votes
Accepted

Why would PayPal send messages from another domain?

Should the practice of sending messages from somecompany.com using anothercompany.com become established, it will be virtually impossible to us users telling if a website is legit or a scam. ...
Mark Beadles's user avatar
  • 4,002
24 votes

I received an "Undelivered Mail", is my email address used maliciously?

In addition to @SteffenUllrich, you might also want to double check the headers of the attached mail. In particular, pay a lot of attention to the Received: from header (well.. the header is just ...
usr-local-ΕΨΗΕΛΩΝ's user avatar
22 votes

Why do phishing e-mails use faked e-mail addresses instead of the real one?

To complement Steffen Ullrich's answer, note that: Historically, it was indeed possible to spoof anything you wanted, no one checked, everybody trusted everybody. However, with the rise of spam, ...
jcaron's user avatar
  • 3,675
21 votes

How do I investigate where personal information in a fraudulent email was leaked from?

This could be related to almost anything, personal information are sold just like any other "things" on the darkweb and even on the "web" by relatively legal entities, Databrokers are selling personal ...
Soufiane Tahiri's user avatar
19 votes

Email received regarding Security flaw in website

This is called fear marketing or fear appeal. It's a marketing method that uses fear as the trigger for action. https://en.wikipedia.org/wiki/Fear_appeal The email contains the 3 basic stages of ...
Reactgular's user avatar
17 votes

Why do phishing e-mails use faked e-mail addresses instead of the real one?

The phisher may be hoping to get any replies to send to that address. They are trying to avoid the various frameworks that exist to prevent spoofed "from" fields from being perceived as authentic by a ...
ShapeOfMatter's user avatar
17 votes
Accepted

How Concerning Is This X-CU-modified: FAKECU Text Attack?

From my understanding the message originally tried to fool the user into clicking some seemingly expected link (as shown in the text) which in reality is a different link (href attribute in the actual ...
Steffen Ullrich's user avatar
16 votes

Someone is using my (or has the same) email

Given the additional information in comments, I have a gmail account and use Mac. He wants to delete evidence. He used the original one, edited it, printed it, presented to his lawyer and deleted the ...
Andrew Leach's user avatar
16 votes

Can an email be doctored to appear from a different sender on an earlier date?

Existing answers are correct, but incomplete. I would like to highlight two other scenarios. First, about SMTP. Under some conditions, someone can connect directly to the final SMTP server and deliver ...
user1532080's user avatar
13 votes

Security of SPF vs SPF and DKIM in email

What benefit would DKIM provide if SPF is already used? If a domain has SPF configured the receiving mail server can check if the claimed sender of the mail according to the SMTP dialog (i.e. MAIL ...
Steffen Ullrich's user avatar
13 votes

Spoofed email sent to me from my email address with SPF/DKIM/DMARC passing

TL;DR: this does not look like a hack but like a broken mail setup for your domain. The DKIM pass and SPF pass are the result of your mail setup accepting the original mail and then forwarding it to ...
Steffen Ullrich's user avatar
11 votes

Is it enough to look at the sender's email address?

Email is a very old plain-text protocol (dating from the 1970s/1980s). Anyone who controls a mail-server can send out mail from their mailserver using any return address (including ones at other ...
dr jimbob's user avatar
  • 39.4k
10 votes

How to create email that will fool DKIM verifier?

First, nice question. I've checked how Thunderbird behaves by modifying an existing mail and it actually takes the first headers for display of From, To and Subject while the DKIM signature mechanism ...
Steffen Ullrich's user avatar
10 votes
Accepted

Can DMARC's SPF alignment be spoofed?

Yes. SPF can be spoofed, but it's not easy. The only reliable ways to do it are with DNS hijacking (such as a MitM attack, which DNSSEC spoils) or with IP spoofing like BGP hijacking. Both of these ...
Adam Katz's user avatar
  • 11.9k
9 votes

Reply to potentially spoofed email

A long time ago when I was just out of short trousers and working my first gig as a system administrator I replied to a spam email asking them to stop spamming me. It turned out the FROM address was ...
symcbean's user avatar
  • 18.7k
8 votes
Accepted

De-obfuscation of malicious javascript in spoofed eMail

This script attempts to infect your Windows computer with the Cerber ransomware. The obfuscated Javascript segment downloads an executable from http://www.geraldgore.com/news/17.exe to a temporary ...
Arminius's user avatar
  • 44.9k
8 votes

Someone is using my (or has the same) email

Due to the nature of electronic mails, anyone can send a mail with any name from NASA to FBI to your neighbour. You need to raise the court's attention to this. Get the court release the full emails, ...
Rápli András's user avatar
8 votes
Accepted

Can SPF be bypassed by using a shared email server?

SPF is designed to protect against someone using their own server to send e-mail with your from address. For instance, spammers might use a botnet of compromised PCs or devices to connect directly to ...
IMSoP's user avatar
  • 3,910
7 votes
Accepted

Our domain being spoofed by email addresses to try and spear phish us - how to prevent

You can implement DMARC - https://dmarc.org/ - DMARC is a standard that allows you to specify mail servers that are valid for sending your email and contain some processes for filtering mail ...
crovers's user avatar
  • 6,381
7 votes

Can I spoof email?

The simple answer is yes, you can spoof mail. You can spoof the FROM email address and the sending domain, however you will not be able to spoof the originating IP address. (Your IP address is used in ...
tlng05's user avatar
  • 10.4k

Only top scored, non community-wiki answers of a minimum length are eligible