213

Is it a scam? First of all, make sure that you actually got the letter from a court. This might very well be a scam - it sure sounds like one. Do this to verify that the letter is real: Make sure that the name of the court correspond to a real court. Find contact information to that court through some independent method (i.e. not using any information in ...


179

While one could create a mail with @amazon.com as SMTP envelope and/or From field of the mail header, the mail would likely be blocked since this domain is protected with Sender Policy Framework (SPF), DomainKeys Identified Mail (DKIM), and Domain-based Message Authentication, Reporting and Conformance (DMARC). This means that a spoofed mail would be ...


146

(Assuming US) No court is going to pre-emptively demand a settlement of $20K for a misdemeanor(!!!) before you've even had a chance to testify. Furthermore, threats are a criminal matter; this isn't a property dispute-- the police would have questioned you long ago, before this ever went to court. If this letter truly claims to have been issued by a court (...


103

TL;DR: It's probably well-intentioned and not a scam, but just poorly written. I don't know of any kind of scam that would be based on this. Certainly there have been attempts to extort website owners for money based on knowledge of website vulnerabilities (and the implicit threat to exploit them), but that doesn't look like the case here. It's not a very ...


57

It seems like the spammer got your personal information including your password through a security breach somewhere. Why did they use your password instead of your name? I would say it was an honest mistake on their side. They just mixed up the fields when designing the spam mail. When you are still using the password somewhere, you should change it ASAP. ...


57

It is possible to add arbitrary fields to the mail and this includes Received headers. But, any proper mail transport server will add a new Received header on top of the mail which means that, depending on the exact delivery infrastructure, the attacker can at most fully fake all but the topmost Received header. In your specific example, the top Received ...


36

Does not appear to be a scam, though it might be a type of mass-mailing due to lack of details. Maybe some guy needs money, runs Nessus on a bunch of sites and is now angling for a small reward from each? I'd run Nessus (or some other scanner) myself to check, then contact the guy and ask for details. Truthfully answer his question about bug rewards. If you ...


26

Set up Domain Keys Identified Mail on your own domain. That will digitally sign legitimate outgoing from your domain. More and more email providers are rejecting or flagging spoofed email where legit email is identified with a Domain Key signature. Your question says, "apart from SPF..." and that's what I answered. However, for others who might use this ...


25

As the answer by phillipp stated, there is a good chance they got your password from some form of security breach. I doubt that they would have obtained that through Paypal's system. It could have happened in one of the following ways, to name a few (with tips on how to protect yourself from each one). At some point you could have accessed a fake PayPal ...


23

This could be related to almost anything, personal information are sold just like any other "things" on the darkweb and even on the "web" by relatively legal entities, Databrokers are selling personal information just like any other stuff. In addition to this as @anon said OSINT tools might be used to gather information about persons, and there are lot of ...


21

To complement Steffen Ullrich's answer, note that: Historically, it was indeed possible to spoof anything you wanted, no-one checked, everybody trusted everybody. However, with the rise of spam, phishing and other scams, SPF, DKIM and DMARC were introduced. Those allow a server to check if the sender does have the right to send mail with a sender in a given ...


19

I have now added this : v=spf1 include:_spf.google.com ~all The ~all at the end just causes a soft fail, that is that mail will still be delivered. If you want to have a permanent fail use -all. Of course this only affects mail server which check the SPF records, which are not all.


18

This is called fear marketing or fear appeal. It's a marketing method that uses fear as the trigger for action. https://en.wikipedia.org/wiki/Fear_appeal The email contains the 3 basic stages of fear appeal. present a risk. present a vulnerability to the risk. suggest a protective action. It is generally considered unethical. I'm only pointing this ...


16

Given the additional information in comments, I have a gmail account and use Mac. He wants to delete evidence. He used the original one, edited it, printed it, presented to his lawyer and deleted the original. He did hack my email. Last week he deleted the original of one of emails that he edited and presented as evidence. Other mails are simply ...


16

The phisher may be hoping to get any replies to send to that address. They are trying to avoid the various frameworks that exist to prevent spoofed "from" fields from being perceived as authentic by a human user. Using this tool I was able to check that amazon.com does have SPF configured. Of course it's on your email client to check DNS for SPF, but most ...


14

Should the practice of sending messages from somecompany.com using anothercompany.com become established, it will be virtually impossible to us users telling if a website is legit or a scam. Unfortunately, this practice is already established - and yes, it makes it very hard to tell legitimate communications from spam. Companies use partners and third ...


13

What is it? I decoded your "garbage." This is base64 encoding, and is far too large to place here. Here's the decoded result: http://pastebin.com/NBV4iY2s This seems to be an attachment of login page for Google Drive. In fact, everything is lifted from Google Drive, with the exception of a few items. This is a phishing attempt. As you can see from line ...


11

Is there anything I can do to prevent them from tarnishing my [...] E-mail address In short: no. In general, you can't prevent anyone from using your email address and sending email on your behalf. You can do a little something by using forwarders that adopt SPF. This means that to be able to send an email to me, pretending to be from you, someone would ...


11

It is as easy to spoof the sender of the email as you can lie about the sender on the envelope of snail mail. It is also not only easy but heavily used: the majority of spam and phishing mails use address spoofing. The only real way to be sure about the sender is if the sender signs the mail and the recipient verifies the signature. Common solutions for ...


11

SMTP messages have a host of header values that are used by mail servers (Qmail) and mail clients (Outlook, Gmail) for different things. It's possible your email was set as either the From or the Sender value which was displayed by your mail client. Here's some info on SMTP from and sender headers: http://tools.ietf.org/html/rfc4021#section-2.1.2 As for ...


11

Email is a very old plain-text protocol (dating from the 1970s/1980s). Anyone who controls a mail-server can send out mail from their mailserver using any return address (including ones at other domain). SMTP doesn't include any checks that the mail came from a mail server who controlled the domain listed on the From: line. Extensions to email protocols ...


10

It's usually a costs vs. benefits decision. Costs: Create your own CA infrastructure or buy a public certificate for each sender Teach employees how to use it Teach employees how not to use it, especially how to make sure that the secret key is really kept secret Teach the customers what this strange stuff in the mail means Properly deal with certificate ...


10

What benefit would DKIM provide if SPF is already used? If a domain has SPF configured the receiving mail server can check if the claimed sender of the mail according to the SMTP dialog (i.e. MAIL FROM) is allowed to send mail from this IP address. This helps against sender spoofing only a bit since only the sender based on the SMTP dialog is checked but ...


9

First, some background information about how email works. The basic issue is that server-to-server contacts using SMTP are unauthenticated: all a server knows about the computer contacting it is The IP address Who the computer wants to send the email to Who the computer claims they are Who the computer claims the email is from Note that the last two items ...


9

From the mail it looks like they are sending from a google account, circumenting the SPF record.Misread the respective headers. It's not the case My recommendation would be to roll out DMARC and DKIM. This allows you to ask the receiving servers to discard or quarantine mail if it wasn't sent and signed by your server. I don't know if DKIM is possible ...


8

It is more likely that your email address is being spoofed than your account is actually hacked, though either is a possibility. Spoofer scenario: Because there are users from your contact list being sent emails from your account, it means that a spoofer likely got access to some of your emails and stole the recipient lists from them. They do this because ...


8

First, nice question. I've checked how Thunderbird behaves by modifying an existing mail and it actually takes the first headers for display of From, To and Subject while the DKIM signature mechanism starts from the end :( . Thus the DKIM signature is considered valid even though From, To and Subject are spoofed. Interestingly the first From line is only ...


8

This script attempts to infect your Windows computer with the Cerber ransomware. The obfuscated Javascript segment downloads an executable from http://www.geraldgore.com/news/17.exe to a temporary file and runs it, employing Internet Explorer's ActiveX controls. The Virustotal analysis of that binary suggest that it's a variant of the Cerber ransomware. ...


8

Due to the nature of electronic mails, anyone can send a mail with any name from NASA to FBI to your neighbour. You need to raise the court's attention to this. Get the court release the full emails, including its headers. The headers will tell that the emails did not go through your mail server (or the mail server you use). If you are using an email giant ...


8

One way to check for personal information is by using google. Just insert the string you want to search for and surround it with ". Like "NAME SURNAME". This will display some sites where exactly this match is found. You can check for other personal data from that mail, too. That way you propably can get close to the source of the information leakage. There ...


Only top voted, non community-wiki answers of a minimum length are eligible