Spoof e-mail

I have been trying to confirm my bank account for a while. I tried again yesterday to get some help. Last night I got an e-mail from paypal saying that she was doing something to confirm my bank account and I would be notified within 72 hours. So, I was like .. great. Finally someone is helping me. Then this morning, I got an e-mail from a bank claiming to associated with paypal. The link in the e-mail redirected to a website that asks for very personal information. So, I closed it. Then I forwarded the e-mail to spoof @ paypal.com - they responded saying with the 'You're right! This was a phishing attempt'' or whatever the exact words are.. So, I was nervous about that, and I was thinking.. How does the person who sent this phishing e-mail know that I'm trying to confirm my bank account with paypal? Or was it a coincidence? Then I let it go and forgot about it. Then I had a phone call, no voicemail was left and I had missed it. I googled the number and it was associated with paypal according to a bunch of people who aren't really reliable sources. Then not long after the phone call, I got another e-mail from paypal (webform @ paypal.com) saying that he had tried to call me to help me confirm my bank account, and I should call him back to set it up. I called, but in the meantime, I got suspicious because of the first e-mail/phishing attempt from that mornign - so while on hold on the phone, I forwarded that e-mail to [email protected] to see if it checked out as legit. Seeing how I was calling these people to confirm my bank and I would probably have to give sensitive information. I got the e-mail back from spoof, and it said AGAIN that the new e-mail was a phishing attempt - the e-mail that told me to call the people I was on hold with right then. I replied to that e-mail from spoof @ paypal.com and I said: Are you sure? I'm on the phone waiting on hold for someone now. I really
need to get my bank account verified.. If this is a legit call then I
really need to do it. And I already gave the last 4 digits of my social
security number. This is the second e-mail that I've gotten saying it's
a phishing attempt. How did they get my number if it's a scam? They
called me first [later on, paypal replied to ^my reply and identified my reply as a phishing attempt, too... yeah.. seriously...] So, a customer service guy picked up the line, and I didn't know what to do at that point. I didn't know what to say to him, so I just tried to explain what had kind of happen and asked him to somehow verify that he is really from PayPal. It was going around in circles and I was trying to explain it to him.. like.. ''Yeah, the e-mail does look legit, but PayPal just told me that the e-mail that told me to call YOU is a scam attempt.. meaning you're the scammer.. Because the scam e-mail told me to call you.. and here we are.'' Basically.. he needed to confirm who I was before he could tell me anything and I needed to confirm who he was before I would tell him anything. He offered to forward me to the fraud department and I was like .. wait, but if you're a scammer then what good is the ''fraud department'' going to do for me? and he was like, if I'm a scammer then why would I connect you to the fraud department.. and I was like anyone could claim to be the fraud department.. ya know? Anyway.. I confirmed the piece of information that he wanted because that was going nowhere. and because the info wasn't something majorly sensitive.. so that he could then confirm to me who he was.. I guess.. So, after that, I asked him to confirm something from my paypal and he did. and he told me all the information on my PayPal account, and he knew everything. So I said okay, I believe you that you're PayPal. We went through the bank confirmation stuff - allthewhile I still feel weird about the whole thing, plus I feel like he thinks I'm a lunatic. But I still have this little voice going, ''But why did spoof @ paypal.com say that he's phishing..?'' and ''How could they possibly identify their own e-mail as a scam...?'' Then he said my bank account was confirmed, so I was like.. Ok, let me just look while you're on the phone with me and check to see that my bank account is confirmed on my PayPal account. Because if it wasn't, there would be a big problem. My bank account WAS confirmed - something I've been trying to do for like 6 months, so I was really happy. And that was that. But here I am.... still wondering.... what just happened...?????

Along with some good advice Leonn1990 wrote:
...You can forward the email to BT, the email address to forward it too is [email protected]..
Reporting spam to [email protected] ought to be a good idea, but I doubt it because that address responds with a long email that starts by saying BT will do nothing unless the spam comes from one of its customers - and that's unusual. Very entertaining, though, because that email is itself trapped by the Yahoo spam filter. It looks as though that address is for reporting fellow customers who misuse the BT email system, not for spammers.
This BT help page (currently linked from the Forums home page) tells us to use address [email protected] That at least returns a very encouraging response, though this whole thing makes me wonder whether BT really does anything about these reports.
The odd thing is that when you follow the advice to forward the spam email you are stripping off the information that is not displayed that BT technicians could use to track down the source. Sending it as an attachment preserves that information but I've no idea whether either of these reporting addresses is set up to do anything with email attachments. Greg

Similar Messages

Spoof E mail, Need to Verify Account?

Received e mail today direct into "In Box" asking to verify account.
It came from [email protected] assume it's a spoof?
Is there any way of reporting it to BT for investigation?

Along with some good advice Leonn1990 wrote:
...You can forward the email to BT, the email address to forward it too is [email protected]..
Reporting spam to [email protected] ought to be a good idea, but I doubt it because that address responds with a long email that starts by saying BT will do nothing unless the spam comes from one of its customers - and that's unusual. Very entertaining, though, because that email is itself trapped by the Yahoo spam filter. It looks as though that address is for reporting fellow customers who misuse the BT email system, not for spammers.
This BT help page (currently linked from the Forums home page) tells us to use address [email protected] That at least returns a very encouraging response, though this whole thing makes me wonder whether BT really does anything about these reports.
The odd thing is that when you follow the advice to forward the spam email you are stripping off the information that is not displayed that BT technicians could use to track down the source. Sending it as an attachment preserves that information but I've no idea whether either of these reporting addresses is set up to do anything with email attachments. Greg

Recover Sign-In Details E-mail

This is scam, isn´t it?
Hi (here was my e-mail),
new
Your Skype details
To recover your sign-in details for Skype, simply follow this link.
Please note this alert was sent because your account has been locked. On the page you'll need to submit your login details to resolve this issue.
Skype
Thanks!
Subject/title amended for clarity.
Solved!
Go to Solution.

Hi, MmeDenise, and welcome to the Community,
I am so distrusting of e-mails received from several websites I maintain accounts with, being that spoof e-mail is so popular, that upon receipt, I will not follow any links provided (redirects happen so fast that it is not easy to watch what is happening) and instead sign in to the website itself and check my account details. I suggest you do the same with your Skype account: sign on to your account dashboard, make sure that your account's registered e-mail address is accurate and valid, and then proceed to change your account password.
Kind regards,
Elaine
Was your question answered? Please click on the Accept as a Solution link so everyone can quickly find what works! Like a post or want to say, "Thank You" - ?? Click on the Kudos button!
Trustworthy information: Brian Krebs: 3 Basic Rules for Online Safety and Consumer Reports: Guide to Internet Security Online Safety Tip: Change your passwords often!

Mail recieving but not sending on Yahoo account!

Hi,
I have had my Yahoo email set up and running fine through Mail for the last year or so. However for the last couple of days I can receive email's but not send them.
I have three yahoo accounts and it's the same on all three. I've tested the connection settings and they're all fine. I've even deleted the accounts from Mail and set them up again from scratch.
I get the following error:
*'Sending the message content to the server failed.*
*Select a different outgoing mail server from the list below or click Try Later to leave the message in your Outbox until it can be delivered.'*
Anyone else getting this problem?
Thanks in advance for your help.
Steve

In order to prevent spam and address spoofing, some mail systems are now being set to disallow 'relay'
That is, sending to another host via an intermediate account.
Example: Your mail account is [email protected]
You are popping mail from [email protected] You get a message at your yahoo address from [email protected]
When you try to reply to the yahoo message from your host.com account, you are trying to use host.com as an intermediate to yahoo.com, which will in turn send the reply to [email protected]
you are thus asking host.com to relay a message from [email protected] to [email protected]
In reality, host.com has no idea who [email protected] is.
So it refuses to allow an unknown user from a foreign system to use it's mail server to send to a 3rd mail server. This is considered relay, and it's a favorite tactic for spammers.
That may be why you are told to "select a different outgoing server"

How an I prevent spoofed email using IronPort C160?

As part of Security Awareness training and testing we contracted a company called knowbe4 to initiate some random spoofed e-mail tests into our domain. Normally I would have figured this would fail because when email comes into the C160 and it has our @domainname.com on it, it needs to validate the DKIM signature, and if it was not sent from our organization, IronPort would not have signed it, correct?
Anyway the security awareness organization was able to successfully send an e-mail inbound and make it appear as if it came from [email protected] (which we do not have a mailbox with that name, but I'm sure he certainly could have done research and used our real CEO's email address.). In Outlook it does appear as [email protected] in the from box, but when you search message tracking for emails coming from that address you get nothing. Upon further inspection of the e-mail headers, the message actually came from bounces+78188-4be9-username=[email protected] So it matched policy DEFAULT for inbound mail policies and eventually it was successfully signed with domain key profile and DKIM profile matching [email protected], then queued for delivery.
How can an email arriving from one server "morph" into another? Is there some sort of vulnerability that this organization is taking advantage of, perhaps some kind of active script that the IronPort ends up acting upon to alter the email address and sign it so it passes through? This was a test today, but we need to plug this hole because the bad guys are going to use this technique to make phishing emails look legitimate coming from internal users.

I use knowbe4 as well, great phishing test templates, and what I found to work best to fight Domain spoofing are the following:
- Implement DMARC/SPF/DKIM DNS records and keys - You will want to set these to passive initially. I personally recommend using dmarcian.com they have tools to help with implementation. Initially you will just want to be in monitor mode then start suggesting actions that gateways should take based on your DNS records. (This will protect your domain from being spoofed to gateway or provider that has DMARC/SPF/DKIM enabled)
- Maintain your DNS SPF records (these are to used to help you authorize who can send emails from as your domains)
- Here is a good how-to video for configuring your appliance to block domain spoofing. You will want to add any providers you want to allow to spoof such as ADP, training, and other third party vendors that generally spoof your domain to send emails to your employees. https://supportforums.cisco.com/video/11932126/configure-spoof-protection-exception-lists
- Create a second mail flow policy similar to your allowspoof one, but turn off spam filtering, I called mine KnowBe4.
- Create a new HAT and call that KnowBe4 and point it to the new policy. Add all the Knowbe4 or who ever your phishing simulation provider is to this HAT table. I suggest adding a description so you will know which ones to delete later on.
You should now have taking care of e-mail spoofing, you will want to monitor this closely. Also if you are using Email Encryption you need to make sure the vendor's (even if using Cisco) gateways are added to your SPF record and your HAT table AllowSpoof list.
Finally I would recommend enabling DMARC feature in your appliance, this will help filter out and report to email providers and gateways who is spoofing their domains, it will also increase your filtering power, but it does not stop all spam just one more thing to eliminate low hanging fruit.
Knowbe4's test phish is a good way to test for spoofing, and your employees.

Mail: Fake undeliverable email?

Hi all,
I got an email with the subject "Undeliverable: Accepting until Monday" from <[email protected]>. Scrolling down to the original email, the From: field says "Academy of Higher Education" followed by my ISP email address. The message body is about classes starting November 7. I did not send this email, there is no matching message in my sent folder. While I would assume that this is a phishing scheme, I don't see link that the sender would want me to click. Any similar experiences? Anyone know what this is about?
Thanks,

It could also be spoofing -
E-mail spoofing - Wikipedia, the free encyclopedia
Someone else with your email address in their address book, probably someone driving a PC, may have had their address book info compromised.

How to send only email from workflow

Hi Guys,
I want to send an email from a workflow without sending a notification ... how do i do it ?
Thanks In advance
Tom.

Hi,
Two possible ways - neither of which I would recommend.
1 - Write a trigger on the WF_NOTIFICATIONS table, so that if the notification for the process that you require is sent, then you populate the mailer status column to 'spoof' the mailer into thinking that it has already sent it. That should suppress the email.
2 - Modify the flow to include an activity prior to the notification to change the recipient preferences to not receive email, send the notification, then change the preferences back.
Email is an "all or nothing" solution - either get email from everything, or get it from nothing. How are they planning on dealing with the notification that they are sent? If they are logging into the application to view the notification, then you could consider sending summary notification emails, and force the users to log into the application to view them all, rather than trying to adopt a half-and-half solution where some things come by email and some only come in the application.
HTH,
Matt
WorkflowFAQ.com - the ONLY independent resource for Oracle Workflow development
Alpha review chapters from my book "Developing With Oracle Workflow" are available via my website http://www.workflowfaq.com
Have you read the blog at http://thoughts.workflowfaq.com ?
WorkflowFAQ support forum: http://forum.workflowfaq.com

Email used by someone else

Had someone used my email to send junk and other stuff. This got blocked and I only use iPad anything I can do to protect myself better?

Don't get upset about this. Evidently, hotmail was hacked and some account info was stolen. I've gotten many spam e mails, particularly from Yahoo e mail accounts where hacked accounts were sending out "spoofed" e mails. This can be annoying, but it's not usually a security issue. So I agree with Rudegar.

DPS - uppercase/lowercase binds

Hi:
In DPS 6.3 running on RHEL 4. I see application binds coming in twice, once for uppercase, once for lowercase, see example. Is this default behavior and can it be stopped?
[16/Jun/2009:22:00:11 -0400] - CONNECT - INFO - conn=2390216 client=54.xx.xx.xx:4679 server=lctsp1110.xxx.com:1389 protocol=LDAP
[16/Jun/2009:22:00:11 -0400] - PROFILE - INFO - conn=2390216 assigned to connection handler cn=default connection handler, cn=connection handlers, cn=config
[16/Jun/2009:22:00:11 -0400] - OPERATION - INFO - conn=2390216 op=0 BIND dn="*cn=fsmrs*,ou=dmz,ou=xxx,ou=services,dc=im-2,dc=com" method="SIMPLE" version=3
[16/Jun/2009:22:00:11 -0400] - SERVER_OP - INFO - conn=2390216 op=0 BIND dn="*cn=FSMRS*,ou=DMZ,ou=xxx,ou=Services,dc=iM-2,dc=com" method="SIMPLE"" version=3 s_msgid=970 s_conn=pedr2:174717
[16/Jun/2009:22:00:11 -0400] - SERVER_OP - INFO - conn=2390216 op=0 BIND RESPONSE err=0 msg="" s_conn=pedr2:174717
[16/Jun/2009:22:00:11 -0400] - SERVER_OP - INFO - conn=2390216 op=0 BIND dn="cn=FSMRS,ou=DMZ,ou=xxx,ou=Services,dc=iM-2,dc=com" method="SIMPLE"" version=3 s_msgid=2 s_conn=pxnm31:175523
[16/Jun/2009:22:00:11 -0400] - SERVER_OP - INFO - conn=2390216 op=0 BIND RESPONSE err=32 msg="" s_conn=pxnm31:175523
[16/Jun/2009:22:00:11 -0400] - OPERATION - INFO - conn=2390216 op=0 BIND RESPONSE err=32 msg="" etime=0
[16/Jun/2009:22:00:11 -0400] - OPERATION - INFO - conn=2390216 op=1 UNBIND
[16/Jun/2009:22:00:11 -0400] - DISCONNECT - INFO - conn=2390216 reason="unbind"
Second question is our proxy services internal and external clients. As in the example above, client connections always will go to default connection handler first and then get sent to a custom connection handler after a bind. Our default connection handler is set to use all data views (internal & external). So in the example above the first bind succeeds because it found the entry in the internal directory. The second bind fails because it searched in the external directory. Is proxy designed to send all client connections first to the default connection handler? Our default handler is ordered last on the list of handlers. My concern is that if an app id connects and gets sent to the wrong data view the bind will fail.
Thanks for any assistance.

When I check the DS log, the bind is coming across as anonymous, but when I check the DPS log, the bind is coming across as cn=bogus.
I would expect when you bind as a user that doesn't exist in the directory, you'll get an error 32. To me, this is separate than allowing anonymous binds, which we do allow.
The problem we have, is that a certain device prompts user to login, before they e-mail. They have to enter their uid, and then a password. If they enter their user id and a blank password, the DPS accepts the connection, and the client believes they are now logged in as the user specified, so their e-mail address is pulled from ldap and populated. This means anyone can spoof e-mail from anyone else. This is a relatively low level problem, in terms of e-mail spoofing, but a very large problem if you think about what other access a user could be granted. I.e. if we were using DPS to authenticate users for access to sensitive information.
When I bind using a real LDAP entry, with a blank password, dps allows the connection, and forward me to a DS. Behind the scenes, it really doing anonymous auth to the back-end DS, but the client doesn't know that. When I try and bind with a real ldap dn, and a blank password, against the DS directly, I get an error 48. My question is, why doesn't DPS issue the same error code?
BTW, I was able to use ldapsearch to bind as cn=bogus against the DPS, but not against the DS.

DPS allowing bogus binds?

I have a severity 1 ticket open with Sun support, but is there anyone out there running DPS 6.3? If so, can you test to see if you can bind to DPS as a user who doesn't exist in your ldap directory? I used the softerra ldap browser to bind as cn=bogus with a blank password, and I was able to bind to DPS and get routed to one of my back-end ldap directory servers. When I try to bind directly to the backend LDAP server, it won't work, which is what I would expect with the DPS as well.
I tried performing this same test using the standard java ldapbrowser, but that client won't allow blank passwords, so it won't work.
Thanks in advance.

When I check the DS log, the bind is coming across as anonymous, but when I check the DPS log, the bind is coming across as cn=bogus.
I would expect when you bind as a user that doesn't exist in the directory, you'll get an error 32. To me, this is separate than allowing anonymous binds, which we do allow.
The problem we have, is that a certain device prompts user to login, before they e-mail. They have to enter their uid, and then a password. If they enter their user id and a blank password, the DPS accepts the connection, and the client believes they are now logged in as the user specified, so their e-mail address is pulled from ldap and populated. This means anyone can spoof e-mail from anyone else. This is a relatively low level problem, in terms of e-mail spoofing, but a very large problem if you think about what other access a user could be granted. I.e. if we were using DPS to authenticate users for access to sensitive information.
When I bind using a real LDAP entry, with a blank password, dps allows the connection, and forward me to a DS. Behind the scenes, it really doing anonymous auth to the back-end DS, but the client doesn't know that. When I try and bind with a real ldap dn, and a blank password, against the DS directly, I get an error 48. My question is, why doesn't DPS issue the same error code?
BTW, I was able to use ldapsearch to bind as cn=bogus against the DPS, but not against the DS.

I want to upgrade my iCloud storage, but as I'm in Spain it won't accept an English card! Is there any other way to upgrade or change country??

I want to upgrade my iCloud storage, but as I'm in Spain it won't accept an English card! Is there any other way to upgrade or change country?? Please help!!!

Andy,
We are currently in the same situation as you. Seems we have been "Spoofed",,,, e-mails "TO" us and also sent "From" us.... Both to and from using our old <xxxxxx.mac.com> address. We are getting about 15 of the e-mails a day. All from some version of "Med Store",, "Great Medical Store",, "Erect Meds Cheap",, and other variations of same.... Each one has a different "Link" in the text, but we never launch them.
The amazing part is that for the past six weeks they all indicate that they originate from a different address. Some foreign and some from US addresses. So, we cannot write a "Rule" banning the originating address.
We did write a "rule" that send them to "Junk" and forwards each one to <[email protected]>.
Anyway,,,, we are ready to change our address, but are in the same "can't be done easily boat" as you.
Seems we have to start all over and establish an entirely new Apple Account. (Our old one will remain out in cyberspace forever)..... Seems strange.....
Our reluctance remains with stuff like our Calendars, Notes, iTunes, Apple Store purchases, etc......
We have posted questions here and on MacRumors, but seem to never get good answers..... Most say just "live with it" and maybe it will stop.
And like you we found out about using Alias' to late... shame on us....
Very confusing and frustrating.....Still open for any input....
Mike

"unrepairable virus detected" says MAILER DAEMON....victim of spoofing?

Arg. A few months ago my friend's email was put onto a blocklist, because it was detected that his mac was vulnerable to hackers. We went to a website where we requested his IP be removed from this blocklist, and everything started working as normal again. Well, today he received an email stating that an email (which he never sent) is being returned to him because the mailer daemon has detected an "unrepairable virus".....is this cause for major concern?!
Could he in fact have a virus? He uses an iMac 20"/1.8 Ghz (running on Panther) and purchased in March '05....could this make him more vulnerable than those of us running on Tiger with newer machines?
Is there any way to stop hackers from using his email address?
Will his IP eventually get block listed again?
Or is the mailer daemon email ITSELF A SPOOF?
aaaaaaaaaahhhhhhhhh
iMac G5 Intel Core 2 Duo 2.16 Ghz Mac OS X (10.4.8) *peace can happen*
iMac G5 Intel Core 2 Duo 2.16 Ghz Mac OS X (10.4.8)
Powermac G4 733 MHz, 512 MB Mac OS X (10.3.9)

Stanley,
Since wireless networking involves broadcasting traffic that can be intercepted by any appropriately tuned receiver within radio line of sight, I stand by my statement.
Second, you are creating a single point-of-failure for your network's security. Given the huge number of known router vulnerabilities, using the BSD-standard firewall ipfw, for which Apple has so kindly provided a user-friendly and easily-understood GUI, makes for a solid second layer of defense.
Making regular data backups and properly configuring your router are both VERY GOOD IDEAS(TM), but, even taken together, they are not "all the average person needs" with respect to computer security.
Computer security is a process. You have named two good practices in that process, but there is no single "magic" bullet that makes computers secure, not even for the average person.
-Wayne

Spoofing ?? Delete eMail without opening 'Mail'

Can I delete a specific emails without opening the 'Mail' program? A company sent me an email saying I must log in to a certain web site. I don't want to do this, and want to instead delete this message. I did manage to move it to the TRASH so I can again use Mail. But if I attempt to open TRASH to delete everything, I get this pop up window that puts me in a loop.

What you need to do to avoid reading messages that have these types of popups embedded is go to Mail > Preferences > Viewing and uncheck "Display remote images in HTML messages"; and change the configuration of your Mail window so that selecting a message does not open it in the viewing pane automatically.
To do this, open Mail, look for the horizontal bar with the dot in the middle running across the right side of the mail window and double-click it to move it to the bottom of the window. From then on, as long as that bar is positioned there, you will need to double-click a Mail message to open it, so you can delete any message without opening it or reading it.
Mulder

Junk mail filter doesn't work all the time

Why doesn't the Junk mail filter work all the time? I click on mail like from Best Buy or Omni Hotels to go into junk mail but hardly any of their mail goes into Junk. Other sites go directly to Junk. If I click on a Best Buy mail to indicate it's Junk, shouldn't that work 100% of the time forever and ever?

The Junk filter is based on an analysis of the content of the message. It ignores the sender. (Filtering based on the sender is an ineffective way of dealing with true spam, since spammers use constantly-changing spoofed addresses.)
If you don't want mail from a legitimate sender like Best Buy, unsubscribe from their ads. If that doesn't work, make a Rule to delete or move the messages.

Recently I have been unable to access our Comcast Xfinity E-mail application in Firefox. It opens but is "frozen" so that I am unable to open e-mail messages or the full inbox.

I have been using Firefox instead of MS Explorer to access our Comcast E-mail account on my Lenova laptop for several months.
Firefox was loaded onto my Lenova Laptop during mid-2011.
I continued to primarily use MS Explorer as my search engine while accessing our Comcast e-mail account until the latter part of 2011. At that time I was urged to try Firefox when I seemed to have slow processing speed in Explorer.
It worked great, and I was very pleased with the processing speed while using my e-mail application (seemed much faster than MS Explorer).
A couple weeks ago I first discovered I could not open any of the listed e-mails in the Comcast Inbox, nor am I able to expand to a full view of the inbox instead of the summary view of only the few latest new message titles. New incoming e-mails appear in the listing, but I am unable to open them from my laptop.
I have no problem with our Comcast E-mail application while using MS Explorer on my laptop (except for slower processing speed).
We also can access all Comcast e-mail functions from our Dell desktop in both Firefox and Explorer; therefore the cause of the problem doesn't appear to be Comcast.
Any suggestions on what caused this problem and how to fix it? Thanks for any help you can provide.
Danny Collins
e-mail: [email protected]

Maybe some info here for you about spoofing. (and much additional info)
http://www.thesafemac.com
Hope this helps

Spoof e-mail

Similar Messages

Maybe you are looking for