A spoofed message can appear to be sent from a coworker, a bank, a family member, or any number of seemingly trustworthy sources. A good spoof is quite convincing and will look like any other email that you would normally receive. This is why email phishing remains one of the leading causes of business email compromises along with social engineering attacks.<\/p>\n
![\"suspicious](\"https:\/\/www.thexyz.com\/blog\/wp-content\/uploads\/this-is-suspicious7.png\")
<\/p>\n
What are the reasons why people spoof email?<\/h3>\n
An email is usually spoofed as part of a phishing attack or spear-phishing campaign targeted towards specific employees of an organization.<\/p>\n
A spoofed email may also be used to dishonestly market an online service or sell you a product that turns out not to be real. The goal of the email is to trick the recipient into making a damaging statement or releasing sensitive information, such as a password through malicious links. If for example, you’re receiving bounced emails returned to you for messages that you did not send, this could be the result of a spoofing attack on your email service.<\/p>\n
How to Identify a spoofed message<\/b><\/h3>\n
It is imperative that all email users understand that emails that appear to be sent from colleagues or friends can possibly be forged emails. This is the case when scammers will alter different sections of an email to disguise who the actual<\/em> sender of the message is.<\/p>\n When a user receives an email, they may be able to recognize an email spoofing attempt by hovering over the sender’s email address to see it in fact the expected email address. With some devices or email clients, this level of diligence may not be sufficient to view sender addresses and it will be necessary to open the email headers<\/strong><\/a> of a message to view data on email protocols and\u00a0email authentication via simple mail transfer protocol (SMTP).<\/span><\/span><\/p>\n Examples of properties with the email that are spoofed:<\/p>\n FROM<\/strong> boss@companyexample.com <\/a>(This will appear to come from a legitimate source on any spoofed message and may make it through spam filters on the receiving server)<\/p>\n REPLY-TO<\/strong> This can also be spoofed, but a lazy scammer will leave the actual REPLY-TO<\/strong> address. If you see a different sending address here, the email may have been spoofed.<\/p>\n RETURN-PATH<\/strong> This can also be spoofed, but a lazy scammer will leave the actual RETURN-PATH<\/strong> address. If you see a different sending address here, the email may have been spoofed.<\/p>\n SOURCE IP<\/strong> address or \u201cX-ORIGIN\u201d address. This is typically more difficult to alter but it is possible to alter the IP of the mail server to another internet service<\/span>.<\/p>\n These first three properties can be easily altered by using settings in your Microsoft Outlook, Gmail, Hotmail, or other email software. The fourth property above, IP address, can also be altered, but usually requires more sophisticated user knowledge to make a false IP address convincing on a SMTP server (simple mail transfer protocol).<\/p>\n <\/p>\n In this example, it appears that the recipient has received a message from their office assistant, requesting money. The subject<\/strong> line should alert you immediately that it is in fact a spam email. This user should contact their assistant through another form of communication to confirm that they did not send this message. Next, you will want to discover who actually sent the message by opening the message headers.<\/p>\n <\/p>\n From:<\/strong> field shows the message being sent from “Assistant” assistant@yourdomainexample.com<\/a><\/strong>. However, we can also see that the<\/p>\n REPLY-TO:<\/strong> field lists spoofer@scam.com<\/a><\/em>. That is a clear cut example of a spoofed message. You will want to Blocklist any address you find in the<\/p>\n REPLAY<\/b> RETURN-PATH<\/strong>, and SOURCE IP<\/strong> field that is not an address\/IP you normally receive mail from. For more information on viewing and understanding email headers, please see View email headers in Webmail.<\/a><\/p>\n Even with strong email security, the first line of defense against this abuse is user education, If a user receives a spoofed message, please advise them to do the following.<\/p>\n Spoofing is possibly the most frustrating abuse issue to deal with, simply put, because domain spoofing cannot be stopped. It doesn’t matter where you host your email, as all email users are potentially vulnerable to spoof attacks, whether you host email with Thexyz, Office 365, Google Workspace etc.\u00a0\u00a0<\/p>\n Spoofing is similar to hand-writing many letters and signing someone else’s name to it. This makes tracing or tracking the activity extremely difficult.<\/p>\n If you are an individual and looking to report an abusive email, we recommend reporting email abuse<\/a>. Our anti-abuse specialists will process the complaint and take the necessary remediation steps. We take email security seriously and are always happy to discuss best practices for avoiding spam.<\/p>\n [\/et_pb_text][\/et_pb_column][\/et_pb_row][\/et_pb_section]<\/p>\n<\/span>","protected":false},"excerpt":{"rendered":" Email spoofing comes from the word spoof, which is basically another word for falsified. An email has been spoofed when the sender deliberately alters parts of the email to make the message appear as though the email sender, sends emails as someone else. Usually, a spoofed email address will contain personal information such as the […]<\/p>\n","protected":false},"author":1,"featured_media":969,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_et_pb_use_builder":"on","_et_pb_old_content":"Email spoofing comes from the word spoof<\/strong>, which is basically another word for falsified<\/strong>. An email has been spoofed when the sender deliberately alters parts of the email to make the message appear as though it was composed and sent by someone else. Usually this is the sender\u2019s name or email address and the body of the message are formatted to appear as if they are from a legitimate source.\r\n\r\nA spoofed message can appear to be sent from a coworker, a bank, a family member or any number of seemingly trustworthy sources. A good spoof is quite convincing and will look like any other email that you would normally receive.\r\n\r\n[box type=\"warning\"] Warning: If you suspect you have received a fraudulent message DO NOT click any link in the message or enter any information that is requested.[\/box]\r\n![\"Sender](\"https:\/\/www.thexyz.com\/blog\/wp-content\/uploads\/sender-discrepancies.png\")
<\/p>\n![\"Email](\"https:\/\/www.thexyz.com\/blog\/wp-content\/uploads\/email-spoof-assistant.png\")
<\/p>\n![\"Pointing](\"https:\/\/www.thexyz.com\/blog\/wp-content\/uploads\/email-spoof-example.png\")
<\/p>\nHow to fight email spoofing<\/h3>\n
\n
What are the reasons behind why people spoof email?<\/h3>\r\nAn email is usually spoofed as part of a phishing attack\r\n\r\nA spoofed email may also be used to dishonestly market an online service or sell you a product that turns out not to be real. The goal of the email is to trick the recipient into making a damaging statement or releasing sensitive information, such as a password. If for example you're receiving bounced email returned to you for messages that you did not send, this could be the result of spoofing.I\r\n
How to Identify a spoofed message<\/b><\/h3>\r\nIt is imperative that all email users understand that emails that appear to be sent from colleague's or friends can possibly be forged emails. This is the case when scammers will alter different sections of an email to disguise who the actual<\/em> sender of the message is.\r\n\r\nA user may be able to recognize a email spoofing attempt by hovering over the senders email address to see it in fact the expected email address. With some devices, this level of diligence may not be sufficient and it will be necessary to open the email headers<\/strong> of a message.\r\n\r\nExamples of properties with the email that are spoofed:\r\n\r\nFROM<\/strong> boss@companyexample.com<\/a>(This will appear to come from a legitimate source on any spoofed message)\r\n\r\nREPLY-TO<\/strong> This can also be spoofed, but a lazy scammer will leave the actual REPLY-TO<\/strong> address. If you see a different sending address here, the email may have been spoofed.\r\n\r\nRETURN-PATH<\/strong> This can also be spoofed, but a lazy scammer will leave the actual RETURN-PATH<\/strong> address. If you see a different sending address here, the email may have been spoofed.\r\n\r\nSOURCE IP<\/strong> address or \u201cX-ORIGIN\u201d address. This is typically more difficult to alter but it is possible.\r\n\r\nThese first three properties can be easily altered by using settings in your Microsoft Outlook, Gmail, Hotmail, or other email software. The fourth property above, IP address, can also be altered, but usually requires more sophisticated user knowledge to make a false IP address convincing.\r\n\r\n
\r\n\r\n\u00a0\r\n\r\nIn this example, it appears that the recipient has received a message from their office assistant, requesting money. The subject<\/strong> line should alert you immediately. This user should contact their assistant through another form of communication to confirm that they did not send this message. Next, you will want to discover who actually sent the message by opening the message headers.\r\n\r\n\r\n\r\n\u00a0\r\n\r\nFrom:<\/strong> field shows the message being sent from \"Assistant\" assistant@yourdomainexample.com<\/a><\/strong>. However, we can also see that the\r\n\r\nREPLY-TO:<\/strong> field lists spoofer@scam.com<\/a><\/em>. That is a clear cut example of a spoofed message. You will want to Blacklist any address you find in the\r\n\r\nREPLAY<\/b> RETURN-PATH<\/strong>, and SOURCE IP<\/strong> field that is not an address\/IP you normally receive mail from. For more information on viewing and understanding email headers, please see View email headers in Webmail.<\/a>\r\nHow to fight email spoofing<\/h3>\r\nThe first line of defense against this abuse is user education, If a user receives a spoofed message, please advise them to do the following.\r\n
\r\n \t