3 ms·
How do they spoof emails to not trigger any spam filter? I know you can change the headers but I thought email providers protected against that
by nabakin 4y ago
How do they spoof emails to not trigger any spam filter? I know you can change the headers but I thought email providers protected against that
- tlogan 4y agoI think this is a valid invoice created in PayPal. I assume you can do the same with Stripe, Quickbooks, etc.
- ryan-c 4y agoDKIM signed emails from PayPal are treated favorably by spam filters. The sample I reviewed had been set to an account belonging to (or compromised by) the scammer, modified slightly, and BCC'd to the victim. Specifically, a Reply-To header was added - PayPal does not assert non-existence of a reply-to header in their DKIM signature, and the entire point of BCC is that it doesn't have a header. Thus, these emails can be relayed to any target, and the scammer can choose any reply-to address they like, and the DKIM signature will still be valid. If anyone has samples and can send me them with full headers, I would be very interested to examine more. I have a public email address in my HN profile.
- bcrescimanno 4y agoThe emails are not spoofed. They are actually generated by PayPal to notify an account holder of an invoice. The vast majority of the emails that these systems generate are legitimate emails with legitimate invoices. The vector here is: 1. Create a PayPal account. 2. Create an invoice through PayPal's invoice tool and send to nabakin@example.com. 3. PayPal sends an email to notify the recipient of the outstanding invoice. When PayPal detects fraudulent invoices are generated, they cancel those invoices so consumers no longer see them and can no longer pay on them; however, it's too late to stop the emails.