Skip to content
Register

Scam near-miss: the 'account verification' that wasn't

General Discussion by carlos2 29 replies 3.4K views
carlos2

Member OP

#1

Almost got owned yesterday. Email looked exactly like Hetzner's verification notice, same footer, same font. URL was hetzner.com — not hetzner.com. I was about to enter credentials when I noticed the MX record in the email header pointed to a mail server with no SPF alignment.

I pulled the full headers. Return-Path was spoofed but the Received chain showed an IP in a range I didn't recognize. The HTML was a pixel-perfect clone of the real login page. I checked my password manager — no matching domain. That saved me.

Which providers take XMR for verification-resistant accounts? Asking for a friend.

https://ipinfo.io

not your keys, not your coins
ronwit

Member

Budget King

#2

Carlos that is scary actually (´・ω・｀)

I got similar mail from "Contabo" last month basically almost clicked too

Check check the envelope-from and from header if they mismatch is big red flag

I use uBlock Origin basically and password manager actually saved me many times

Kaomoji comfort zone (´・ω・｀)

instant noodles, instant deploys
mediaaustin

Member

Deliverability Nerd

#3

Thanks for sharing carlos, no?

I think sspf and dkim is important, no? But many small host no have proper setup, no?

I check my server logs sometimes, see many bounce from fake verification.

Spoofing is easy when the original looks so bad, no? Some host email look like scam itself, no?

SPF, DKIM, DMARC — holy trinity ✉️
minhdock

Member

#4

Oh no~~~ this happen to me before~~~

1. I get email from "Vultr"
2. I click link
3. I see login page same same real one
4. I check URL and see vultr.com not vultr.com
5. I close very much~~~

Now I always check check domain very much~~~

Real host should send plain text email~~~ easy to verify very much~~~

mediaaustin

Member

Deliverability Nerd

#5
ronwit said:
Check check the envelope-from and from header if they mismatch is big red flag

Envelope-from is easy to spoof in a way that passes casual inspection. The real check is whether the MTA that delivered to your inbox authenticated it with SPF, and whether the signature validates under the published DKIM key. Most people do not have access to that in their mail client.

I have seen legitimate Hetzner mail fail SPF because they route through a third-party relay not in their SPF record. This makes the heuristic unreliable.

SPF, DKIM, DMARC — holy trinity ✉️
carlos2

Member OP

#6
mediaaustin said:
I have seen legitimate Hetzner mail fail SPF because they route through a third-party relay not in their SPF record.

This is why I do not trust email at all anymore. My password manager is the only source of truth. If it does not offer to fill, I do not type.

For the XMR question: I know Njalla takes it, but they are a registrar. Anyone using it for compute?

not your keys, not your coins
NO

Member

#7

Carlos2, you can pay Hetzner with XMR indirectly through their partner in Germany, but it is not native. I use a swap service and then pay in EUR. Not ideal for privacy but better than card.

The real problem is KYC on account creation. They want ID now for everything above 10 EUR.

prague1983

Member

btw I use Arch

5 #8

Prague1983 here. I run my own mail server on a Hetzner box in Falkenstein. SPF, DKIM, DMARC all aligned. The amount of phishing that targets my users pretending to be me is absurd. They do not even check if the domain has DNSSEC.

I have started greylisting everything from Gmail because their filtering is so bad that my users forward me phishing from "me" that passed SPF at Google.

oops: 0000 [#1] SMP
nerdbann

Member

DNS Propagator

#9
prague1983 said:
I have started greylisting everything from Gmail because their filtering is so bad

It is always DNS until it is email authentication, and then it is still DNS because nobody publishes their keys correctly.

I audit SPF records for clients weekly. The number of companies with 

include:_spf.google.com
and twenty other includes that blow past the 10-lookup limit is staggering. They all soft-fail and hope for the best.

ronwit

Member

Budget King

#10
mediaaustin said:
Envelope-from is easy to spoof in a way that passes casual inspection

I know I am not expert but uBlock Origin show the real URL when hover, no? And my password manager (Bitwarden) only fill if domain match exactly. So I am safe enough I think.

My Minecraft server players try to phish me with fake "Microsoft account verification" sometimes. Very funny. I send them to the real login and they stop.

instant noodles, instant deploys

Post a reply

You need an account to reply. Log in or register to join the conversation.

Post reply Preview Save draft