How to know how it's an fake email?

[Joopie]

Hello,

I see and hear allot of posts and talks about an kind of weird subject.

I mean the `Is this mail real or not?` talk.

But you're automatich think `it's real omfg`.
But i'll show you how easy it can be to send an mail with an others email account.

For example:

You see, olga.sancherz@sulake.com sended it to me....... you think.

But wrong, with an simple php script it allows you to edit the headers so the mail can look like it's being sended from an sulake employee.

PHP: *Script taken from php.net - mail*

<?php
    $to      = '*My email is secrect witch*';
    $subject = 'Lol whut';
    $message = 'This is an facke message';
    $headers = 'From: olga.sanchez@sulake.com' . "\r\n" .
        'Reply-To: olga.sanchez@sulake.com' . "\r\n" .
        'X-Mailer: PHP/' . phpversion();
    
    mail($to, $subject, $message, $headers);
?>

As you can see I edited the header `from and reply-to` so it might look like it's from sulake.

Their are maby also more examples of how to-do it.

Now I explained how it works, I'm going to tell you how to check it.

Just look at the full headers.

The own of the example will look something like this:

Return-Path: <*****@*****.**>
Delivered-To: *****@*****.**
[COLOR=#ff0000]Received: from mx-c.one.com (mx-c.one.com [91.198.169.50])[/COLOR]
        by mail24.b-one.net (Postfix) with ESMTP id B3DC4280CC05
        for <*****@*****.**>; Tue, 15 May 2012 17:57:43 +0200 (CEST)
X-Virus-Scanned: by one.com
X-Greylist: whitelisted by SQLgrey-1.8.0-rc2
Received: from mail-out2.b-one.net (mail-out2.one.com [91.198.169.19])
        by mx-c.one.com (Postfix) with ESMTP id 881AD151C173
        for <*****@*****.**>; Tue, 15 May 2012 15:57:43 +0000 (UTC)
Received: from localhost.localdomain (srv83.one.com [193.202.110.83])
        by mail-out2.b-one.net (Postfix) with ESMTP id 700445082
        for <*****@*****.**>; Tue, 15 May 2012 17:57:43 +0200 (CEST)
Received: from ***.***.***.*** by *****.*****.** via /someshit/mailtest.php with HTTP; Tue, 15 May 2012 15:57:43 +0000
To: *****@*****.**
Subject: Lol whut
X-PHP-Originating-Script: 444090:mailtest.php
From: olga.sanchez@sulake.com
Reply-To: olga.sanchez@sulake.com
X-Mailer: PHP/5.3.10
Message-Id: <20120515155743.700445082@mail-out2.b-one.net>
Date: Tue, 15 May 2012 17:57:43 +0200 (CEST)

As you can see, their is allot of information sended with an email.
But what my eyes first catched up is the domain names.
It defendly doesn't look like the one of sulake.
That's one!

Other thing you can do is checking the first `received` ip this case:

[COLOR=#ff0000]Received: from mx-c.one.com (mx-c.one.com [91.198.169.50])[/COLOR]

With an simple `ip look up` you can easily find out where it's send from.

You must be registered to see links

It's not that hard to search if it's actually right.
But if you still not sure, you can ring sulake, but bewared: by ringing them and they say they haven't mail you they might suspect something.
You don't call them for nothing...

Hope you guys learned from it.

Kind regards

- Joopie

 

[BadBehaviour]

How can you send fake emails lol

 

[LHaZze]

How can you send fake emails lol

People do it all the time, sometimes to get passwords and etc, but in this case it would be to shut down a Hotel, less hotels more money. People will do anything these days. What happened to the violence!

 

[DeliriousCoder]

Ask a moderator to move this to /f333

 

[Shredinator]

I see you're using one.com - don't. They'll rape you sooner or later.

 

[Joopie]

I see you're using one.com - don't. They'll rape you sooner or later.

After 4 years? Lol...And for the record, i dont run a hotel ....

Ask a moderator to move this to /f333

Why that?, i dont ask help? :/

How can you send fake emails lol

Read the thread and you know it.

 

[Liam]

It's good that you've defined that emails from sulake can be fake or not, it would be best to just reply to the sender asking if they recently sent you an email. But they have to have written information to close down a website, in witch means a letter in the mail from your host or from Sulake. And, sulake always adds there logo at the top of each message, and has professional writing, not sloppy short writing.

 

[Bui]

I don't get the moral of this thread... you're saying we can check if a mail is fake by looking at the sender's IP/host in the headers?

 

[Joopie]

I don't get the moral of this thread... you're saying we can check if a mail is fake by looking at the sender's IP/host in the headers?

Yep as sulake use their own mailserver

 

[Bergthor]

Easy,

You must be registered to see links

.