Ask HN: Protect loved ones from online scams?

Re:Ask HN: Protect loved ones from online scams? by frik on Saturday July 29, 2017 @05:40AM (#14880402)

Everyone knows that such spam mails are NOT sent by the company, but by scammers. Look at the raw email header.

So why is this comment on top?

It seems HN got mainstream and with it the usefulness is declining - low quality comments staying on top that can be answered by common sense.

[ Parent | on HN ]

Re:Ask HN: Protect loved ones from online scams? by nothrabannosir on Saturday July 29, 2017 @07:02AM (#14880597)

For the record, that's John Nagle:

https://en.m.wikipedia.org/wiki/Nagle%27s_algorithm

[ Parent | on HN ]

Re:Ask HN: Protect loved ones from online scams? by nl on Saturday July 29, 2017 @05:53AM (#14880429)

Generally it's good to assume that Animats knows more about how the internet works than you do, especially if it is something related to networks.

[ Parent | on HN ]

Re:Ask HN: Protect loved ones from online scams? by DanBC on Saturday July 29, 2017 @05:46AM (#14880414)

It's likely that Animats knows what he's doing.

He also says that the email contains a link to the real website, not to a scam website.

So, if it was sent by a scammer what's the purpose? How does it work?

And if it was sent by the company, why are they sending email that looks like a scam?

[ Parent | on HN ]

Re:Ask HN: Protect loved ones from online scams? by Animats on Saturday July 29, 2017 @01:15PM (#14882113)

The mail header entry at the point it leaves FedEx's systems and enters my website is:

    Received: from pvma00057.prod.fedex.com ([204.135.8.98]:61625 helo=mx28.infosec.fedex.com)
	by gator4118.hostgator.com with esmtps (TLSv1.2:ECDHE-RSA-AES256-GCM-SHA384:256)
	(Exim 4.87)
	(envelope-from <[email protected]>)
	id 1dWn4C-00092V-Dd
	for [email protected]; Sun, 16 Jul 2017 12:10:48 -0500
    DKIM-Signature: v=1; a=rsa-sha256; d=fedex.com; s=edc; c=relaxed/relaxed;
	q=dns/txt; [email protected]; t=1500225037;
	h=From:Sender:Reply-To:Subject:Date:Message-ID:To;
	bh=M2wd7ncO9bsu5aQpoaGPtLYIjzi/OkxO+5qgmnqO1D4=;
	b=ktUTxDShfkakjcLd2BEwRVC4X4ItHdPYvR+Dqyj6oiWPWrsuWA98jHqIssipCXHa
	XsPn72sxMnWIlwy0LLC3r2WGTUBHg7afy0K804QLQ2ztSHr7CnMZ4jFh0O6A9ElQ
	16twStNpiG9XBF4Gho08WHg+EUrKSnTqPwknnhOg+9BVyKZLsQhsGAk1Bl/Vgu9z
	55RxPd3VjDlAM04i+sZZaLLTX3TLA8jbMHNgZpwx01j6/whY2RVktfMYvmJZo3n9
	6XVJTcUVA3QiXb32Ps9OwGpOZQMSR0EKGrXSEUyk8YEGDZmFkZOgy6cUZBuzKRXs
	yPqdVtE4gHvuck8T5nrllg==;
    X-AuditID: cc870862-345fb700000012f5-3f-596b9e0d6fb1

That looks OK. Unless FedEx has an open mail forwarder, a break-in at "pvma00057.prod.fedex.com", or DNS trouble, that's from FedEx.

[ Parent | on HN ]

Re:Ask HN: Protect loved ones from online scams? by frik on Saturday July 29, 2017 @01:56PM (#14882277)

IP seems legit, is from FedEx - apologize.

  NetRange:       204.135.0.0 - 204.135.255.255
  CIDR:           204.135.0.0/16
  NetName:        FEDEX-2009-BLOCK
  NetHandle:      NET-204-135-0-0-1
  Parent:         NET204 (NET-204-0-0-0-0)
  NetType:        Direct Assignment
  OriginAS:       AS7726
  Organization:   FedEx (FEC)
  RegDate:        2009-07-20
  Updated:        2017-04-29
  Ref:            https://whois.arin.net/rest/net/NET-204-135-0-0-1

  OrgName:        FedEx
  OrgId:          FEC
  Address:        70 FedEx Parkway
  City:           Collierville
  StateProv:      TN
  PostalCode:     38017
  Country:        US
  RegDate:        
  Updated:        2014-06-02
  Ref:            https://whois.arin.net/rest/org/FEC

[ Parent | on HN ]