News for hackers. Stuff that matters.

A comment on Ask HN: Protect loved ones from online scams?. Parent comment

Re:Ask HN: Protect loved ones from online scams? by DanBC on Saturday July 29, 2017 @05:46AM (#14880414)
It's likely that Animats knows what he's doing.

He also says that the email contains a link to the real website, not to a scam website.

So, if it was sent by a scammer what's the purpose? How does it work?

And if it was sent by the company, why are they sending email that looks like a scam?

[ Parent | on HN ]
Re:Ask HN: Protect loved ones from online scams? by Animats on Saturday July 29, 2017 @01:15PM (#14882113)
The mail header entry at the point it leaves FedEx's systems and enters my website is:

    Received: from pvma00057.prod.fedex.com ([204.135.8.98]:61625 helo=mx28.infosec.fedex.com)
	by gator4118.hostgator.com with esmtps (TLSv1.2:ECDHE-RSA-AES256-GCM-SHA384:256)
	(Exim 4.87)
	(envelope-from <[email protected]>)
	id 1dWn4C-00092V-Dd
	for [email protected]; Sun, 16 Jul 2017 12:10:48 -0500
    DKIM-Signature: v=1; a=rsa-sha256; d=fedex.com; s=edc; c=relaxed/relaxed;
	q=dns/txt; [email protected]; t=1500225037;
	h=From:Sender:Reply-To:Subject:Date:Message-ID:To;
	bh=M2wd7ncO9bsu5aQpoaGPtLYIjzi/OkxO+5qgmnqO1D4=;
	b=ktUTxDShfkakjcLd2BEwRVC4X4ItHdPYvR+Dqyj6oiWPWrsuWA98jHqIssipCXHa
	XsPn72sxMnWIlwy0LLC3r2WGTUBHg7afy0K804QLQ2ztSHr7CnMZ4jFh0O6A9ElQ
	16twStNpiG9XBF4Gho08WHg+EUrKSnTqPwknnhOg+9BVyKZLsQhsGAk1Bl/Vgu9z
	55RxPd3VjDlAM04i+sZZaLLTX3TLA8jbMHNgZpwx01j6/whY2RVktfMYvmJZo3n9
	6XVJTcUVA3QiXb32Ps9OwGpOZQMSR0EKGrXSEUyk8YEGDZmFkZOgy6cUZBuzKRXs
	yPqdVtE4gHvuck8T5nrllg==;
    X-AuditID: cc870862-345fb700000012f5-3f-596b9e0d6fb1
That looks OK. Unless FedEx has an open mail forwarder, a break-in at "pvma00057.prod.fedex.com", or DNS trouble, that's from FedEx.
[ Parent | on HN ]
Re:Ask HN: Protect loved ones from online scams? by frik on Saturday July 29, 2017 @01:56PM (#14882277)
IP seems legit, is from FedEx - apologize.

  NetRange:       204.135.0.0 - 204.135.255.255
  CIDR:           204.135.0.0/16
  NetName:        FEDEX-2009-BLOCK
  NetHandle:      NET-204-135-0-0-1
  Parent:         NET204 (NET-204-0-0-0-0)
  NetType:        Direct Assignment
  OriginAS:       AS7726
  Organization:   FedEx (FEC)
  RegDate:        2009-07-20
  Updated:        2017-04-29
  Ref:            https://whois.arin.net/rest/net/NET-204-135-0-0-1

  OrgName:        FedEx
  OrgId:          FEC
  Address:        70 FedEx Parkway
  City:           Collierville
  StateProv:      TN
  PostalCode:     38017
  Country:        US
  RegDate:        
  Updated:        2014-06-02
  Ref:            https://whois.arin.net/rest/org/FEC
[ Parent | on HN ]