Topic: A public service announcement: spotting phishing emails (Read 1545 times)

I got my first dodgy bitcoin related email yesterday claiming to be from 'coin base'...  I've never even used it -_-

If you think that's over the top, you're in denial.

It's probably not even close to being sufficient, given the completely broken state of PC security.

Wow. OTT much?

I've stopped using my desktop PC as one for all practical purposes.

My desktop PC is now a virtualization host, and every task actually takes place in one of nine VMs.

One VM runs Thunderbird, and nothing else. It's firewalled such that it can't do anything at all except access one designated SMTP/IMAP server.

THAT is vigilance!

I no longer open emails from any coin related sites that I use.  The subject lines are usually detailed enough that if I deem it important I will just navigate to the site directly myself.

D&T, I got my first phishing email into my gmail account since I can't remember. It appears to ask me to login to my blockchain.info but actually redirects to blockschain.info
Careful everyone the wolves are out to play!
FF
PS. I'm going to rebuild my Linux dev box and thunderbird the details into a separate thread.
PPS. keep up the vigilance!
 

I got this email today and here is how it shows up in gmail


One thing to look for is this

what this is saying is the email was sent indicating it was sent from btc-e.com however it actually came from smtp.com.  Now that this isn't that uncommon many sites move their email off their domain however there is a way of authenticating these off email domains and it wasn't done.

So any time you see a "via" in gmail be wary.  There is a high chance it is a phishing attempt.  It could be an uneducated operator or some misconfiguration but your phishing radar should be going off when you see a redirected email.

Looking at the source

A couple of things in here.  The first is that the sent from and reply to emails are simply lines of text.  There is absolutely no security.  You can send email with a from email address of [email protected] as easily as you can type the letters.  So never rely on those.

This show where the email actually originated from

now as I said before it isn't that uncommon for email to originate off domain however this is the warning sign

In simple terms it is saying btc-e has not approved the originating server to send email on its behalf.  Google should really make these types of "soft" failures more pronounced with scary warnings but they don't.

Lastly the actual originator is a commercial service.  They provided this information in the header

If your email client gives you the option to report as phishing (not just report as spam) be sure to do so.  Most will forward this back to in this case to [email protected].
You can also manually forward it to [email protected] and report it is phishing.