What really irks me is getting an email like this:
Shipping account suspended
Dear XXXX,
FedEx shipping privileges for account number ending in NNNN
have been suspended. To access and update your credit card
data, log in to FedEx® Billing Online.
Log in today (Button)
This just screams "scam", especially since I haven't used the FedEx account in months. When I log into FedEx (not using the link in the email), my account shows a zero balance and no outstanding messages. So I send the email, with headers, to "abuse@fedex.com". (They never answered.)
I call FedEx Revenue Services, and they can't find anything wrong with the account. They tell me the account isn't suspended. They want the expiration date on my credit card updated before the end of the month, but it hasn't expired yet.
I look at the message source, and it looks like it's really coming from FedEx, and the link really goes to FedEx. I keep looking, and can't find anything wrong in the headers. It's a legit email. It's just stupidity at FedEx.
Sloppy work, FedEx, sending out an email like that. You're training people to click on links they should not click on.
I got a similar dodgy looking email from Dell. It was from some different e-mail address (dellteam.com instead of dell.com). It was a failed transaction.
The email was completely dodgy, had several typos. There was a lack of instructions on what to do, just a "please contact us". I tried to contact customer service instead of the representative, but it was impossible because I needed an order code, which they never gave me. Emails to the individuals were never replied to and he insisted on only calling and handling a bank transfer over the phone.
The whole situation was very similar to a man in the middle attack.
It turned out to be legit, but the whole situation makes me never want to order anything from them again.
I've made the same complaint, "you're training people to click on links," to I-forget-who. "Your security is important to us, and we'll send that directly to the crickets."
Either the people you are able to contact don't care, because they have no idea what you're talking about, or they don't care because they wrote/required exactly what you're complaining about, out of expediency or ignorance.
However you can still check the IP address of the mail server that sent the mail. Some things to look at:
1. Check PTR for IP and verify that the A or AAAA record for that name points back to the same IP.
2. Compare with IP address of server that sent previous mail to you.
3. Check SPF records for the domain.
4. Check MX records for the domain. Keep in mind that they might be using different servers for sending than for receiving though and that MX is for receiving.
With SPF, DKIM, DMARC, coupled with blacklists and the reputation system of big mail providers that's making it difficult to host your own email, it's actually quite to impersonate an email address.
Try it, then see how many times you can hit a @gmail address.
I found that this does not stop one from sending emails that appear to originate from addresses like info@paypal.com as long as the contents of the email are different from known spam emails. They are not flagged by GMail at all as long as you send them from a reputable email server through services like mailgun.com.
One possibility is the "Hostile Subdomain Takeover" attack recently mentioned here, where an attacker could have control of, say, help.fedex.com https://news.ycombinator.com/item?id=14860149
I call FedEx Revenue Services, and they can't find anything wrong with the account. They tell me the account isn't suspended. They want the expiration date on my credit card updated before the end of the month, but it hasn't expired yet.
I look at the message source, and it looks like it's really coming from FedEx, and the link really goes to FedEx. I keep looking, and can't find anything wrong in the headers. It's a legit email. It's just stupidity at FedEx.
Sloppy work, FedEx, sending out an email like that. You're training people to click on links they should not click on.