Technology | 5 Minutes Reading

Email Spoofing, Inspection, and Protection Against It!

Written By Sambita

Approved By Anuraag Singh

Published On Oct 5th, 2023

Email Spoofing is a deceptive attempt where changes in the sender’s address and other header components are done in order to misinterpret origin of the message. This technique is generally adopted by spammers as an attempt to make a message being opened by the recipient or even respond to it with the intention of information theft. For example: Emails appearing to have come from a legitimate institution like bank asking to login to account.

You know your email has been spoofed when you receive a fake email (spoofed email) from spammer, it might contain a link to spoofed website which can be of online-banking service. The false website appears to be similar like the original one and prompts for account login details (the username and password). When you enter he information, an error like “Website is Unavailable” will be reverted and during this course of time, the spammer will dishonestly steal the confidential information for illegal profits.

Why Email Spoofing is Easy for Spammers?

“An email over the internet is easy to spoof and trusting it without any strong security enhancements like Digital Signature is not a good idea. For example: An email exchanged over internet hosts uses a protocol that is a combination of simple ASCII character commands.

Using Telnet, these commands can help to connect with SMTP port of the system. This way, the receiving host trusts the sending host and the hacker easily changes its original address to a targeted address!”

The reason why email spoofing is possible and relatively simple for the spammers is the protocol used for sending emails, i.e. SMTP does not use any authentication mechanism. Header components like From, Reply-to, Return-Path, Origin-IP are forged using certain commands that make an email to have appeared from a different source than its original one. While the first three properties of header are easy to change, but the fourth one, i.e. the IP address requires special knowledge for falsifying a message.

How to Inspect a Spoofed Email?

Fake email reflects a particular behavior that normal messages don’t. Here are some of the ways that can help to identify if an email is legitimate or it is an address spoofing by spammers:

Check the Link in the Mails If an email contains a link to another website, just hover your mouse on the link and you will see the destination where the link would be directed to. If it is to a legitimate site, it would be a normal link like “https://amazon.com” but if it is a spoofed website, it will seem like “slp.clickr***#apsr###sin::us”. Also, if a site is prompting you for confidential details, check out HTTP connection with SSL which can be verified with a lock icon before “https” in the link.
Any Threat or Request If the spam email has requested to provide account login information or uses any threatening words like “failure to which your account will be permanently deactivated”, it is a sign that the message has come from illegitimate site. Plus, it is important to know that a message that has come from institutions like bank, credit card, PayPal do not confirm account details through email.

Language and Attachments If the language used in email spoofing seems to be too good to be true or have spelling mistakes, it means something is fishy. Messages with texts like “You won a Lottery”, “Win by Clicking here” are quite abnormal. Plus, attachments in the file (especially .exe, .zip, .bat) have high risk.
Missing Logo or Image in the Body If the email appears to have arrived from a commercial, educational, or financial institute, notice if the company’s logo is there is the mail. Also, if the body of fake email is a combination of images and text, then beware! Adding links to images is the most common fraudulent technique used by spammers.

fraud-message-sample

Measures to Address Spoofing

Over the time, number of methods have been developed in order to detect or track a spoofed email. SPF, DKIM, Sender ID, and DMARC are few of them.

Sender Framework Policy (SPF) is an anti-spam technique where a fake email is identified against are forging (changes in header components). Nowadays, most of the abusive messages use a fake sender address. This not only diminishes the reputation of the victim whose address is used as the sender but also wastes his time from getting the IP from the blacklist.

SPF in an internet header gives a hint about the spam email forgery of its way to target mailbox while traversing different MTAs. SPF for a domain help administrators to define as which hosts can send a mail through it by creating SPF records in the Domain Name System. When en email exchanges between two hosts, the SPF checks out if the message is being sent by host sanctioned under the domain.