Questions tagged [spoofing]
Spoofing is an activity when a person or program try to impersonates itself as another.
106
questions
0
votes
0answers
22 views
Why are these popular SMTP providers suggesting I use a subdomain?
When adding a new mail domain to my Mailgun account, I noticed a message informing me I should use a subdomain instead. Intrigued by this I clicked on the FAQ link they provided, but unfortunately it ...
0
votes
0answers
16 views
Many requests over port 445 on Ubuntu VPS, what could it mean? [duplicate]
I own a small VPS hosted by Hetzner on which i run a small Minecraft game server. The VPS is running on Ubuntu, and the only software i installed are Java JRE and the required software to run a ...
2
votes
0answers
22 views
Using DMARC techniques to block Backscatter
We run a small email (receiving not bulk sending) service (~ 300 domains or so) for our customers and are just starting to introduce DMARC. One of the reasons for doing so is to help stop backscatter ...
0
votes
1answer
47 views
How to stop Backscatter (NDR) from spoofed Mail address?
some one is sending mails from a spoofed mail account from our domain (randomname@ourdomain.com) to hundreds, sometimes thousands of non existant russian E-Mail addresses.
The web hosts send out NDRs ...
2
votes
1answer
47 views
Rewrite email (RFC822) From address to match MAIL FROM (RFC821) envelope address postfix
I'm taking steps to harden my outgoing postfix SMTP server. I want to prevent users from spoofing their sender address.
When sending email with postfix SMTP the sender is identified in three ways:
...
0
votes
1answer
59 views
Prevent from being spoofed by sendgrid
Recently we received an odd mail coming from adress1@company.com to address2@company.com
The problem is that address1 didn't send any email to address2. The email was sent using sendgrid.
Sendgrid ...
-1
votes
1answer
34 views
Make program think that it's connecting to one IP, but spoof it with another [closed]
There's program that can connect to servers, but it's limited to 6 predefined IPs (although it has ability to connect to other IPs, don't ask why and how). I can't modify it.
I need to connect to ...
0
votes
0answers
65 views
Stop spoofing emails of my own domain in my own postfix server
I am receiving spam mail from a spoofed email account in my debian postfix server. SPF checks are activated, but the messages still arrives. The SPF checker reports PASS as seen in the headers below, ...
0
votes
0answers
29 views
Is there a way to reserve a tcp port for an executable on a Linux Server?
I am designing a security policy for a server program on Linux. I wish to reserve a tcp port number-say 8888, to and only to that executable of the program to listen to. Then I could turn the program ...
-1
votes
1answer
151 views
Whats the purpose of getting daily DMARC reports from google about my Mail Server?
I've been getting DMARC reports from google everyday after setting this up on my domain to prevent domain spoofing. Do I really need to have this daily report? I've never opened the attached zip file ...
1
vote
2answers
179 views
SpamAssassin, Postfix, and Multiple Addresses in From Header
I'm working on a problem that I'm seeing with an email scanning server (MailScanner, Spamassassin, Postfix, etc.), and From header spoofing. Unfortunately, some of the versions of these components ...
1
vote
1answer
86 views
Spoofing/Spam received from GSuite alias accounts
The company currently have 2 domains registered: "dom1.com" and "dom1.com.ex". "dom1.com" is hosted and is the main domain associated on our GSuite account to create user accounts to send mails, "dom1....
1
vote
2answers
77 views
How config Exim4 to accept only authenticated sender
How can I setup Exim to accept only authenticated email from managed domain address?
I'm receiving spoofed email.. from myself.
-1
votes
1answer
52 views
DNS Spoofing in Bind9 DNS Server
I configured Ubuntu Server 18.04 as a master DNS server.
zone ==> google.com
;
; BIND data file for local loopback interface
;
$TTL 12h
@ IN SOA ns1.google.com. root.google.com. (
...
1
vote
1answer
442 views
Possibility of detecting MAC address spoofing in a decentralized network? [closed]
The paper that has been published here: https://dl.acm.org/citation.cfm?id=3282283 proposes a consensus algorithm based on distributed voting process in which it claims that it would be possible to ...
0
votes
1answer
62 views
Firewall block all but one ip spoofing
We have a server which accepts traffic coming from a few sources (ip addresses) and accept's it (using firewalld). All other traffic inbound is blocked.
How likely is the risk that somebody ...
0
votes
2answers
49 views
Redirect purely LAN communication to a different interface and port (Linux)
I have the following situation:
One interface (device) identified by an IP address of 192.168.1.x (I1) that's connecting through whatever service to another interface with IP 192.168.1.y (I2) to port (...
1
vote
2answers
379 views
Cloudflare “Access” service real security
Cloudflare Access is a new attractive feature from Cloudflare, based more or less on Google's BeyondCorp (a reverse-proxy with login which should replace VPN in accessing internal network applications)...
1
vote
1answer
262 views
RDP Server under attack; IP address used is our server address
I have setup a Windows 2016 server for remote desktop access, and installed RDPGuard to block brute force attacks. This worked well for a few days and RDPGuard blocked out a number of IP addresses.
...
-1
votes
2answers
43 views
Concerns about SPF for external provider
I´m searching for some arguments to avoid the creation of an SPF record for an external survey provider.
Example: Division inside a company (abcd) wants to send survey mails to external recipients ...
0
votes
1answer
345 views
fatal error in master.cf when restart postfix
I follow a guide to prevent spoofed emails in my mail server
first I installed postfix-policyd-spf-perl
apt-get install postfix-policyd-spf-perl
second I added this lines to the ...
-3
votes
1answer
321 views
How to prevent an openly recursive DNS server from being abused for DNS amplification [closed]
I have a business need to provide an open and recursive DNS. This DNS has of course been heavily abused by DNS amplification attacks, resulting in 5-10 Mbps sustained outbound load only caused by ...
1
vote
1answer
1k views
Iptables rules to prevent IP Spoofing
We had following below iptables rules that exist in our web front-end boxes to prevent IP Spoofing:
-A INPUT -s 255.0.0.0/8 -j LOG --log-prefix "Spoofed source IP"
-A INPUT -s 255.0.0.0/8 -j DROP
-A ...
1
vote
1answer
2k views
Is it possible to override a single domain name using dnsmasq?
I have a server application that I'm running two instances of, production and development, namely:
prod.example.com (10.0.0.1)
dev.example.com (10.0.0.2)
A third-party has written a client ...
-2
votes
1answer
1k views
How to check my network for IP spoofing availability?
I want to test if my network or even my ISP blocks spoofed IP packets. I am running a Debian Linux OS.
I found this nice tool, but it's not working on my system ..
https://www.caida.org/projects/...
0
votes
1answer
587 views
ARP spoofing on switch across subnets
Consider a switch without any VLAN's defined with 2 subnets configured. Is it possible to ARP spoof from one subnet to another?
According to Evans reply in What are the implications of having two ...
-3
votes
1answer
193 views
TLS auth issue: 'CompanyA@exmple.com “via” SendGrid.me' email is dropped by Exchange [closed]
Looking for clarification about what this Exchange 2007 Management Shell (Powershell) command does and how it affects TLS at the Receive Connector: ms-exch-smtp-accept-authoritative-domain-sender
...
0
votes
2answers
362 views
Change the domain in the 'via' that Gmail shows as the result of a wrong SPF record
So I have a small Linux webserver, it is running the Direct Admin control panel and everything is working fine. For each domain, SPF and DKIM records are present in the DNS and mail is (as far as I ...
0
votes
0answers
437 views
Exchange 2013 -Prevent Spam emails from outside but with my internal domain name
my apologies if this question was asked and answered previously.
we have Exchange 2013 email server. We have been seeing some of the emails are coming from outside but using our own domain name which ...
2
votes
1answer
1k views
Checking SMTP headers for spoofed email (did client authenticate?)
I have been using rackspace email service, and I am finding that rogue emails are seemingly coming from harry@mydomain.com to james@mydomain.com but were never actually sent by that user.
As per ...
3
votes
1answer
761 views
Exchange not checking SPF record for own domain
I have an interesting issue with Exchange where it appears to check and stamp spoofed messages from external domains but not ones it has setup to send from. For example I can spoof a message from 1@...
5
votes
1answer
15k views
How can I prevent spoofed emails from outside thats using my internal accepted domain
I'm receiving spam emails sent from my own domain to my own domain. I'm using Exchange 2013.
Example:
myemail@mydomain.com is being used to send spam to myemail@mydomain.com.
I can successfully ...
0
votes
1answer
488 views
Spoofing a duplicate MAC address on an interface not connecting to the network where the original MAC is
I'm trying to run a PHP project on a test server.
The project uses an internal framework that has been modified so it will only run on the production server by checking the MAC address in eth0, and ...
2
votes
1answer
120 views
Using SPF for spoof protection
I'm trying to work through properly configuring SPF for my domain. We have two MX servers that only receive mail, and two outbound relay servers which we expect to list in our SPF record.
We also ...
0
votes
1answer
669 views
What will happen in a network if multiple devices have the same MAC address? [closed]
What will happen in something like a wifi connection where different laptops are set with the same MAC address .
To make it more interesting what will happen if there are multiple devices with same ...
0
votes
4answers
4k views
Setting up an SPF record for a shared hosting service with lots of email gateways
My website is on a Hostgator shared host, and I need to set up SPF for my email so my outgoing emails won't get bounced. So, I have to add a TXT record to the DNS for my domain, listing all possible ...
1
vote
0answers
104 views
How can I reject mails coming from a fake domain or a fake user in a real domain?
I have an exchange server 2010 recently installed and I receive a test with 3 step to check the security of my server. below the test
Check if my server receive from fake domain.
Check if my server ...
1
vote
1answer
800 views
Prevent IP Spoofing on OpenVPN tun
I have a question regarding IP Spoofing and authentication. I have an OpenVPN server in TUN mode with many untrusted clients in the same VPN network, and I was wondering if one client is able to spoof ...
-2
votes
1answer
70 views
Is it possible to make me send an email by opening a malicious email? [closed]
I know I don't have much info on this problem/question so I will delete if everyone downvotes or votes to close/delete.
Is it possible for someone to make an email look like I sent it simply by me ...
1
vote
0answers
276 views
Email Spoofed From Exchange Server
One of my exchange users got an email that bounced back to them. They did not send the email and I'm a little confused at how they got it. I looked through the logs and do not see the email leaving ...
-1
votes
2answers
54 views
Can a DNS server (specified by its IP address) be spoofed?
When a DNS server is specified (in my case in OS X, in the Network Preferences), can it be spoofed (for instance by an organization with the power of a government)?
I am asking the question because ...
-2
votes
1answer
328 views
Can I use ASA5505 to spoof the reply to a heartbeat request?
I have a CISCO ASA 5505 in a home office. It has two subnet, public and private. There is a wifi belkin router on the private net, which provides wifi for some users. That belkin router sends out ...
3
votes
1answer
1k views
Dovecot Sieve allows spoofing through LMTP
I have set up Postfix to block spoofing your email (you can only send emails as yourself):
smtpd_sender_restrictions =
reject_authenticated_sender_login_mismatch
I have set up Sieve and ...
-1
votes
1answer
119 views
What use are systems that ban IP addresses if all the evildoers spoof them anyways
Many anti-spam or web applications with a security component give the ability to ban IP addresses. In my experience any bot, person or other entity that is truly nefarious is using an endless supply ...
1
vote
1answer
2k views
Any way to block IP address host header spoofing?
I have already added the following the following to my nginx config to deal with spoofed domains:
if ($host !~* ^(.*example.org|\d+\.\d+\.\d+\.\d+)$ ) {
return 444;
}
Right now ...
0
votes
0answers
2k views
How To Stop Cisco ASA Spoof Attack
I have thousands of "Deny TCP reverse path check from 10.60.60.X to 10.60.6X.X on interface outside"
The IP addresses for the source and destination hosts are all over the board, and the interface is ...
0
votes
1answer
331 views
Brute force attacks with server's IP
I am running a Debian wheezy server with fail2ban installed, everything works as expected but recently my own server got banned. I added the server's IP in the exception row and it seems to work, but ...
3
votes
2answers
3k views
Wrong DNS answer with CNAME and A Record at the same time
We had a customer which has set a CNAME Record for his domain. Somehow he managed it to set an A Record too, which should be not possible and is forbidden by DNS. But the result was:
$ dig @ns1.your-...
7
votes
1answer
6k views
Does postfix reject spoofed senders?
Is there a reliable way to reject incoming mails with a spoofed e-mail address?
What kind of checks does postfix run normally on incoming mails?
does postfix check the reverse dns by default?
does ...
0
votes
1answer
39 views
how to discourage email spoofing
One of my production server emails look like to be spoofed from another network.
The team (group or individual or professional company) is sending mass mails out to their list of users, using our ...
