Questions tagged [spoofing]

Spoofing is an activity when a person or program try to impersonates itself as another.

Filter by
Sorted by
Tagged with
0 votes
0 answers
18 views

smpp requires a persistent connection. will ip spoofing work?

usually connecting to external SMPP gateway requires IP whitelisting. recently, there were some SMS sent without SMPP record (that was without our submission). I worried if our IP was spoofed. since ...
user avatar
0 votes
0 answers
13 views

Prevent FING / network scan on router level

I connect 20+ phones on the same wifi. I use each with a different VPN connection (android) I see a network scan can leak when pining the whole subnet. Is there a router settings to avoid discovery on ...
user avatar
  • 101
0 votes
1 answer
57 views

How to hide restricted nginx subdomains?

To hide a restricted location, e.g. location /secret/ { allow 10.0.0.0/24; deny all; } one could set error_page 403 =404 /404.html; error_page 404 /404.html; to make impossible to distinguish a ...
user avatar
  • 15
0 votes
0 answers
20 views

How to hide restricted nginx subdomains?

To hide a restricted location, e.g. location /secret/ { allow 10.0.0.0/24; deny all; } one could set error_page 403 =404 /404.html; error_page 404 /404.html; to make impossible to distinguish a ...
user avatar
  • 15
-1 votes
2 answers
91 views

Prevent spoofing - SPF, DKIM, DMARC in place

I am just a developer handling this issue for our small organization, so apologies in advance if I have missed anything obvious. We use Rackspace Cloud as our email provider. Our emails started going ...
user avatar
  • 99
1 vote
2 answers
59 views

How to block spoofed mail from *.host.com

I'm currently running a centOS server with directadmin and custombuild. I keep getting spoofed phishing mails with spoofed from addresses that have SPF setup properly. Spamassassin gives it a score 1....
user avatar
0 votes
1 answer
244 views

Server IP spoofed and attacking

I have a server that has been reported as an attacker since January, finally today I found some information about these attacks, however none of the logs on my server shows anything similar. As a ...
user avatar
0 votes
0 answers
314 views

Allowing Messages from IP Address DMARC

I'm still learning infrastructure stuff and need to ask a question which relates to DMARC. A user in the organisation has an app which is sending marketing messages to staff within the business. The ...
user avatar
0 votes
1 answer
327 views

iptables and SNAT spoofing

So we are working with iptables at class and I've been testing some rules in the NAT table. As far as I know SNAT changes the IP source of a packet to which the rule dictates but what I tested does ...
user avatar
  • 1
1 vote
2 answers
152 views

Possibilities to protect network traffic in datacenter without adding much latency

I am looking for possibilities (and their pros and cons) for protecting network traffic of the components of a a time-critical application in a data center. The aim is minimizing the damage an ...
user avatar
  • 5,127
0 votes
3 answers
207 views

Preventing a Large Number of Failed Login Attempts from FAKE SPOOFED IPs?

My system log file (/var/log/auth.log) is showing hundreds and hundreds of different IP's trying to log into my system. How can I prevent all these attacks? It looks like all the IP addresses are ...
user avatar
  • 101
0 votes
0 answers
157 views

It's 2020, is it still implausible to set up a "secure" open resolver?

In reference to this question, last updated five years ago. I'm interested in setting up a public DNS server as a personal project, but I'm aware that open resolvers make it extremely easy to amplify ...
user avatar
  • 101
2 votes
2 answers
7k views

Googlecast SSDP and MDNS queries on network despite not having any chromecast applications installed in main computer

As title states, Ive detected some MDNS queries from a googlecast address, which is strange since i don't have any googlecast apps or similar installed. Additionally My PC is sending SSDP packets to ...
user avatar
  • 23
0 votes
1 answer
480 views

first step to combat display name spoofing on postfix

lately we receive a lot of display name spoofed emails in our company, impersonating customers and suppliers. Since my co-workers unfortunately do not pay too much attention to security warnings, etc. ...
user avatar
0 votes
2 answers
82 views

What is the point of a bot spoofing various ancient user agents while "GET / HTTP/1.1"?

I found the following interesting traffic in my apache log: 213.159.213.236 - - [16/Dec/2019:03:02:03 -0500] "GET / HTTP/1.1" 200 3797 "-" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; FSL 7.0....
user avatar
  • 103
0 votes
1 answer
869 views

How to use my router's Mac Address on Pfsense installed on Esxi

My ISP bind my router's Mac address so only this router can connect to their pppoe server, now I want to connect it on Pfsense installed on Esxi for better configuration options but pppoe server is ...
user avatar
  • 113
0 votes
0 answers
24 views

Outlook Inbox after spoofing attack is empty. Incoming mails not coming through in Inbox

Supposedly, a spoofing mail was sent to a internal and hundreds of external people from our user's account last Wednesday. Since Friday afternoon, her Outlook Inbox is shown empty and she is not able ...
user avatar
  • 1
0 votes
0 answers
27 views

Why are these popular SMTP providers suggesting I use a subdomain?

When adding a new mail domain to my Mailgun account, I noticed a message informing me I should use a subdomain instead. Intrigued by this I clicked on the FAQ link they provided, but unfortunately it ...
user avatar
0 votes
0 answers
18 views

Many requests over port 445 on Ubuntu VPS, what could it mean? [duplicate]

I own a small VPS hosted by Hetzner on which i run a small Minecraft game server. The VPS is running on Ubuntu, and the only software i installed are Java JRE and the required software to run a ...
user avatar
3 votes
0 answers
130 views

Using DMARC techniques to block Backscatter

We run a small email (receiving not bulk sending) service (~ 300 domains or so) for our customers and are just starting to introduce DMARC. One of the reasons for doing so is to help stop backscatter ...
user avatar
0 votes
1 answer
1k views

How to stop Backscatter (NDR) from spoofed Mail address?

some one is sending mails from a spoofed mail account from our domain (randomname@ourdomain.com) to hundreds, sometimes thousands of non existant russian E-Mail addresses. The web hosts send out NDRs ...
user avatar
  • 21
2 votes
1 answer
821 views

Rewrite email (RFC822) From address to match MAIL FROM (RFC821) envelope address postfix

I'm taking steps to harden my outgoing postfix SMTP server. I want to prevent users from spoofing their sender address. When sending email with postfix SMTP the sender is identified in three ways: ...
user avatar
2 votes
1 answer
2k views

Prevent from being spoofed by sendgrid

Recently we received an odd mail coming from adress1@company.com to address2@company.com The problem is that address1 didn't send any email to address2. The email was sent using sendgrid. Sendgrid ...
user avatar
-1 votes
1 answer
46 views

Make program think that it's connecting to one IP, but spoof it with another [closed]

There's program that can connect to servers, but it's limited to 6 predefined IPs (although it has ability to connect to other IPs, don't ask why and how). I can't modify it. I need to connect to ...
user avatar
0 votes
0 answers
97 views

Is there a way to reserve a tcp port for an executable on a Linux Server?

I am designing a security policy for a server program on Linux. I wish to reserve a tcp port number-say 8888, to and only to that executable of the program to listen to. Then I could turn the program ...
user avatar
  • 350
0 votes
1 answer
2k views

Whats the purpose of getting daily DMARC reports from google about my Mail Server?

I've been getting DMARC reports from google everyday after setting this up on my domain to prevent domain spoofing. Do I really need to have this daily report? I've never opened the attached zip file ...
user avatar
2 votes
2 answers
2k views

SpamAssassin, Postfix, and Multiple Addresses in From Header

I'm working on a problem that I'm seeing with an email scanning server (MailScanner, Spamassassin, Postfix, etc.), and From header spoofing. Unfortunately, some of the versions of these components ...
user avatar
1 vote
1 answer
638 views

Spoofing/Spam received from GSuite alias accounts

The company currently have 2 domains registered: "dom1.com" and "dom1.com.ex". "dom1.com" is hosted and is the main domain associated on our GSuite account to create user accounts to send mails, "dom1....
user avatar
  • 13
1 vote
2 answers
239 views

How config Exim4 to accept only authenticated sender

How can I setup Exim to accept only authenticated email from managed domain address? I'm receiving spoofed email.. from myself.
user avatar
  • 1,190
-1 votes
1 answer
369 views

DNS Spoofing in Bind9 DNS Server

I configured Ubuntu Server 18.04 as a master DNS server. zone ==> google.com ; ; BIND data file for local loopback interface ; $TTL 12h @ IN SOA ns1.google.com. root.google.com. ( ...
user avatar
1 vote
1 answer
2k views

Possibility of detecting MAC address spoofing in a decentralized network? [closed]

The paper that has been published here: https://dl.acm.org/citation.cfm?id=3282283 proposes a consensus algorithm based on distributed voting process in which it claims that it would be possible to ...
user avatar
0 votes
1 answer
137 views

Firewall block all but one ip spoofing

We have a server which accepts traffic coming from a few sources (ip addresses) and accept's it (using firewalld). All other traffic inbound is blocked. How likely is the risk that somebody ...
user avatar
0 votes
2 answers
396 views

Redirect purely LAN communication to a different interface and port (Linux)

I have the following situation: One interface (device) identified by an IP address of 192.168.1.x (I1) that's connecting through whatever service to another interface with IP 192.168.1.y (I2) to port (...
user avatar
  • 3
1 vote
2 answers
860 views

Cloudflare "Access" service real security

Cloudflare Access is a new attractive feature from Cloudflare, based more or less on Google's BeyondCorp (a reverse-proxy with login which should replace VPN in accessing internal network applications)...
user avatar
  • 151
1 vote
1 answer
631 views

RDP Server under attack; IP address used is our server address

I have setup a Windows 2016 server for remote desktop access, and installed RDPGuard to block brute force attacks. This worked well for a few days and RDPGuard blocked out a number of IP addresses. ...
user avatar
-1 votes
2 answers
46 views

Concerns about SPF for external provider

I´m searching for some arguments to avoid the creation of an SPF record for an external survey provider. Example: Division inside a company (abcd) wants to send survey mails to external recipients ...
user avatar
  • 109
0 votes
1 answer
887 views

fatal error in master.cf when restart postfix

I follow a guide to prevent spoofed emails in my mail server first I installed postfix-policyd-spf-perl apt-get install postfix-policyd-spf-perl second I added this lines to the ...
user avatar
-1 votes
1 answer
524 views

How to prevent an openly recursive DNS server from being abused for DNS amplification [closed]

I have a business need to provide an open and recursive DNS. This DNS has of course been heavily abused by DNS amplification attacks, resulting in 5-10 Mbps sustained outbound load only caused by ...
user avatar
  • 73
1 vote
2 answers
3k views

Iptables rules to prevent IP Spoofing

We had following below iptables rules that exist in our web front-end boxes to prevent IP Spoofing: -A INPUT -s 255.0.0.0/8 -j LOG --log-prefix "Spoofed source IP" -A INPUT -s 255.0.0.0/8 -j DROP -A ...
user avatar
  • 443
6 votes
1 answer
8k views

Is it possible to override a single domain name using dnsmasq?

I have a server application that I'm running two instances of, production and development, namely: prod.example.com (10.0.0.1) dev.example.com (10.0.0.2) A third-party has written a client ...
user avatar
  • 322
-2 votes
1 answer
3k views

How to check my network for IP spoofing availability?

I want to test if my network or even my ISP blocks spoofed IP packets. I am running a Debian Linux OS. I found this nice tool, but it's not working on my system .. https://www.caida.org/projects/...
user avatar
  • 113
1 vote
1 answer
987 views

ARP spoofing on switch across subnets

Consider a switch without any VLAN's defined with 2 subnets configured. Is it possible to ARP spoof from one subnet to another? According to Evans reply in What are the implications of having two ...
user avatar
  • 111
-3 votes
1 answer
328 views

TLS auth issue: 'CompanyA@exmple.com "via" SendGrid.me' email is dropped by Exchange [closed]

Looking for clarification about what this Exchange 2007 Management Shell (Powershell) command does and how it affects TLS at the Receive Connector: ms-exch-smtp-accept-authoritative-domain-sender ...
user avatar
0 votes
2 answers
533 views

Change the domain in the 'via' that Gmail shows as the result of a wrong SPF record

So I have a small Linux webserver, it is running the Direct Admin control panel and everything is working fine. For each domain, SPF and DKIM records are present in the DNS and mail is (as far as I ...
user avatar
0 votes
0 answers
631 views

Exchange 2013 -Prevent Spam emails from outside but with my internal domain name

my apologies if this question was asked and answered previously. we have Exchange 2013 email server. We have been seeing some of the emails are coming from outside but using our own domain name which ...
user avatar
  • 41
2 votes
1 answer
3k views

Checking SMTP headers for spoofed email (did client authenticate?)

I have been using rackspace email service, and I am finding that rogue emails are seemingly coming from harry@mydomain.com to james@mydomain.com but were never actually sent by that user. As per ...
user avatar
  • 1,120
3 votes
1 answer
914 views

Exchange not checking SPF record for own domain

I have an interesting issue with Exchange where it appears to check and stamp spoofed messages from external domains but not ones it has setup to send from. For example I can spoof a message from 1@...
user avatar
5 votes
1 answer
17k views

How can I prevent spoofed emails from outside thats using my internal accepted domain

I'm receiving spam emails sent from my own domain to my own domain. I'm using Exchange 2013. Example: myemail@mydomain.com is being used to send spam to myemail@mydomain.com. I can successfully ...
user avatar
0 votes
1 answer
629 views

Spoofing a duplicate MAC address on an interface not connecting to the network where the original MAC is

I'm trying to run a PHP project on a test server. The project uses an internal framework that has been modified so it will only run on the production server by checking the MAC address in eth0, and ...
user avatar
  • 101
2 votes
1 answer
139 views

Using SPF for spoof protection

I'm trying to work through properly configuring SPF for my domain. We have two MX servers that only receive mail, and two outbound relay servers which we expect to list in our SPF record. We also ...
user avatar