Dynadot

security Scammer using premium domain name Federal.com?

NameSilo
Watch

Arfy

Shrew.comTop Member
Impact
1,406
So I was checking my emails this morning and I decided to check the spam folder (you should do this in case potential leads have been routed to spam - has happened to me in the past!). At the top of the pile I noticed an email from CEO@Federal / com. Now, I would not normally be enticed to open an email from Spam that I knew nothing about but the domain sounded too good.

I opened the email and as per usual I was being told I am the beneficiary of a large sum of money from 'Dallas Federal Bank' - ok now I knew it was a bullshit. However, I was surprised to see spam coming from such a good quality domain. Federal.com must be worth 5 figures right or at the very least 4 figures?

I also clicked the actual sender contact name to show the actual email address as sometimes the name shows a different email address but when you click into it the underlying address is a convoluted string of letters and numbers at a crap domain name. For this one it does show the email address as CEO@Federal / com.

My question is, does this mean the email was actually sent from this domain or is there some way to spoof the actual email address it self when sending an email? Why would anyone send spam / scams from premium domain name - maybe the answer is that a good domain name means more people are caught out?

Your thoughts please. :pompous:


Here is a screenshot of part of the email itself:


Screenshot_20181210-145153_Outlook.jpg



thanks,

CK!
 
Last edited:
0
•••
The views expressed on this page by users and staff are their own, not those of NamePros.
Of course it's a scam. The guy can't even spell correctly.

The email certainly does not come from federal.com. You need to look at the complete headers or show original message, to list the chain of emails.
 
1
•••
I think it's called spoofing - also, it looks like the site is down. If it wasn't a real biz and maybe just a monetized "mini" site - it may be hacked.
 
0
•••
Run the email headers of the emails you received through a source check such as
https://www.ip2location.com/free/email-tracer
to determine where they really came from

Also open an account with spamcop.net to report such phishing spam. To do so you must register your own email servers, there is a process to this, but worth it in the long run.
 
1
•••
Today I received the same crappy email from that LOSER!!!

Scammers are LOSERS!! They fail in life and they only try to screw successful people. :greedy::greedy::greedy::greedy:
 
0
•••
sometimes it does show as if it's a real domain extension (Federal.com in this case), but when you click on the email itself or if there's a button to show more details, often that's where you see the real email it comes from.. it seems that it's some type of masking option
 
0
•••
The email was in my Junk folder in my email and I did NOT open the email, just deleted the Junk folder and the scammers email was directly to the Trash! :xf.grin::xf.laugh::ROFL::hilarious::hilarious::hilarious:
 
Last edited:
0
•••
This is a spoofing, to prevent this, it is recommended to configure the SPF record: https://en.wikipedia.org/wiki/Sender_Policy_Framework
(It's the owner of the domain who must configure this, so recipient can check if the sender IP is authorized to send emails with @federal.com)
In this case federal.com has dns issues, so there is no SPF records!
 
Last edited:
1
•••
i got it today
and looked at it

it has a different reply to address setup when you clocik reply.. so I gues this partly answers the mystery

however, I don't know enough about mail headers etc to understand how they were able to originate it from @federal.com

but from looks of it, they defiitely cannot receive replies there.. hence the use of some lame lowend and unimpressive reply to email address..
 
0
•••
  • The sidebar remains visible by scrolling at a speed relative to the page’s height.
Back