security How do YOU check if mails are legit?

[atv]

I post this here because i recently got AWS renewal emails which looked extremely legit, on the surface at least. It also came from a amazon.com address, which i thought would be sufficient to make sure it's safe. I guess they found or setup a SMTP that allows relay somehow. Ofcourse looking at the raw source there's plenty of servers that are not in the realm of amazon and my suspicions were confirmed when i read this article: https://anspachmedia.com/aws-email-scam/

Ofcourse, there's no confirmation of AWS whois details if you're in the EU (GDPR and all) so it's all nonsense. There's a couple of (really minor spelling mistakes or inconsistent capitalisations going on, with a minor threat of your domain being put on hold. Nothing unusual from the normal ICANN or registrar email. I've had them from dynadot or godaddy as well.

Anyway, as these emails look so real and until there's a way to verify they come from the correct domain (SSL checkmark?) i am just going to logon to the site and check my notifications there. I'm quite used to spam and scams but it's getting way to real.

What's the point of email if you can't trust any of them anymore.

Thanks for your input, i'd love to hear how you deal with this stuff.

 

[tonyk2000]

Manually. Just familiarize yourself with reading and understanding e-mail headers. Some headers (arriving from the sender) may be forged [which is also a red flag if you see strange lines], but the last header - added on receiving end - is always genuine, and it shows IP of the sending server. IP can be checked using whois.

Extra measures:

- disable external images

- use own domain with different aliases. Ideally: separate something12345 @ yourdomain . com for each website or anything you share your email with. This way, it would be easier to find who allowed your email to be distributed to spammers/hackers, and simply delete this alias

- no webmail for anything important. Desktop clients are more powerful for security purposes

 

[lock]

Type the website directly to make your queries let the website in question know of any phishing activities.

 

[barman]

I've been on the internet a long time so I'm pretty good at not falling for stuff like this. But the best way to protect yourself is to never click shady links in emails. Visit the URL in your browser directly.