An abuse report, in person

This message appeared in my mailbox yesterday:

Hi thҽrҽ!

I am a profҽssional H A C K E R and havҽ succҽssfully managҽd to H A C K your opҽrating systҽm.

Currҽntly I havҽ gainҽd full accҽss to your account. (sҽnt the mҽssagҽ from insidҽ your ҽ-mail)

In addition, I was sҽcrҽtly monitoring all your activitiҽs and watching you for sҽvҽral months.

Thҽ thing is your computҽr was infҽctҽd with harmful spywarҽ duҽ to thҽ fact that you had visitҽd a wҽbsitҽ with porn contҽnt prҽviously.

Hi there! I am a professional HACKER and have successfully managed to HACK your operating system. Currently I have gained full access to your account. (sent the message from inside your e-mail) In addition, I was secretly monitoring all your activities and watching you for several months. The thing is your computer was infected with harmful spyware due to the fact that you had visited a website with porn content previously.

A classic extortion threat followed: they claimed to have recorded me through my webcam while I was watching explicit content, and unless I paid $2,780 in Bitcoin within hours, they would send the video to all my contacts.

The text was Base64-encoded and full of homoglyphs, possibly to evade spam filters, or because a real hackerman simply writes like that. Both the From and To fields contained my own address. I checked the raw headers for more details, just to make sure I hadn't accidentally exposed an internal service while tinkering with my server 😅

What the headers (do not) say

The From address names the author of an email, but like a signature on a letter, anyone can write any name there. On its own, it doesn't tell you who sent the message.

But the letter also comes in an envelope, with its own return address: the envelope sender (usually recorded in the Return-Path header). It can be different from the visible From address. Here it was hotels@palmview.tours, while the message claimed to come from me:

From:                   •••••@bonge.rs
Return-Path:            hotels@palmview.tours
X-Source-Auth:          hotels@palmview.tours
Authentication-Results: dmarc.icloud.com; dmarc=fail header.from=bonge.rs
Authentication-Results: spf=pass  smtp.mailfrom=hotels@palmview.tours;
                        dkim=pass header.d=palmview.tours

The last header shows SPF and DKIM both passed. That might seem odd, since the email was clearly spoofed! But neither of them looks at the From address:

• SPF checks the envelope: is the server that sent this message allowed to send mail for the envelope sender's domain? It was, because the message really did leave through palmview.tours' own server.
• DKIM checks a digital signature, using a public key that the signing domain publishes in its DNS. The signature was from palmview.tours, and it was valid.

So both checks only proved that palmview.tours sent the message, not that I did.

DMARC connects the two. It requires at least one of those checks to pass for the same domain as the From address (this is called alignment). Both passed for palmview.tours, but the From address said bonge.rs, so DMARC failed.

My DMARC policy is p=quarantine, which tells receiving providers to mark messages that fail DMARC as suspicious (usually by sending them to spam), but still deliver them. Mine did just that.

One more header stood out: X-Source-Auth. HostGator's mail servers add it to record from which authenticated account the message was sent. Here, that was hotels@palmview.tours itself. So someone actually obtained the password to their mailbox, possibly a weak or leaked one.

Reporting the abuse

When I receive phishing/scamming emails like this, I usually do a WHOIS lookup on the domain to find the abuse address and send a quick report. The headers pointed to HostGator, so I forwarded the raw message to them. Duty done.

Out of curiosity, I opened the domain's website. It was a small travel agency in Heliopolis, Cairo.

Wait... Heliopolis? That's literally the suburb where I'm currently staying on holiday!

So I thought, why not go over and inform them? I packed my laptop, ordered a taxi and headed to the address on their website. There I found an employee and explained that one of their mailboxes had been sending spam, and yes, this is weird, but I happened to be nearby. He directed me to the owner, who didn't speak English, but we managed with a translation app.

I showed him the email headers on my laptop, he photographed them, and I advised him to change the mailbox password now and ask his regular IT guy to check the server (offering myself to poke around his systems seemed like a bad idea). He was friendly and grateful for the heads-up.

Asking for leniency

When I got back, HostGator had already replied to my abuse report:

Thank you for bringing this matter to our attention. Upon reviewing your complaint, we have notified our customer that they have 48 hours to resolve the spamming complaint in accordance with our terms of service.

I wrote back to explain that, by pure coincidence, I was staying near their customer's office and had just visited the owner to help him resolve the issue. I assured them he was on top of it and asked if they could give him some time to get it sorted.

Getting blackmailed, walking into a random Egyptian office to give unsolicited IT advice, and then asking a hosting provider to go easy on the guy I just reported. Not quite what I had in mind for my holiday.