I recently received (and then un-received -- details below*) a phishing attempt where the FROM address was the same as my TO address, making it seem to a noob as though the hacker had penetrated the email account:
I am a professional hacker and have successfully managed to hack your operating system.
Currently I have gained full access to your accounts.
I might be an idiot but I'm not a noob, and I saw right away this was just a spoofed email header, so I popped open the full headers to take a look (redacted and removing the long ID codes).
Download Original Copy to clipboard
Delivered-To: <my-private@email_address.com>
Received: by 2002:a17:906:ba8f:b0:c34:3feb:bd09 with SMTP id cu15csp2304284ejd; Thu, 15 Oct 2026 17:38:42 -0700 (PDT)
ARC-Authentication-Results: i=1; mx.google.com; dkim=pass header.i=@mazaiya.com header.s=default header.b=s2kJpPA+; spf=none (google.com: <my-private@email_address.com> does not designate permitted sender hosts) smtp.mailfrom=<my-private@email_address.com>
Return-Path: <<my-private@email_address.com>>
Received-SPF: none (google.com: <my-private@email_address.com> does not designate permitted sender hosts) client-ip=162.19.135.228;
Authentication-Results: mx.google.com; dkim=pass header.i=@mazaiya.com header.s=default header.b=s2kJpPA+; spf=none (google.com: <my-private@email_address.com> does not designate permitted sender hosts) smtp.mailfrom=<my-private@email_address.com>
Date: Fri, 16 Oct 2026 02:38:40 +0200
To: <my-private@email_address.com>
From: <my-private@email_address.com>
Message-ID: <6ad172106e0b1.5e8344c5eda7bbcdc6bb054c8ad62e47@mail.mazaiya.com>
X-AntiAbuse: This header was added to track abuse, please include it with any abuse report
X-AntiAbuse: Primary Hostname - ss3.totalcp.com
X-AntiAbuse: Original Domain - email_address.com
X-AntiAbuse: Originator/Caller UID/GID - [47 12] / [47 12]
X-AntiAbuse: Sender Address Domain - EmailAddress.com
X-Get-Message-Sender-Via: ss3.totalcp.com: authenticated_id: hr@mazaiya.com
X-Authenticated-Sender: ss3.totalcp.com: hr@mazaiya.com
That's pretty cool, we can see the email was cryptographically signed as coming from inbox hr@mazaiya.com which is kind of funny on its own.
Who is Mazaiya.com? Their front page claims to be a computer security company --
ironic -- but there don't seem to be any customers, reviews, or mentions of them anywhere online. Only their website comes up, and pretty soon this post will show up. They do have an account on x🤮, sorry twi🤮, sorry anyway they
have an account using Arabic language also claiming to be a technology company. And finally they also
have an account on fa🤮 -- ok sorry honestly it's hard to even say the names. Also they have an account on the chat app owned by that last company.
That means Mazaiya.com is only listed in places where it listed itself, and the only places it listed itself are deep wells of boomer scams and international frauds. Awesome, so I asked hr@mazaiya.com for a comment and didn't hear back from them. I also posted on their public page, and sent them chat messages. They have not responded.
The headers also show the host is TotalCP dot com (what a name... am I reading too much into that?), so I sent the full headers to the the fraud-and-abuse account at totalcp.com for a comment and now, seven days later, we are still exchanging preliminary messages and they asked me to send the original headers a second time. I hope TotalCP does something about it but so far they have not and I will update this post if anything happens with them.
*Side story: this spam email disappeared from my gmail inbox. I received the email on the 16th, saved the headers, and sent some investigative messages. Today when asked for the headers again, I couldn't find that email anywhere not even in the trash, which is a small mystery. I figure Google detected a pattern and fully ganked emails back out of inboxes, some time during the last week, probably shortly after I received and read it myself. Luckily I had all the full headers from my initial look.
Actually there is one more clue from Google's scant indexing of this website: one reference to market-x-y dot com which has
some domain registration information about the website. That is some curiously specific historical registration info, so I went ahead and emailed the listed account.
The end. Probably nothing more will happen. Kind of unsatisfying. Stay safe out there.
No comments:
Post a Comment