→ 14 messages moved to Chimney

Hey people!

Can someone please confirm if this spam or official mail from SE/SO:

hm

That looks plausible - SE uses Jira cloud for support

why you have it tho... is another question

@JourneymanGeek Can someone from SE confirm?

@JourneymanGeek I used the contact page a month ago..

@RandomPerson hmm - If it helps that's the email I've gotten replies for support requests from

oh.. OK.

Can @Catija or @JNat confirm please?

Looks legit (check email headers), then click on "View Request".

@JourneymanGeek your email is visible :|

@Rob what is email headers?

Ah. I don't actually particularly care 😁

In any case I can confirm as far as it's possible from and end user point of view that that looks valid

@RandomPerson Here, the arrow:

It's 60 years old, here's what headers are: en.wikipedia.org/wiki/Email#Header_fields

@JourneymanGeek hmm..

I also got my email in the profile.

I think?

Yes as image.

As long as it's not harvested by spam bots it's fine, I don't care getting emails from actual people.

@JourneymanGeek did you mean "...from an..."?

Yes

@Rob there's no reply to option in my case..

@JourneymanGeek OK.

@RandomPerson might be email client issue

@ShadowWizardWearingMaskV2 ok..

@RandomPerson it's an older email. Maybe different

@JourneymanGeek hmm. OK.

The from: and reply-to: are irrelevant, they're trivial to spoof. Just look at the actual headers and check that it was indeed sent from that address. If you're on gmail, click on the three vertical dots (the menu) and choose "show original". You should see something like this if it's real:

Received: from o1.em.stackoverflow.email (o1.em.stackoverflow.email. [167.89.81.234])
        by mx.google.com with ESMTPS id u10si6763704wmj.96.2021.07.23.12.01.12

Basically, check that the received from headers looks like real stackoverflow addresses, @RandomPerson.

@RandomPerson The first email doesn't have a "reply-to:", you need to sign up first, after you check the identity of the sender: support.google.com/mail/answer/7039474

And, of course, before clicking the link, check that it actually points to a stackoverflow domain.

They won't be "stackoverflow addresses/domain", because that's not who sent the email; and all the recieved from (etc.) can be spoofed too - you need to click on "See security details" --- "How email works" is explained (partially) at the link above.

@RandomPerson Paste the full email headers in Email Header Analyzer, RFC822 Parser - MxToolbox and let it do the hard work for you.

@Rob yes, OK they can be but at least it isn't as trivial as a setting in your mail client.

Setting the from and reply to doesn't even require minimal tech savvy

I was just saying that checking those two, the from and reply-to is pointless given how trivial they are to change

There are online forms to set almost anything to anything, compose the email, and send it so it can't be traced back to you - The convenience of The Internet.

Fair, but setting those two is as easy as setting your name so I just don't see any point in even looking at them.

@terdon in this case it's an altassian domain 😁

I personally know of many instances where people misspelled their own name or wouldn't provide the correct one. Here is one instance of proof:

@JNat cross site... something no idea how to call it, this user keeps copy and pasting random stuff, there were couple of answers with random images, now some copy&paste of text. It's wasting our time, probably better to just nuke that weird thing and be done with. Thanks! :)

I thought it was just one site, and that they got a warning that they heeded. They also earned a badge: stackoverflow.com/help/badges/2600/informed?userid=16516646 - so that didn't help. 😀

@JourneymanGeek yeah, I mean check that the headers at least match the info in the from and reply-to. That has helped me identify amateur scams often enough. I am not claiming it's foolproof, it's just a useful test and I am arguing that looking at the from: and replyto: isn't even useful since those are just options you can choose in your email client so even the most amateur of scammers would be able to change them.

Received: from mta-81-96.sparkpostmail.com (mta-81-96.sparkpostmail.com. [192.174.81.96])
        by mx.google.com with ESMTPS id q14si3651212pfk.85.2021.07.22.12.00.50

@RandomPerson @terdon

@Rob OK.

@terdon It points to a link like this: stackoverflow.atlassian.net......

@DavidPostill I used this: toolbox.googleapps.com/apps/messageheader

@JourneymanGeek stackoverflow.atlassian.net...

I clicked the link and it looks like it is StackOverflow really! They asked me to provide my full name and set a password. After that I was able to see the correspondence which I sent using contact page

^^^ The from and reply-to don't match and aren't supposed to in this case, if they did that would be suspect. 🛴

Sometimes anti-malware effort becomes frontline

Microsoft sent representatives to people's houses to have them physically disconnect infected equipment

@Rob do you still have the link to the screenshot? I was going to edit the question to include it.

The screenshot was really nice, mixing the before and after colors of the links.

@Rob found it was in my browser history. Do you mind if I include it in the post?

Wait a minute, maybe the color difference is because you don't have 2k on SO :(

^ mebe

@Rob edited. And I'm off for tonight. Thanks.