7

Just received this email "from" Stack Overflow:

enter image description here

Relevant Headers:

Received: from o16824532x199.outbound-mail.sendgrid.net (o16824532x199.outbound-mail.sendgrid.net [168.245.32.199])
    (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits))
    (No client certificate requested)
    by in-003.mia.mailroute.net (Postfix) with ESMTPS id 46k2Cl25H6z23jS1
    for <[email protected]>; Wed,  2 Oct 2019 16:49:06 +0000 (UTC)
Authentication-Results: mail.mailroute.net; dmarc=pass (p=reject dis=none) header.from=stackoverflow.email
Authentication-Results: mail.mailroute.net; spf=pass smtp.mailfrom=bounces+5841141-c769-obfuscated=obfuscated.com@em.stackoverflow.email
Authentication-Results: mail.mailroute.net;
    dkim=pass (1024-bit key) header.d=stackoverflow.email [email protected] header.b="r6EdTtiu"
DKIM-Signature: v=1; a=rsa-sha1; c=relaxed/relaxed; 
    d=stackoverflow.email; 
    h=content-type:from:list-unsubscribe:mime-version:reply-to:subject:to; 
    s=s1; bh=/mAAZXhTNkMi6rIPclhuiiuHNlA=; b=r6EdTtiuqI384o5JhT7VyDj
    UsqzISLIx7B4NmH1KE8Imn5Gm+2F1uoIVrGVFjhgh6vcafdOttJchesgwbpOIB9L
    rsFtgaCkBfZHOiq9Md7Xdr9iKiJ3yjaw4D7lxq9H7ccc1SjDGbGx+hrfYFl/QX4s
    NbClO0f37LOVFlEwNoRk=
Received: by filter1270p1las1.sendgrid.net with SMTP id filter1270p1las1-14455-5D94D4FC-12
        2019-10-02 16:49:00.33677624 +0000 UTC m=+69003.745394183
Received: from NTg0MTE0MQ (ec2-100-24-43-50.compute-1.amazonaws.com [100.24.43.50])
    by ismtpd0014p1iad2.sendgrid.net (SG) with HTTP id LCICV5WWTrCL-RQYBFXhIw
    for <[email protected]>; Wed, 02 Oct 2019 16:49:00.238 +0000 (UTC)
Content-Type: multipart/alternative; boundary=5fa36584273123c694e86880080b7c8c4a41af1564eade29a698ea7a6e68
Date: Wed, 02 Oct 2019 16:49:00 +0000 (UTC)
Feedback-ID: 1144188:814177:7013:iterable
From: "Cesar at Stack Overflow" <[email protected]>

So the email comes from stackoverflow.email (not stackoverflow.com) originating on an AWS node via SendGrid... sure looks phishy to me.

Is it?

4
  • 5
    Sorry, but anything promising free money for taking a survey has to clear a pretty high bar, such as being PGP (or GPG)-signed with a keypair I can verify. Otherwise it gets tossed immediately. I would have expected SO to know better. Oct 2, 2019 at 17:16
  • 1
    It's not even free money. $45 for a 45 minute "meeting"? Anyway, FWIW the IP of the domain seems to be matching with some other domains that are part of the SE network so at least that bit checks out. Still wouldn't click it though.
    – ivarni
    Oct 2, 2019 at 17:24
  • The domain name stackoverflow.email and the use of sendgrid + AWS is not suspicious and in line with previous mails, at least. If it's phishing, it's very well-researched phishing.
    – Erik A
    Oct 2, 2019 at 17:25
  • 2
    Yeah, I figured there was a reasonable chance it was legit, but it feels so poorly thought out that I have no intention of clicking. Oct 2, 2019 at 17:28

0

Browse other questions tagged .