www.proofpoint.com Open in urlscan Pro
2a02:e980:107::cf Public Scan

Back to summary

URL:
https://www.proofpoint.com/us/corporate-blog/post/how-does-email-spoofing-work-and-why-it-so-easy
Submission: On October 07 via manual (October 7th 2024, 4:28:11 pm UTC) from US — Scanned from DE

Form analysis
4 forms found in the DOM

<form class="header-nav__search-form">
  <input type="text" class="header-nav__search-input" placeholder="">
  <input type="submit" class="header-nav__search-button" val="Search">
</form>

<form id="mktoForm_19277" data-mkto-id="19277" data-mkto-base="//app-abj.marketo.com" data-munchkin-id="309-RHV-619" data-submit-text="" data-redirect-link="" data-prefill="" data-event-label="" data-lang-code="us" data-validate-email="1"
  class="mk-form__form marketo-form-block__form mktoForm mktoHasWidth mktoLayoutLeft js-visible mkto-form-processed" data-asset-type="Blogs Subscribe" novalidate="novalidate"
  style="font-family: inherit; font-size: 16px; color: rgb(51, 51, 51); width: 1601px;">
  <style type="text/css"></style>
  <div class="mktoFormRow">
    <div class="mktoFieldDescriptor mktoFormCol" style="margin-bottom: 5px;">
      <div class="mktoOffset" style="width: 5px;"></div>
      <div class="mktoFieldWrap mktoRequiredField"><label id="LblEmail" for="Email" class="mktoLabel mktoHasWidth" style="width: 150px;">
          <div class="mktoAsterix">*</div>Business Email:
        </label>
        <div class="mktoGutter mktoHasWidth" style="width: 5px;"></div><input id="Email" name="Email" placeholder="Business Email  *" maxlength="255" aria-labelledby="LblEmail InstructEmail" type="email"
          class="mktoField mktoEmailField mktoHasWidth mktoRequired" aria-required="true" style="width: 200px;"><span id="InstructEmail" tabindex="-1" class="mktoInstruction"></span>
        <div class="mktoClear"></div>
      </div>
      <div class="mktoClear"></div>
    </div>
    <div class="mktoClear"></div>
  </div>
  <div class="mktoFormRow"><input type="hidden" name="blogInterest" class="mktoField mktoFieldDescriptor mktoFormCol" value="All Blog Posts" placeholder="" style="margin-bottom: 5px;">
    <div class="mktoClear"></div>
  </div>
  <div class="mktoFormRow"><input type="hidden" name="Employees_Picklist__c" class="mktoField mktoFieldDescriptor mktoFormCol" value="" placeholder="" style="margin-bottom: 5px;">
    <div class="mktoClear"></div>
  </div>
  <div class="mktoFormRow"><input type="hidden" name="State" class="mktoField mktoFieldDescriptor mktoFormCol" value="State/Province" placeholder="" style="margin-bottom: 5px;">
    <div class="mktoClear"></div>
  </div>
  <div class="mktoFormRow"><input type="hidden" name="Most_Recent_Medium__c" class="mktoField mktoFieldDescriptor mktoFormCol" value="Website" placeholder="" style="margin-bottom: 5px;">
    <div class="mktoClear"></div>
  </div>
  <div class="mktoFormRow"><input type="hidden" name="Most_Recent_Medium_Detail__c" class="mktoField mktoFieldDescriptor mktoFormCol" value="www-pfpt" placeholder="" style="margin-bottom: 5px;">
    <div class="mktoClear"></div>
  </div>
  <div class="mktoFormRow"><input type="hidden" name="Industry" class="mktoField mktoFieldDescriptor mktoFormCol" value="" placeholder="" style="margin-bottom: 5px;">
    <div class="mktoClear"></div>
  </div>
  <div class="mktoFormRow"><input type="hidden" name="Website" class="mktoField mktoFieldDescriptor mktoFormCol" value="" placeholder="" style="margin-bottom: 5px;">
    <div class="mktoClear"></div>
  </div>
  <div class="mktoFormRow"><input type="hidden" name="AnnualRevenue" class="mktoField mktoFieldDescriptor mktoFormCol" value="" placeholder="" style="margin-bottom: 5px;">
    <div class="mktoClear"></div>
  </div>
  <div class="mktoFormRow"><input type="hidden" name="demandbasesid" class="mktoField mktoFieldDescriptor mktoFormCol" value="" placeholder="" style="margin-bottom: 5px;">
    <div class="mktoClear"></div>
  </div>
  <div class="mktoFormRow"><input type="hidden" name="demandBase_Data_Source" class="mktoField mktoFieldDescriptor mktoFormCol" value="" placeholder="" style="margin-bottom: 5px;">
    <div class="mktoClear"></div>
  </div>
  <div class="mktoFormRow"><input type="hidden" name="Primary_Product_Interest__c" class="mktoField mktoFieldDescriptor mktoFormCol" value="" placeholder="" style="margin-bottom: 5px;">
    <div class="mktoClear"></div>
  </div>
  <div class="mktoFormRow"><input type="hidden" name="UTM_Post_ID__c" class="mktoField mktoFieldDescriptor mktoFormCol" value="" placeholder="" style="margin-bottom: 5px;">
    <div class="mktoClear"></div>
  </div>
  <div class="mktoFormRow"><input type="hidden" name="utmcampaign" class="mktoField mktoFieldDescriptor mktoFormCol" value="" placeholder="" style="margin-bottom: 5px;">
    <div class="mktoClear"></div>
  </div>
  <div class="mktoFormRow"><input type="hidden" name="utmterm" class="mktoField mktoFieldDescriptor mktoFormCol" value="" placeholder="" style="margin-bottom: 5px;">
    <div class="mktoClear"></div>
  </div>
  <div class="mktoFormRow"><input type="hidden" name="db_employee_count" class="mktoField mktoFieldDescriptor mktoFormCol" value="" placeholder="" style="margin-bottom: 5px;">
    <div class="mktoClear"></div>
  </div>
  <div class="mktoFormRow"><input type="hidden" name="Unsubscribed" class="mktoField mktoFieldDescriptor mktoFormCol" value="0" placeholder="" style="margin-bottom: 5px;">
    <div class="mktoClear"></div>
  </div>
  <div class="mktoButtonRow"><span class="mktoButtonWrap mktoNative" style="margin-left: 110px;"><button type="submit" class="mktoButton">Submit</button></span></div><input type="hidden" name="formid" class="mktoField mktoFieldDescriptor"
    value="19277" placeholder=""><input type="hidden" name="munchkinId" class="mktoField mktoFieldDescriptor" value="309-RHV-619" placeholder=""><input type="hidden" name="Website_Conversion_URL__c" class="mktoField mktoFieldDescriptor"
    value="https://www.proofpoint.com/us/corporate-blog/post/how-does-email-spoofing-work-and-why-it-so-easy" placeholder=""><input type="hidden" name="gAClientID" class="mktoField mktoFieldDescriptor" value="272709983.1728318485" placeholder="">
  <style type="text/css"></style>
  <div class="mktoFormRow">
    <div class="mktoFieldDescriptor mktoFormCol" style="margin-bottom: 5px;">
      <div class="mktoOffset" style="width: 5px;"></div>
      <div class="mktoFieldWrap mktoRequiredField"><label id="LblEmail" for="Email" class="mktoLabel mktoHasWidth" style="width: 150px;">
          <div class="mktoAsterix">*</div>Business Email:
        </label>
        <div class="mktoGutter mktoHasWidth" style="width: 5px;"></div><input id="Email" name="Email" placeholder="Business Email *" maxlength="255" aria-labelledby="LblEmail InstructEmail" type="email"
          class="mktoField mktoEmailField mktoHasWidth mktoRequired" aria-required="true" style="width: 200px;"><span id="InstructEmail" tabindex="-1" class="mktoInstruction"></span>
        <div class="mktoClear"></div>
      </div>
      <div class="mktoClear"></div>
    </div>
    <div class="mktoClear"></div>
  </div>
  <div class="mktoFormRow"><input type="hidden" name="blogInterest" class="mktoField mktoFieldDescriptor mktoFormCol" value="All Blog Posts" placeholder="" style="margin-bottom: 5px;">
    <div class="mktoClear"></div>
  </div>
  <div class="mktoFormRow"><input type="hidden" name="Employees_Picklist__c" class="mktoField mktoFieldDescriptor mktoFormCol" value="" placeholder="" style="margin-bottom: 5px;">
    <div class="mktoClear"></div>
  </div>
  <div class="mktoFormRow"><input type="hidden" name="State" class="mktoField mktoFieldDescriptor mktoFormCol" value="State/Province" placeholder="" style="margin-bottom: 5px;">
    <div class="mktoClear"></div>
  </div>
  <div class="mktoFormRow"><input type="hidden" name="Most_Recent_Medium__c" class="mktoField mktoFieldDescriptor mktoFormCol" value="Website" placeholder="" style="margin-bottom: 5px;">
    <div class="mktoClear"></div>
  </div>
  <div class="mktoFormRow"><input type="hidden" name="Most_Recent_Medium_Detail__c" class="mktoField mktoFieldDescriptor mktoFormCol" value="www-pfpt" placeholder="" style="margin-bottom: 5px;">
    <div class="mktoClear"></div>
  </div>
  <div class="mktoFormRow"><input type="hidden" name="Industry" class="mktoField mktoFieldDescriptor mktoFormCol" value="" placeholder="" style="margin-bottom: 5px;">
    <div class="mktoClear"></div>
  </div>
  <div class="mktoFormRow"><input type="hidden" name="Website" class="mktoField mktoFieldDescriptor mktoFormCol" value="" placeholder="" style="margin-bottom: 5px;">
    <div class="mktoClear"></div>
  </div>
  <div class="mktoFormRow"><input type="hidden" name="AnnualRevenue" class="mktoField mktoFieldDescriptor mktoFormCol" value="" placeholder="" style="margin-bottom: 5px;">
    <div class="mktoClear"></div>
  </div>
  <div class="mktoFormRow"><input type="hidden" name="demandbasesid" class="mktoField mktoFieldDescriptor mktoFormCol" value="" placeholder="" style="margin-bottom: 5px;">
    <div class="mktoClear"></div>
  </div>
  <div class="mktoFormRow"><input type="hidden" name="demandBase_Data_Source" class="mktoField mktoFieldDescriptor mktoFormCol" value="" placeholder="" style="margin-bottom: 5px;">
    <div class="mktoClear"></div>
  </div>
  <div class="mktoFormRow"><input type="hidden" name="Primary_Product_Interest__c" class="mktoField mktoFieldDescriptor mktoFormCol" value="" placeholder="" style="margin-bottom: 5px;">
    <div class="mktoClear"></div>
  </div>
  <div class="mktoFormRow"><input type="hidden" name="UTM_Post_ID__c" class="mktoField mktoFieldDescriptor mktoFormCol" value="" placeholder="" style="margin-bottom: 5px;">
    <div class="mktoClear"></div>
  </div>
  <div class="mktoFormRow"><input type="hidden" name="utmcampaign" class="mktoField mktoFieldDescriptor mktoFormCol" value="" placeholder="" style="margin-bottom: 5px;">
    <div class="mktoClear"></div>
  </div>
  <div class="mktoFormRow"><input type="hidden" name="utmterm" class="mktoField mktoFieldDescriptor mktoFormCol" value="" placeholder="" style="margin-bottom: 5px;">
    <div class="mktoClear"></div>
  </div>
  <div class="mktoFormRow"><input type="hidden" name="db_employee_count" class="mktoField mktoFieldDescriptor mktoFormCol" value="" placeholder="" style="margin-bottom: 5px;">
    <div class="mktoClear"></div>
  </div>
  <div class="mktoFormRow"><input type="hidden" name="Unsubscribed" class="mktoField mktoFieldDescriptor mktoFormCol" value="0" placeholder="" style="margin-bottom: 5px;">
    <div class="mktoClear"></div>
  </div>
  <div class="mktoButtonRow"><span class="mktoButtonWrap mktoNative" style="margin-left: 110px;"><button type="submit" class="mktoButton">Submit</button></span></div>
</form>

<form data-mkto-id="19277" data-mkto-base="//app-abj.marketo.com" data-munchkin-id="309-RHV-619" data-submit-text="" data-redirect-link="" data-prefill="" data-event-label="" data-lang-code="us" data-validate-email="1"
  class="mk-form__form marketo-form-block__form mktoForm mktoHasWidth mktoLayoutLeft" data-asset-type="Blogs Subscribe" novalidate="novalidate"
  style="font-family: inherit; font-size: 16px; color: rgb(51, 51, 51); visibility: hidden; position: absolute; top: -500px; left: -1000px; width: 1600px;"></form>

<form data-mkto-id="19277" data-mkto-base="//app-abj.marketo.com" data-munchkin-id="309-RHV-619" data-submit-text="" data-redirect-link="" data-prefill="" data-event-label="" data-lang-code="us" data-validate-email="1"
  class="mk-form__form marketo-form-block__form mktoForm mktoHasWidth mktoLayoutLeft js-visible mkto-form-processed" data-asset-type="Blogs Subscribe" novalidate="novalidate"
  style="font-family: inherit; font-size: 16px; color: rgb(51, 51, 51); width: 1600px; visibility: hidden; position: absolute; top: -500px; left: -1000px;"></form>

Text Content

Skip to main content
English (Americas)
Search
Login
 * Platform
 * Products
 * Solutions

Proofpoint
Contact

Search

 * Platform
 * Products
 * Solutions
 * Partners
 * Resources
 * Company

Search
Login
English (Americas)
Platform
Products
Solutions
Partners
Resources
Company
Protect People
Multi-layered, adaptive defenses for threat detection, impersonation, and
supplier risk.
Email Security
Impersonation Protection
More products
Defend Data
Transform your information protection with a human-centric, omni-channel
approach.
Enterprise DLP
Adaptive Email DLP
Insider Threat Management
Intelligent Compliance
Mitigate Human Risk
Unlock full user risk visibility and drive behavior change.
Security Awareness
Augment Your Capabilities
Managed Services
Product Packages

More Protect People Products
Account Take-Over and Identity Protection
Secure vulnerable identities, stop lateral movement and privilege escalation.
Adaptive Email Security
Stop more threats with a fully integrated layer of behavioral AI.
Secure Email Relay
Secure your application email and accelerate DMARC implementation
Solutions by Use Case
How Proofpoint protects your people and data.
Authenticate Your Email
Protect your email deliverability with DMARC.
Combat Email and Cloud Threats
Protect your people from email and cloud threats with an intelligent and
holistic approach.
More use cases
Solutions by Industry
People-centric solutions for your organization.
Federal Government
Cybersecurity for federal government agencies.
State and Local Government
Protecting the public sector, and the public from cyber threats.
More industries
Comparing Proofpoint
Evaluating cybersecurity vendors? Check out our side-by-side comparisons.
View comparisons


SOLUTIONS BY USE CASE

How Proofpoint protects your people and data.
Change User Behavior
Help your employees identify, resist and report attacks before the damage is
done.
Combat Data Loss and Insider Risk
Prevent data loss via negligent, compromised and malicious insiders.
Modernize Compliance and Archiving
Manage risk and data retention needs with a modern compliance and archiving
solution.
Protect Cloud Apps
Keep your people and their cloud apps secure by eliminating threats and data
loss.
Prevent Loss from Ransomware
Learn about this growing threat and stop attacks by securing ransomware's top
vector: email.
Secure Microsoft 365
Implement the best security and compliance solution for Microsoft 365.


SOLUTIONS BY INDUSTRY

People-centric solutions for your organization.
Higher Education
A higher level of security for higher education.
Financial Services
Eliminate threats, build trust and foster growth for your organization.
Healthcare
Protect clinicians, patient data, and your intellectual property against
advanced threats.
Mobile Operators
Make your messaging environment a secure environment.
Internet Service Providers
Cloudmark email protection.
Small and Medium Businesses
Big-time security for small business.


PROOFPOINT VS. THE COMPETITION

Side-by-side comparisons.
Proofpoint vs. Abnormal Security
Proofpoint vs. Mimecast
Proofpoint vs. Cisco
Proofpoint vs Microsoft
Proofpoint vs. Microsoft Purview
Proofpoint vs. Legacy DLP


PARTNERS

Deliver Proofpoint solutions to your customers.
Channel Partners

Archive Extraction Partners
Learn about Extraction Partners.
GSI and MSP Partners
Learn about our global consulting.
Technology and Alliance Partners
Learn about our relationships.
Social Media Protection Partners
Learn about the technology and....
Proofpoint Essentials Partner Programs
Small Business Solutions .
Become a Channel Partner


RESOURCES

Find reports, webinars, blogs, events, podcasts and more.
Resource Library

Blog
Keep up with the latest news and happenings.
Webinars
Browse our webinar library to learn about the latest threats, trends and issues
in cybersecurity.
Cybersecurity Academy
Earn your certification to become a Proofpoint Certified Guardian.
Podcasts
Learn about the human side of cybersecurity.
New Perimeters Magazine
Get the latest cybersecurity insights in your hands.
Threat Glossary
Learn about the latest security threats.
Events
Connect with us at events to learn how to protect your people and data from
ever-evolving threats.
Customer Stories
Read how our customers solve their most pressing cybersecurity challenges.


COMPANY

Proofpoint protects organizations' greatest assets and biggest risks: their
people.
About Proofpoint

Why Proofpoint
Learn about our unique people-centric approach to protection.
Careers
Stand out and make a difference at one of the world's leading cybersecurity
companies.
News Center
Read the latest press releases, news stories and media highlights about
Proofpoint.
Privacy and Trust
Learn about how we handle data and make commitments to privacy and other
regulations.
Environmental, Social, and Governance
Learn how we apply our principles to positively impact our community.
Support
Access the full range of Proofpoint support services.


PLATFORM

Discover the Proofpoint human-centric platform.
Learn More

Proofpoint Nexus
Detection technologies to protect people and defend data.
Proofpoint Zen
Protect and engage users wherever they work.
Search Proofpoint
Try searching for
Email Security Phishing DLP Email Fraud
Select Product Login
 * Support Log-in
 * Proofpoint Cybersecurity Academy
 * Digital Risk Portal
 * Email Fraud Defense
 * ET Intelligence
 * Proofpoint Essentials
 * Sendmail Support Log-in

Select Language
 * English (Americas)
 * English (Europe, Middle East, Africa)
 * English (Asia-Pacific)
 * Español
 * Deutsch
 * Français
 * Italiano
 * Português
 * 日本語
 * 한국어

Blog
Email and Cloud Threats
How Does Email Spoofing Work and Why Is It So Easy?


HOW DOES EMAIL SPOOFING WORK AND WHY IS IT SO EASY?

Share with your network!

August 01, 2018 Neil Glick

According to Verizon, email fraud (spoofing) accounts for more than 90% of
enterprise attacks. Why is email such a popular vector for spreading malware and
malicious links?  Because it’s much easier for criminals to convince a human to
click on a fraudulent file or link within an email than it is to force their way
into a hardened infrastructure.

Think about it this way: Would you rather take on a tank or trick the crew to
come out of the tank and surrender? The latter option is much easier.

The structure of email

Why can’t we just harden email like we do a firewall and turn it into a tank?
Because email wasn’t built with security in mind. It was invented in the 1960’s
and the original standard, RFC 822, was written in 1982. Updated standards
weren’t written until 2008, which contain the current email structure that we
all know and are comfortable with. 

Email as we know it today consists of three major sections:

 1. The envelope
 2. The message header
 3. The message body

Each email program handles email differently, so they all speak a common
language, Simple Mail Transport Protocol (SMTP), to allow these different
systems to talk to each other.

In many ways, email is like a letter that we might mail. However, the recipient
of the email doesn’t see the envelope. In most cases, that’s fine because when
we compose an email in our email clients, the envelope information usually gets
filled in from the header information automatically.

However, when spoofing an email, a threat actor can put whatever he/she wants
into the following fields:

 * Mail from:
 * From:
 * Subject:
 * Date:
 * To:
 * Reply-To:

Why are they allowed to do that and how does email spoofing work?  Let’s explore
an example.

How to spoof an email



The box in red above highlights the email’s envelope. Normally the envelope
fields are filled out for the sender automatically during the translation of the
header. Neither the sender nor the recipient usually sees this information. The
stuff in blue is the header and body. This is the stuff you normally see when
you open an email that was sent to you.

It is possible for the sender to tinker with the message header and spoof the
sender’s identify so the email looks like it is from someone other than Dude1.
Let’s break down how spoofing an emails identity works.

Say you have a friend that likes to play practical jokes on you. And you receive
an email from them that says this:



Notice that the envelope fields are correct, but the From and Reply-To are
false. When Dude1 receives this email, he may think it’s from his boss. When he
hits “Reply” all he’ll see in the To: field is the “BossMan” name, but it will
go back to his friend who spoofed the email, Dude2.

Cyber criminals can cleverly disguise an email in the same way and custom tailor
it for their intended victims

For example, if a criminal wants banking credentials from his or her target,
they can do the same thing Dude2 did, but instead of telling Dude1 that he got a
raise, they can falsely represent themselves within the email as a trusted bank
and direct the recipient to go to a fraudulent website.

Email spoofing success relies on human vulnerability

There are many variations of this email scam, however at the core, they are the
same: spoof the sender’s identity and convince the victim the email is not from
a threat actor, but a legitimate source.  From there, the end goal is usually
the same, extracting money from the victim.

What’s the best way to protect yourself against email spoofing? Check out our
Email Security Strategy Guide to find out.

Previous Blog Post
Next Blog Post


SUBSCRIBE TO THE PROOFPOINT BLOG

*
Business Email:




















Submit
*
Business Email:




















Submit
Products
 * Protect People
 * Defend Data
 * Mitigate Human Risk
 * Premium Services

Get Support
 * Product Support Login
 * Support Services
 * IP Address Blocked?

Connect with Us
 * +1-408-517-4710
 * Attend an Event
 * Contact Us
 * Free Demo Request

More
 * About Proofpoint
 * Why Proofpoint
 * Careers
 * Leadership Team
 * News Center
 * Privacy and Trust

© 2024. All rights reserved.
Terms and conditions Privacy Policy Sitemap
 * 
 * 
 * 
 * 
 *

www.proofpoint.com Open in urlscan Pro 2a02:e980:107::cf Public Scan

Form analysis 4 forms found in the DOM

Text Content

www.proofpoint.com Open in urlscan Pro
2a02:e980:107::cf Public Scan

Form analysis
4 forms found in the DOM