Received email from apple, email address seems legit, from @apple.com but just feel suspicious as the email too generic, nvr address me by my name n the link within seems fake.
Anyone received this too?
The proper way to check for legitimacy in such emails is to read the email headers properly.
From: headers are part of the mail body, so it can be spoofed very easily.
Read the
Received: headers. These are inserted by mail servers, and there will be one that is written by the destination mail servers, which at least one is from your own mail service (likely your own ISP).
You may see something like this for Apple
Received-SPF: pass (google.com: domain of
do_not_reply@email.apple.com designates 17.151.1.96 as permitted sender)
My domain is using google app, so google spf from apple helps
The following is the SPF from domain "email.apple.com"
Code:
$ dig email.apple.com txt
; <<>> DiG 9.8.3-P1 <<>> email.apple.com txt
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 39763
;; flags: qr rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 0, ADDITIONAL: 0
;; QUESTION SECTION:
;email.apple.com. IN TXT
;; ANSWER SECTION:
email.apple.com. 3600 IN TXT "v=spf1 ip4:17.254.6.0/24 ip4:17.171.23.0/24 ip4:17.151.1.0/24 ip4:17.171.37.0/24 ip4:17.151.62.0/24 ip4:17.171.2.0/24 include:icloud.com ~all"
;; Query time: 12 msec
;; SERVER: 172.16.123.2#53(172.16.123.2)
;; WHEN: Sun Oct 23 18:42:05 2016
;; MSG SIZE rcvd: 189
While email authenticity can be loosely rule out using mistakes in the mail content, it is inaccurate to use it as the absolute measure. The raw headers of the emails is the preferred forensic approach.
For such cases, I normally access by opening my browser and end the relevant site manually instead of using any links provided in the emails. Since you know it is a service that you are using, then you should be able to access it separately by your own without any links provided in the email, even if it is an authentic email.
The problem with using the link provided are the following
1) You might be clicking on a malware link, which may bring you more harm
2) The link provided may also be one that notify the sender to further inform them that their mass emailing has successfully reach some parties and they know you are an existing user of the service they are trying to spoof. So you are providing information for further attacks even if you may have not fallen into their trap this time.
