What is going on in what looks like an attack that checks out?

Question

I received an email (text and source below), that looks socially like phishing but looks technically like it will check out. My best guess is that Unicode has been used to copy domain names.

The text of the webpage is:

Action required: Your Google Account is temporarily disabled
Hi, We’ve detected unusual activity in your Google Account jonathan.hayward@pobox.com and locked it to protect your information.

Sign in to your account or to any Google service as soon as possible, to reactivate your account.

Use the Security Checkup to verify and improve your account’s security.

The Google Accounts team

This email can't receive replies. For more information, visit the Google Accounts Help Center.

You received this mandatory email service announcement to update you about important changes to your Google product or account.

© 2017 Google Inc., 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA

The source is:

Received-SPF: pass (google.com: domain of srs0=jfi5=ai=gaia.bounces.google.com=3vxqxwqgtaoirs-vitpceggsyrxw.ksskpi.gsq@bounce2.pobox.com designates 64.147.108.55 as permitted sender) client-ip=64.147.108.55;
MIME-Version: 1.0
Date: Thu, 7 Sep 2017 16:56:14 +0000 (UTC)
Feedback-ID: 68:account-notifier
Message-ID: 
Subject: Action required: Your Google Account is temporarily disabled
From: Google 
To: jonathan.hayward@pobox.com
Content-Type: multipart/alternative; boundary="94eb2c0762b0ec2da405589c58ad"

--94eb2c0762b0ec2da405589c58ad
Content-Type: text/plain; charset="UTF-8"; format=flowed; delsp=yes
Content-Transfer-Encoding: base64

QWN0aW9uIHJlcXVpcmVkOiBZb3VyIEdvb2dsZSBBY2NvdW50IGlzIHRlbXBvcmFyaWx5IGRpc2Fi
bGVkDQoNCg0KDQpIaSwNCldl4oCZdmUgZGV0ZWN0ZWQgdW51c3VhbCBhY3Rpdml0eSBpbiB5b3Vy
IEdvb2dsZSBBY2NvdW50DQpqb25hdGhhbi5oYXl3YXJkQHBvYm94LmNvbSBhbmQgbG9ja2VkIGl0
IHRvIHByb3RlY3QgeW91ciBpbmZvcm1hdGlvbi4NCg0KMS4gU2lnbiBpbiB0byB5b3VyIGFjY291
bnQgPGh0dHBzOi8vbXlhY2NvdW50Lmdvb2dsZS5jb20+IG9yIHRvIGFueSBHb29nbGUNCnNlcnZp
Y2UgYXMgc29vbiBhcyBwb3NzaWJsZSwgdG8gcmVhY3RpdmF0ZSB5b3VyIGFjY291bnQuMi4gVXNl
IHRoZSBTZWN1cml0eQ0KQ2hlY2t1cCA8aHR0cHM6Ly9teWFjY291bnQuZ29vZ2xlLmNvbS9zZWN1
cmVhY2NvdW50PiB0byB2ZXJpZnkgYW5kIGltcHJvdmUNCnlvdXIgYWNjb3VudOKAmXMgc2VjdXJp
dHkuDQpUaGUgR29vZ2xlIEFjY291bnRzIHRlYW0NCg0KDQoNClRoaXMgZW1haWwgY2FuJ3QgcmVj
ZWl2ZSByZXBsaWVzLiBGb3IgbW9yZSBpbmZvcm1hdGlvbiwgdmlzaXQgdGhlIEdvb2dsZQ0KQWNj
b3VudHMgSGVscCBDZW50ZXIgPGh0dHBzOi8vc3VwcG9ydC5nb29nbGUuY29tL21haWwvYW5zd2Vy
LzUwMjcwPi4NCg0KDQoNCllvdSByZWNlaXZlZCB0aGlzIG1hbmRhdG9yeSBlbWFpbCBzZXJ2aWNl
IGFubm91bmNlbWVudCB0byB1cGRhdGUgeW91IGFib3V0DQppbXBvcnRhbnQgY2hhbmdlcyB0byB5
b3VyIEdvb2dsZSBwcm9kdWN0IG9yIGFjY291bnQuDQoNCsKpIDIwMTcgR29vZ2xlIEluYy4sIDE2
MDAgQW1waGl0aGVhdHJlIFBhcmt3YXksIE1vdW50YWluIFZpZXcsIENBIDk0MDQzLCBVU0ENCmV0
OjY4DQo=
--94eb2c0762b0ec2da405589c58ad
Content-Type: text/html; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable

@media s=
creen and (min-width: 600px) {.v2sp {padding: 6px 34px 0px;}}=
Action required: Your Google Account is temporarily disab=
led=
Hi,We=E2=80=99=
ve detected unusual activity in your Google Account jonathan.hayward@pob=
ox.com and locked it to protect your information.

1. Sign in to your account or to any Google ser=
vice as soon as possible, to reactivate your account.
2. Use the Security Checkup to verify=
 and improve your account=E2=80=99s security.The Google Accounts=
 teamThis email can't receive replies. For more in=
formation, visit the Google Accounts Help Center.You received this mandatory email service announcement to=
 update you about important changes to your Google product or account.=
© 2017 Google Inc., 1600 Amphitheatre Parkway, Mountain View=
, CA 94043, USAet:68
--94eb2c0762b0ec2da405589c58ad--

How, besides basic social blunders on the attacker's end, can I recognize the phishing?

--UPDATE--

I started writing the note below as a comment to an answer, then realized I should have put this in the question from the beginning. I wrote:

One comment that I probably should have added: I have a main email address, christos.jonathan.hayward@gmail.com, which can send email through several addresses, including sending email from jonathan.hayward@pobox.com by logging into pobox servers. The second address has no separate Gmail account, just a passport to get in to pobox.com and send emails, if you will. I read the quoted email from the first address, which does not seem impaired in any way.

And more specifically, I've sent test emails to and from jonathan.hayward@pobox.com. All of them have gotten through uneventfully.

Check here: https://myaccount.google.com what is happening with your account, and change your password as soon as possible, because your email can be found in many public dumps - check - https://haveibeenpwned.com/. — Mirsad, Sep 08 '17 at 02:27

score 6 · Answer 1 · answered Sep 08 '17 at 02:15

The first indication that this is not a phishing email is that there's no link included, nor are there instructions to navigate to a specific domain or URL. The email only directs you to log in to your account, which you'll do through a URL that you already know to be trustworthy.

Looking into the headers, the receiving server has added these:

Authentication-Results: mx.google.com; dkim=pass header.i=@accounts.google.com header.s=20161025 header.b=f6IaG5Yo; spf=pass (google.com: domain of srs0=jfi5=ai=gaia.bounces.google.com=3vxqxwqgtaoirs-vitpceggsyrxw.ksskpi.gsq@bounce2.pobox.com designates 64.147.108.55 as permitted sender) smtp.mailfrom=SRS0=jFi5=AI=gaia.bounces.google.com=3VXqxWQgTAOIRS-VITPcEGGSYRXW.KSSKPI.GSQ@bounce2.pobox.com; dmarc=pass (p=REJECT sp=REJECT dis=NONE) header.from=accounts.google.com

This indicates that the receiving server mx.google.com has validated that the sender is who they claim to be, passing SPF and DKIM checks (as indicated by spf=pass and dkim=pass).

Additionally, this header contains header.from=accounts.google.com, telling us that when Google's receiving server got this email, the From header contained an address at accounts.google.com.

For whatever reason, Gmail appears to have changed this header to simply read Google, presumably to indicate to the user that it's confirmed to be sent by Google itself.

Conclusion: the email is legitimate.

Thank you; could you review the update at the bottom of my email? There's something puzzling me in that jonathan.hayward@pobox.com is not a full-fledged Gmail account. — Christos Hayward, Sep 09 '17 at 12:42

Steffen Ullrich · Answer 2 · 2017-09-08T09:52:16.537

It is hard to tell if the mail is fake but there are some strange things in it - which might or might due to the way you provided the source code of the mail:

The HTML part claims to be quoted-printable UTF-8 and thus should not contain any non-ASCII characters unencoded. But, what you provided contains a clear '©' which would need to be encoded.
The DKIM signature does not match the body of the mail. But again, this might be a problem of how you provided the source of the mail.
There is no Message-ID given (i.e. empty). Again, this might be a problem how you've provided the source code
Similar there is no email in the 'From: ..' header but only 'Google'. Given that other headers claim to have a successful DMARC validation this should not be possible since DMARC requires a valid From header which must match the domain of the DKIM signature.

My guess is that you actually don't provide the full and exact source code of the mail for validation, either because you've tried to remove some information or because of the way this source was provided to you from the mail program you use. In this case the source is not of much use for further analysis.

score 0 · Answer 3 · answered Sep 07 '17 at 22:56

From: Google looks suspicious in this one. Legitimate email will have some sort or sent address, even if it is a noreply@.

Some phishing email is particularly well crafted though, so the advice I always give people is that if you receive an email with a link that you are unsure about, either:

Browse to the organization's site that the email claims to be from yourself. By initiating the communication, you know who you are talking to, rather than risking a possibly dodgy link in an email. In this instance, you'll know quickly if your Google account is locked out.
Contact the vendor. Tricky when that is google, but if it was a bank, for example, they would be able to tell you if the email was legitimate.

Hope that helps.

what is in the email that could be a phishing attack? nothing. there are no links, and nothing that directs you to a website or a place that could pretend to be Google. — Keith M, Sep 08 '17 at 05:13

What is going on in what looks like an attack that checks out?

3 Answers3

Linked