Bogus e-mail

[Screechey21]

I just recieved what looks like a genuine e-mail that begins with "We've improved your security.
Please download the latest firmware to stay up-to-date. "

Directly below this it says "LEARN HOW TO DOWNLOAD"  This part you can click, but on closer inspection and after checking for a update myself via logging into my router, it would appear there is no update and this e-mail is most likely fake so DO NOT click the link as it is most likely mallware.

Thank you

[antinode · Accepted solution]

> I just recieved what looks like a genuine e-mail that begins with
> "We've improved your security. [...]

   I got one, too.  As shown by information in the e-mail header, mine
came from "mta2.e.netgear.com (136.147.187.62)", which is whence a
legitimate such message might come.  In-line pictures in these forums
are delayed untl a moderator approves, so I can't (yet) see what you
got, and, in any case, the important stuff is not visible in a picture.
The important stuff is in the e-mail header, and the actual link
target(s), not in a picture of the e-mail message.

   The message which I got looks genuine, too.  Because it is.  I don't
know what you got, but I suspect that it's similar.

> [...] this e-mail is most likely fake so DO NOT click the link as it
> is most likely mallware.

   Not really.  When Netgear has some new firmware which is supposed to
solve some security problem for some device model, it typically notifies
every Netgear owner whose e-mail address is on record, whether or not
the update applies to any device owned by the recipient.  And the
message doesn't say that, so victims tend to worry when no applicable
update is found.  It does, however, say the following:

      For more information about the security enhancements, please visit
      our Security Advisory Page and enter your model number in the
      Security Advisory Search box, then press Enter.

   That "Security Advisory Page" link also points to a "netgear.com"
address, so there's no particular reason to suspect it, either.

   Perhaps it would be more helpful to learn how to identify actual
problems _before_ posting "bogus" panicky warnings about legitimate
(although lame) notifications from Netgear.

[antinode · Accepted solution]

> I just recieved what looks like a genuine e-mail that begins with
> "We've improved your security. [...]

   I got one, too.  As shown by information in the e-mail header, mine
came from "mta2.e.netgear.com (136.147.187.62)", which is whence a
legitimate such message might come.  In-line pictures in these forums
are delayed untl a moderator approves, so I can't (yet) see what you
got, and, in any case, the important stuff is not visible in a picture.
The important stuff is in the e-mail header, and the actual link
target(s), not in a picture of the e-mail message.

   The message which I got looks genuine, too.  Because it is.  I don't
know what you got, but I suspect that it's similar.

> [...] this e-mail is most likely fake so DO NOT click the link as it
> is most likely mallware.

   Not really.  When Netgear has some new firmware which is supposed to
solve some security problem for some device model, it typically notifies
every Netgear owner whose e-mail address is on record, whether or not
the update applies to any device owned by the recipient.  And the
message doesn't say that, so victims tend to worry when no applicable
update is found.  It does, however, say the following:

      For more information about the security enhancements, please visit
      our Security Advisory Page and enter your model number in the
      Security Advisory Search box, then press Enter.

   That "Security Advisory Page" link also points to a "netgear.com"
address, so there's no particular reason to suspect it, either.

   Perhaps it would be more helpful to learn how to identify actual
problems _before_ posting "bogus" panicky warnings about legitimate
(although lame) notifications from Netgear.