Subject: New Reply Received - Re: Vulnerability report -No DMARC record found / NO DEMARC REJECT POLICY
From: Max <[email-masked]>
To: [email-masked]
Date: Thu, 30 Jan 2020 13:47:52 +0000

Hi Nikhil Bishnoi,  The customer has responded to the ticket.  Re: Vulnerability report -No DMARC record found / NO DEMARC REJECT POLICY  Ticket comment <div dir="ltr">  Hi there ,<br>I disagree with your remarks , after visiting the landmarkgroup i found maxfashion under brands tags. this issue is for maxhfasion specifically, and its valid as you can see the forged mail is landing in inbox. when i saw the record for <a href="http://landmarkgroup.com/" target="_blank" rel="noreferrer">landmarkgroup.com</a> it also has no DMARC record publish and reject policy enabled . also the landmark group has no email available on website but they do have a contact form, once an attacker sends any message via support form he can know the email for landmark and can send a forged or fake email from it. but for maxfasion the contact email is given on website which was used earlier in my report for demo .<br>S.S of Dmarc record is attached below for <a href="http://landmarkgroup.com/" target="_blank" rel="noreferrer">landmarkgroup.com</a><br>Let me know if you want me to forged an email to any specific address. will be happy to assist. with that being said I would like to ask you to reconsider the validation of the bug and bounty reward for it . Will be reporting my future findings afterwards. <br><br>As I  received and send the same message from splashfasion. I'm expecting that you are from the same team. so kindly respond to me in a genuine way. It may happen that i have reported other brands this same bug too from this email address so , I apologize for that as i had no idea for that its related to <a href="http://landmarkgroup.com" rel="noreferrer">landmarkgroup.com</a>. this issue may be with other brand website too.  So you can publish the record and enable reject policy for all those emails. and can give a reasonable bounty reward for pointing out this issue for all websites. If you want me to send images of dmarc record for other website to then it's fine I will be happy to help.<br><br><br><br>Best Regards   <br><div><br></div>
<div><div>
<img src="https://attachment.freshdesk.com/inline/attachment?token=eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.eyJpZCI6MjA0MzA4MzExMTYwNCwiZG9tYWluIjoibGFuZG1hcmtncm91cHNlcnZpY2UuZnJlc2hkZXNrLmNvbSIsImFjY291bnRfaWQiOjExMjUxNTZ9.spqjXPzG2BFo-sq3W9RTYBrT5yG8yCmrln6J714m4YI" alt="image.png" width="514" height="247"><br>
</div></div>
</div>
<br><div class="gmail_quote"><div dir="ltr" class="gmail_attr"></div></div>
<div class="freshdesk_quote"><blockquote class="freshdesk_quote">
<div>On Thu, 30 Jan 2020 at 05:34, Max &lt;<a href="mailto:[email-masked]" rel="noreferrer">[email-masked]</a>&gt; wrote:<br>
</div>
<blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex"><div style='font-family:-apple-system,BlinkMacSystemFont,"Segoe UI",Roboto,"Helvetica Neue",Arial,sans-serif;font-size:14px'>
	<div style='font-family:-apple-system,BlinkMacSystemFont,"Segoe UI",Roboto,"Helvetica Neue",Arial,sans-serif;font-size:14px'>
<div dir="ltr">
<div>Hi Husnain,</div>
<div>​<br>
</div>
<div>Thank
you for getting in touch with us.
<div> </div>
<div>This
doesn’t look like something related to the Landmark Group. To know more about
the Landmark Group, visit <a href="http://www.landmarkgroup.com" rel="noreferrer" target="_blank">www.landmarkgroup.com</a>
</div>
<div> </div>
<div>
<div>Your friends,</div>
<div dir="ltr">The Support Team</div>
</div>
</div>
</div>
<div dir="ltr"><div><br></div></div>
</div>

	

</div></blockquote>
</blockquote></div>  https://landmarkgroupservice.freshdesk.com/helpdesk/tickets/433154