{"id":1752628,"date":"2026-07-22T14:41:16","date_gmt":"2026-07-22T12:41:16","guid":{"rendered":"https:\/\/blog.wedos.com\/?p=1752628"},"modified":"2026-07-23T08:16:43","modified_gmt":"2026-07-23T06:16:43","slug":"prisel-vam-spam-dokazete-ho-rozlisit-od-bezneho-e-mailu","status":"publish","type":"post","link":"https:\/\/blog.wedos.com\/cs\/prisel-vam-spam-dokazete-ho-rozlisit-od-bezneho-e-mailu","title":{"rendered":"P\u0159i\u0161el v\u00e1m spam. Dok\u00e1\u017eete ho rozli\u0161it od b\u011b\u017en\u00e9ho e-mailu?"},"content":{"rendered":"\n

\u201eVa\u0161e slu\u017eba byla pozastavena, obnovte ji nyn\u00ed.“ Zpr\u00e1va vypad\u00e1, \u017ee p\u0159i\u0161la od n\u00e1s, zmi\u0148uje va\u0161i dom\u00e9nu a tla\u010d\u00ed na okam\u017eitou akci. Jen\u017ee od n\u00e1s nen\u00ed. Podvodn\u00e9 e-maily vyd\u00e1vaj\u00edc\u00ed se za poskytovatele hostingu a dom\u00e9n jsou dnes b\u011b\u017en\u00e1 v\u011bc a m\u00ed\u0159\u00ed p\u0159esn\u011b na majitele dom\u00e9n, tedy i na v\u00e1s. V tomto \u010dl\u00e1nku uk\u00e1\u017eeme na skute\u010dn\u00e9m zachycen\u00e9m vzorku, jak takov\u00fd podvod poznat, a hlavn\u011b jak spolehliv\u011b rozeznat n\u00e1\u0161 e-mail od ciz\u00edho.<\/p>\n\n\n\n\n\n\n\n

Jak vypad\u00e1 e-mail od n\u00e1s<\/h2>\n\n\n\n

Prvn\u00ed a nejd\u016fle\u017eit\u011bj\u0161\u00ed kontrola je dom\u00e9na odes\u00edlatele, tedy to, co je v adrese za zavin\u00e1\u010dem. Na\u0161e zpr\u00e1vy p\u0159ich\u00e1zej\u00ed v\u00fdhradn\u011b z na\u0161ich ov\u011b\u0159en\u00fdch dom\u00e9n: @vedos.cz<\/strong>, @wedos.com<\/strong>, p\u0159\u00edpadn\u011b z dal\u0161\u00edch na\u0161ich dom\u00e9n jako wedos.tools. Nic jin\u00e9ho. \u017d\u00e1dn\u00e1 varianta, \u017e\u00e1dn\u00e1 obm\u011bna, \u017e\u00e1dn\u00e9 dopln\u011bn\u00e9 slovo.<\/p>\n\n\n\n

Druh\u00fd spolehliv\u00fd znak je t\u00f3n. Nikdy netla\u010d\u00edme na okam\u017eitou akci.<\/strong> Nepos\u00edl\u00e1me zpr\u00e1vy typu \u201eIHNED OV\u011a\u0158TE“, \u201eZAPLA\u0164TE DO 24 HODIN“ ani \u201eOBNOVTE NYN\u00cd, JINAK O DOM\u00c9NU P\u0158IJDETE“. Um\u011bl\u00fd \u010dasov\u00fd n\u00e1tlak je klasick\u00fd n\u00e1stroj podvodn\u00edk\u016f, proto\u017ee vystra\u0161en\u00fd \u010dlov\u011bk klikne d\u0159\u00edv, ne\u017e za\u010dne p\u0159em\u00fd\u0161let. Pokud v\u00e1m zpr\u00e1va na\u0161\u00edm jm\u00e9nem vyhro\u017euje term\u00ednem v \u0159\u00e1du hodin, nen\u00ed od n\u00e1s.<\/p>\n\n\n\n

Pozn\u00e1vac\u00ed znamen\u00ed: \u010desk\u00e9 form\u00e1tov\u00e1n\u00ed textu a \u010d\u00edsel<\/h2>\n\n\n\n

V na\u0161ich \u010desk\u00fdch zpr\u00e1v\u00e1ch d\u016fsledn\u011b pou\u017e\u00edv\u00e1me standardn\u00ed \u010desk\u00e9 form\u00e1tov\u00e1n\u00ed textu i \u010d\u00edsel. Podvodn\u00e9 e-maily naopak vznikaj\u00ed hromadn\u011b a strojov\u00fdm p\u0159ekladem, tak\u017ee je \u010dasto prozrad\u00ed pr\u00e1v\u011b detaily, kter\u00fdch si rodil\u00fd mluv\u010d\u00ed v\u0161imne na prvn\u00ed pohled: desetinn\u00e1 te\u010dka m\u00edsto \u010d\u00e1rky, symbol m\u011bny p\u0159ed \u010d\u00e1stkou, americk\u00fd form\u00e1t data nebo chyb\u011bj\u00edc\u00ed diakritika.<\/p>\n\n\n\n

Jak to p\u00ed\u0161eme my<\/th>Typick\u00fd podvod<\/th><\/tr><\/thead>
1 234,50 K\u010d (desetinn\u00e1 \u010d\u00e1rka, mezera v tis\u00edc\u00edch, m\u011bna za \u010d\u00e1stkou)<\/td>1,234.50 K\u010d nebo K\u010d 1234.50 \u010di $ 49.99<\/td><\/tr>
21. 7. 2026<\/td>07\/21\/2026 nebo 2026-07-21<\/td><\/tr>
Spr\u00e1vn\u00e1 diakritika a p\u0159irozen\u00e1 \u010de\u0161tina<\/td>Chyb\u011bj\u00edc\u00ed h\u00e1\u010dky a \u010d\u00e1rky, kostrbat\u00e9 strojov\u00e9 formulace<\/td><\/tr>
Osloven\u00ed a souvisl\u00fd, v\u011bcn\u00fd text<\/td>Obecn\u00e9 \u201eV\u00e1\u017een\u00fd z\u00e1kazn\u00edku“ a poslepovan\u00e9 v\u011bty<\/td><\/tr><\/tbody><\/table><\/figure>\n\n\n\n

Samo o sob\u011b \u017e\u00e1dn\u00e9 z t\u011bchto znamen\u00ed nen\u00ed d\u016fkaz, i podvodn\u00edci se u\u010d\u00ed a n\u011bkter\u00e9 zpr\u00e1vy u\u017e maj\u00ed \u010de\u0161tinu slu\u0161nou. V kombinaci s kontrolou dom\u00e9ny odes\u00edlatele jde ale o rychl\u00fd prvn\u00ed filtr: zpr\u00e1va, kter\u00e1 tvrd\u00ed, \u017ee je od \u010desk\u00e9 firmy, a p\u0159itom po\u010d\u00edt\u00e1 s desetinnou te\u010dkou a americk\u00fdm datem, si zaslou\u017e\u00ed zv\u00fd\u0161enou pozornost d\u0159\u00edv, ne\u017e na cokoliv kliknete.<\/strong><\/p>\n\n\n\n

Jak vypad\u00e1 podvod<\/h2>\n\n\n\n

Podvodn\u00e9 adresy s\u00e1zej\u00ed na to, \u017ee \u010dtete zb\u011b\u017en\u011b. Typick\u00e9 vzory: dom\u00e9na, kter\u00e1 na\u0161e jm\u00e9no obsahuje, ale nen\u00ed na\u0161e, nap\u0159\u00edklad @verifed-vedos.cz<\/strong> nebo @manager-wedos.com<\/strong>. Oby\u010dejn\u00e1 freemailov\u00e1 schr\u00e1nka jako jack.black@gmail.com<\/strong>. Nebo \u00fapln\u011b n\u00e1hodn\u00e1 dom\u00e9na, kter\u00e1 s n\u00e1mi nem\u00e1 nic spole\u010dn\u00e9ho, t\u0159eba tom.bathory@medivalaged.cloud<\/strong>. Ve v\u0161ech p\u0159\u00edpadech plat\u00ed jednoduch\u00e9 pravidlo: rozhoduje p\u0159esn\u00e1 dom\u00e9na za zavin\u00e1\u010dem, ne jm\u00e9no, kter\u00e9 se zobrazuje p\u0159ed n\u00ed. Zobrazovan\u00e9 jm\u00e9no si toti\u017e odes\u00edlatel m\u016f\u017ee nastavit naprosto libovoln\u011b.<\/p>\n\n\n\n

Rozbor skute\u010dn\u00e9ho podvodu, kter\u00fd jsme zachytili<\/h2>\n\n\n\n

N\u00e1sleduj\u00edc\u00ed uk\u00e1zka je z re\u00e1ln\u00e9 zpr\u00e1vy doru\u010den\u00e9 z\u00e1kazn\u00edkovi (\u00fadaje p\u0159\u00edjemce jsme anonymizovali). P\u0159edm\u011bt zn\u011bl \u201evasedomena.cz: Slu\u017eba pozastavena, obnovte ji nyn\u00ed“ a jako odes\u00edlatel se zobrazovalo jm\u00e9no WEDOS. Pod\u00edvejme se, co prozrad\u00ed hlavi\u010dky:<\/p>\n\n\n\n

From: =?utf-8?b?V9CVRNCe0IU=?= <support@cizifirma-llc.com>\nTo: info@vasedomena.cz\nSubject: =?utf-8?q?vasedomena=2Ecz_=3ASlu=C5=BEba_pozastavena_...?=<\/code><\/pre>\n\n\n\n
T\u0159i pozoruhodn\u00e9 v\u011bci. Zaprv\u00e9, skute\u010dn\u00e1 adresa odes\u00edlatele je support@cizifirma-llc.com, dom\u00e9na, kter\u00e1 s n\u00e1mi nem\u00e1 nic spole\u010dn\u00e9ho. Zadruh\u00e9, zobrazovan\u00e9 jm\u00e9no je zak\u00f3dovan\u00e9 a po rozbalen\u00ed zn\u00ed \u201eW\u0415D\u041e\u0405“. Vypad\u00e1 jako WEDOS, ale p\u00edsmena \u0415, \u041e a \u0405 jsou ve skute\u010dnosti azbuka. \u00dato\u010dn\u00edk pou\u017eil takzvan\u00e9 homoglyfy, znaky z jin\u00e9 abecedy, kter\u00e9 jsou na pohled k nerozezn\u00e1n\u00ed od latinky, aby obe\u0161el filtry hledaj\u00edc\u00ed slovo WEDOS. A zat\u0159et\u00ed, p\u0159edm\u011bt obsahuje va\u0161i dom\u00e9nu a n\u00e1tlak na okam\u017eitou akci, p\u0159esn\u011b ten, kter\u00fd my nikdy nepou\u017e\u00edv\u00e1me.<\/p>\n\n\n\n
Received-SPF: pass (cizifirma-llc.com: Sender is authorized ...)\nDKIM-Signature: v=1; a=rsa-sha256; d=cizifirma-llc.com; s=aliyun-ap-southeast-1; ...\nX-Spamd-Result: ... DMARC_POLICY_ALLOW(-0.50)[cizifirma-llc.com,none]; ...<\/code><\/pre>\n\n\n\n
A te\u010f to nejz\u00e1ludn\u011bj\u0161\u00ed: SPF pro\u0161lo, DKIM pro\u0161lo, DMARC pro\u0161lo. Znamen\u00e1 to, \u017ee je zpr\u00e1va v po\u0159\u00e1dku? V\u016fbec ne. V\u0161echny t\u0159i kontroly pro\u0161ly pro dom\u00e9nu \u00fato\u010dn\u00edka<\/strong>. Podvodn\u00edk si svoji dom\u00e9nu cizifirma-llc.com technicky nastavil spr\u00e1vn\u011b, co\u017e mu nic nebr\u00e1n\u00ed ud\u011blat. Zelen\u00e1 fajfka u SPF a DKIM tedy \u0159\u00edk\u00e1 jen \u201eodes\u00edlatel je opravdu ten, za koho se vyd\u00e1v\u00e1 jeho dom\u00e9na“. Ne\u0159\u00edk\u00e1 nic o tom, jestli t\u00e9 dom\u00e9n\u011b m\u00e1te v\u011b\u0159it. Rozhoduj\u00edc\u00ed ot\u00e1zka v\u017edy zn\u00ed: je to dom\u00e9na, od kter\u00e9 zpr\u00e1vu \u010dek\u00e1m?<\/strong><\/p>\n\n\n\n
X-Spam-Status: Yes, score=6.99\nX-Spamd-Result: ... BAYES_SPAM(6.89)[95.46%]; MANY_INVISIBLE_PARTS(1.00)[10];\n    URL_IN_SUBJECT(0.40)[vasedomena.cz]; ...\nX-Spam-Flag: YES<\/code><\/pre>\n\n\n\n
Spamov\u00fd filtr na serveru zpr\u00e1vu spr\u00e1vn\u011b vyhodnotil: sk\u00f3re 6,99, bayesovsk\u00fd klasifik\u00e1tor si byl podvodem jist\u00fd na 95 %, a mezi p\u0159\u00edznaky sv\u00edt\u00ed i deset neviditeln\u00fdch \u010d\u00e1st\u00ed v obsahu (trik na oklam\u00e1n\u00ed filtr\u016f) a adresa va\u0161\u00ed dom\u00e9ny v p\u0159edm\u011btu. Zpr\u00e1va byla ozna\u010dena jako spam. Ne ka\u017ed\u00fd podvod ale filtr zachyt\u00ed se stejnou jistotou, proto se vyplat\u00ed um\u011bt \u010d\u00edst hlavi\u010dky vlastn\u00edma o\u010dima.<\/p>\n\n\n\n
\n
Je va\u0161e dom\u00e9na podvr\u017eiteln\u00e1?<\/h3>\n\n\n\n
V\u0161imn\u011bte si, \u017ee si podvodn\u00edk na sv\u00e9 dom\u00e9n\u011b korektn\u011b nastavil SPF i DKIM. A te\u010f obr\u00e1cen\u011b: pokud je nem\u00e1te spr\u00e1vn\u011b nastaven\u00e9 vy, m\u016f\u017ee kdokoliv rozes\u00edlat e-maily p\u0159\u00edmo jm\u00e9nem va\u0161\u00ed dom\u00e9ny<\/strong>. Ov\u011b\u0159te si to zdarma b\u011bhem p\u00e1r sekund.<\/p>\n\n\n\n
\n
Zkontrolovat dom\u00e9nu<\/a><\/div>\n<\/div>\n<\/div><\/div>\n\n\n\n
Jak si hlavi\u010dky zobrazit u va\u0161eho poskytovatele<\/h2>\n\n\n\n
V Gmailu<\/strong> otev\u0159ete zpr\u00e1vu, klikn\u011bte na t\u0159i te\u010dky vpravo naho\u0159e a zvolte Zobrazit origin\u00e1l. Naho\u0159e rovnou uvid\u00edte p\u0159ehlednou tabulku s v\u00fdsledky SPF, DKIM a DMARC. V Outlooku<\/strong> (web) otev\u0159ete zpr\u00e1vu, t\u0159i te\u010dky, Zobrazit, Zobrazit podrobnosti zpr\u00e1vy. V Seznam Emailu<\/strong> otev\u0159ete zpr\u00e1vu a v menu zvolte Zobrazit hlavi\u010dky, p\u0159\u00edpadn\u011b Zdrojov\u00fd k\u00f3d zpr\u00e1vy. V Thunderbirdu<\/strong> sta\u010d\u00ed kl\u00e1vesov\u00e1 zkratka Ctrl+U.<\/p>\n\n\n\n
Na co se v hlavi\u010dk\u00e1ch d\u00edvat p\u0159edev\u0161\u00edm: \u0159\u00e1dek From<\/strong> a skute\u010dn\u00e1 dom\u00e9na v n\u011bm (pozor na zobrazovan\u00e9 jm\u00e9no, to nic nedokazuje). \u0158\u00e1dek Return-Path<\/strong>, tedy kam se vracej\u00ed nedoru\u010denky, u podvod\u016f se \u010dasto li\u0161\u00ed nebo m\u00ed\u0159\u00ed na podivnou dom\u00e9nu. \u0158\u00e1dky Received-SPF<\/strong> a Authentication-Results<\/strong>, kde vid\u00edte, pro jakou dom\u00e9nu ov\u011b\u0159en\u00ed prob\u011bhlo. A stavov\u00e9 \u0159\u00e1dky spamov\u00e9ho filtru jako X-Spam-Status<\/strong> nebo X-Spamd-Result, kde je sk\u00f3re i konkr\u00e9tn\u00ed d\u016fvody. Pokud dom\u00e9na ve From nen\u00ed na\u0161e ov\u011b\u0159en\u00e1 dom\u00e9na, d\u00e1l nemus\u00edte nic zkoumat.<\/p>\n\n\n\n
Pro\u010d to nejde jednou prov\u017edy zastavit<\/h2>\n\n\n\n
Tyto kampan\u011b aktivn\u011b monitorujeme a ka\u017ed\u00fd nahl\u00e1\u0161en\u00fd vzorek analyzujeme. Realita je ale takov\u00e1, \u017ee jsou prakticky neposti\u017eiteln\u00e9: ka\u017ed\u00e1 vlna p\u0159ich\u00e1z\u00ed z jin\u00e9 dom\u00e9ny a od jin\u00e9ho odes\u00edlatele, dom\u00e9ny jsou registrovan\u00e9 na jedno pou\u017eit\u00ed, infrastruktura s\u00eddl\u00ed v zahrani\u010d\u00ed a ne\u017e se cokoliv dohled\u00e1, kampa\u0148 u\u017e neexistuje a b\u011b\u017e\u00ed dal\u0161\u00ed s nov\u00fdm jm\u00e9nem. Proto je nej\u00fa\u010dinn\u011bj\u0161\u00ed obranou informovan\u00fd p\u0159\u00edjemce, tedy vy. \u017d\u00e1dn\u00fd filtr sv\u011bta nenahrad\u00ed dv\u011b sekundy, kter\u00e9 v\u011bnujete pohledu na dom\u00e9nu za zavin\u00e1\u010dem.<\/p>\n\n\n\n
Co d\u011blat, kdy\u017e si nejste jist\u00ed<\/h2>\n\n\n\n
Neklikejte na \u017e\u00e1dn\u00fd odkaz ve zpr\u00e1v\u011b. Pokud zpr\u00e1va tvrd\u00ed, \u017ee m\u00e1te probl\u00e9m se slu\u017ebou nebo dom\u00e9nou, otev\u0159ete si administraci sami: napi\u0161te adresu do prohl\u00ed\u017ee\u010de ru\u010dn\u011b nebo pou\u017eijte z\u00e1lo\u017eku a stav slu\u017eby si ov\u011b\u0159te p\u0159\u00edmo tam. Skute\u010dn\u00fd probl\u00e9m by tam byl vid\u011bt. A pokud chcete m\u00edt jistotu, nebo n\u00e1m chcete podez\u0159elou zpr\u00e1vu nahl\u00e1sit, kontaktujte na\u0161i podporu, nejl\u00e9pe i s kompletn\u00edmi hlavi\u010dkami zpr\u00e1vy. Pom\u016f\u017eete t\u00edm nejen sob\u011b, ale i v\u0161em ostatn\u00edm, kter\u00fdm stejn\u00e1 vlna pr\u00e1v\u011b p\u0159ist\u00e1v\u00e1 ve schr\u00e1nce.<\/p>\n\n\n\n
Shrnuto do jedn\u00e9 v\u011bty: n\u00e1\u0161 e-mail pozn\u00e1te podle p\u0159esn\u00e9 dom\u00e9ny @vedos.cz, @wedos.com nebo dal\u0161\u00edch na\u0161ich ov\u011b\u0159en\u00fdch dom\u00e9n, a podle toho, \u017ee v\u00e1s nikdy netla\u010d\u00edme k okam\u017eit\u00e9 platb\u011b \u010di ov\u011b\u0159en\u00ed. Cokoliv jin\u00e9ho, jakkoliv v\u011brohodn\u011b to vypad\u00e1, si zaslou\u017e\u00ed dv\u011b sekundy podez\u0159en\u00ed a pohled do hlavi\u010dek. A pokud jste to je\u0161t\u011b neud\u011blali, ov\u011b\u0159te si, jestli nen\u00ed podvr\u017eiteln\u00e1 i va\u0161e vlastn\u00ed dom\u00e9na<\/a>.<\/p>\n\n\n\n
P\u0159\u00edklady, jak m\u016f\u017ee spam vypadat:<\/h2>\n\n\n\n
\n
\n
\n
\n
\"\"\n\t\t\t\n\t\t\t\t\n\t\t\t<\/svg>\n\t\t<\/button><\/figure>\n\n\n\n
\"\"\n\t\t\t\n\t\t\t\t\n\t\t\t<\/svg>\n\t\t<\/button><\/figure>\n\n\n\n
\"\"\n\t\t\t\n\t\t\t\t\n\t\t\t<\/svg>\n\t\t<\/button><\/figure>\n<\/figure>\n<\/div>\n<\/div>\n<\/div><\/div>\n","protected":false},"excerpt":{"rendered":"
\u201eVa\u0161e slu\u017eba byla pozastavena, obnovte ji nyn\u00ed.“ Zpr\u00e1va vypad\u00e1, \u017ee p\u0159i\u0161la od n\u00e1s, zmi\u0148uje va\u0161i dom\u00e9nu a tla\u010d\u00ed na okam\u017eitou akci. Jen\u017ee od n\u00e1s nen\u00ed. Podvodn\u00e9 e-maily vyd\u00e1vaj\u00edc\u00ed se za poskytovatele hostingu a dom\u00e9n jsou dnes b\u011b\u017en\u00e1 v\u011bc a m\u00ed\u0159\u00ed p\u0159esn\u011b na majitele dom\u00e9n, tedy i na v\u00e1s. V tomto \u010dl\u00e1nku uk\u00e1\u017eeme na skute\u010dn\u00e9m zachycen\u00e9m … <\/p>\n
Pokra\u010dovat ve \u010dten\u00ed „P\u0159i\u0161el v\u00e1m spam. Dok\u00e1\u017eete ho rozli\u0161it od b\u011b\u017en\u00e9ho e-mailu?“<\/span><\/a><\/p>\n","protected":false},"author":16,"featured_media":1752631,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[3],"tags":[],"class_list":["post-1752628","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-spolecnost"],"_links":{"self":[{"href":"https:\/\/blog.wedos.com\/cs\/wp-json\/wp\/v2\/posts\/1752628","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/blog.wedos.com\/cs\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/blog.wedos.com\/cs\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/blog.wedos.com\/cs\/wp-json\/wp\/v2\/users\/16"}],"replies":[{"embeddable":true,"href":"https:\/\/blog.wedos.com\/cs\/wp-json\/wp\/v2\/comments?post=1752628"}],"version-history":[{"count":12,"href":"https:\/\/blog.wedos.com\/cs\/wp-json\/wp\/v2\/posts\/1752628\/revisions"}],"predecessor-version":[{"id":1754145,"href":"https:\/\/blog.wedos.com\/cs\/wp-json\/wp\/v2\/posts\/1752628\/revisions\/1754145"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/blog.wedos.com\/cs\/wp-json\/wp\/v2\/media\/1752631"}],"wp:attachment":[{"href":"https:\/\/blog.wedos.com\/cs\/wp-json\/wp\/v2\/media?parent=1752628"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/blog.wedos.com\/cs\/wp-json\/wp\/v2\/categories?post=1752628"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/blog.wedos.com\/cs\/wp-json\/wp\/v2\/tags?post=1752628"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}