Would the FBI not establish first contact by mail, in person or at least on the phone? What kind of common sense thinks this is legit.
Is it general FUD (eroding FBI legitimacy) or a smear campaign against Vinny Troia..?
EDIT: Or it's a diversion of attention; there's something else going on somewhere else that they want to go unnoticed.
So they tried basic, stupid 419 type scams, with broken English.
They could have pried the entire org wide open - she had masses of private data in her inbox, enough to impersonate or social engineer your way to anywhere.
But instead, they blew it - and blew it so badly the client spent days investigating what this could have been a distraction for, as they pretty much couldn’t believe their luck at the minimal severity of the attack.
It’s like breaking into the federal reserve, thinking it’s a 7/11, and then stealing the ballpoint pens from the cashiers desks.
Either way, it was a helpful experience for them - a vaccination against further stupidity, and they all of a sudden started engaging on their ISMS with gusto and panache.
The IP address does belong to the fbi.gov (both forward and reverse DNS lookups check out).
The DKIM public key does exist at the given selector [0], but without the complete raw message, it is not possible to verify the signature. He also excluded the authentication-result header from his post.
[0] https://www.mailhardener.com/tools/dkim-validator?domain=cji...
A few other people on that thread got the same mail and did verify it. Either they're all sockpuppets or it verifies.