From Pine View Farm

I Get Mail Spam 0

This one was from

no rep Iy @ amazo n.co m

Following that was this string:

auto.confirm-[nonsense sequence of letters and numbers]@webmails-service.com/

It claimed that my account with a retail establishment was on hold because reasons.

I logged into said account, going to it directly on a whole nother computer. The account was not on hold.

Note the spaces in the sender address and the “I” instead of an “l” in “no rep Iy.”

An inspection of the headers showed that the message was sent from a NAT address and therefore, for all practical purpose, untraceable. I used whois and dig to track down webmails-service.com and the results were most interesting. Needless to say, they had nothing to do with said retail establishment.

You might want to give that a whirl, just to find out how dig and whois work. They are useful tools.

This has got to be one of the clumsiest phishing attempts I’ve ever seen.

Share

Comments are closed.