- Joined
- Jul 4, 2015
- Messages
- 8,983
- Thread Author
- #1
I thought it might be fun and informative to start a series on real phishing emails and calling out the indicators of why they are suspicious. One of my old email addresses has been in a lot of data breaches so it tends to receive a lot of spam and phishing emails.
Without further ado here is the email.
(1) The first sign of a suspicious email is a weird subject line that is vague and does not reference something specific
(2) The sender, Prime (maybe trying to pretend to be Amazon Prime), but the actual email is @gmail.com. No business save for mom/pop shops will send from a gmail email
(3) Weird random characters, definitely does not look professional (looks like base64 encoding, but does not translate to anything readable)
(4) The hook, hey I won a prize all I have to do is click the link... Never blindly click links. Hover over them and see if they look legitimate
(5) Another hook, get a prize if I click on the link.
There are three links in this email. "Christmas Tree", the "Get Started" button and "uns" at the bottom.
All three point to the same thing
(Green) Probably an auto generated domain name, definitely suspect
(Orange) This could be some kind of tracking to my email as a victim. There is also another legit domain accounts.cragslist.org. Might even try something clever like generating a post with something I end up entering from this link such as credentials.
Domain is not very reputable
Link Removed
Safely Analyzing the URL
Looks like there are further redirects to buildwork.club domain (This could be intentional or an anti forensic effort)
Hard to see the screenshot but the link appears to be broken
Link Removed
Without further ado here is the email.
(1) The first sign of a suspicious email is a weird subject line that is vague and does not reference something specific
(2) The sender, Prime (maybe trying to pretend to be Amazon Prime), but the actual email is @gmail.com. No business save for mom/pop shops will send from a gmail email
(3) Weird random characters, definitely does not look professional (looks like base64 encoding, but does not translate to anything readable)
(4) The hook, hey I won a prize all I have to do is click the link... Never blindly click links. Hover over them and see if they look legitimate
(5) Another hook, get a prize if I click on the link.
There are three links in this email. "Christmas Tree", the "Get Started" button and "uns" at the bottom.
All three point to the same thing
(Green) Probably an auto generated domain name, definitely suspect
(Orange) This could be some kind of tracking to my email as a victim. There is also another legit domain accounts.cragslist.org. Might even try something clever like generating a post with something I end up entering from this link such as credentials.
Domain is not very reputable
Link Removed
Safely Analyzing the URL
Looks like there are further redirects to buildwork.club domain (This could be intentional or an anti forensic effort)
Hard to see the screenshot but the link appears to be broken
Link Removed
