Spam Warning: Automated Intuit  Notification

This email has been spotted this week:

Spam Warning: Apple Alert Regarding Your Recent Purchase

This email has been seen by a number of people this week - it is not a particularly convincing one, but it deserves to be mentioned in case it may cauase any damage...

The email appears as:

The email addres obviously doesn't stack as it is from [email protected] and not Apple and the link described as see details here is pointing to http://dryerventwizarduniversity.mobi?3I=QIUBNYQASHUBQYUDP which again isn't a very convincing domain as it doesn't even have Apple in it.

If you do click the link you are taken to a non-existant website and so the email can do no harm:

Either way this email shoudl be marked as spam and the address marked as a spam source.

The IdealOfficeInc.com has no SPF record: 

and so this may well be why it was chosen. SPF (Sender Policy Framework) is a simple way of informing other email servers of which IP addresses your emails are likely to originate from and not having one means that poeple are more likely to spoof your address as we see in this case.

At sircles we would always advise having a full SPF and DKIM/DMARC set of records to stop spammers impersonating you.

Spam Warning: OnlineInvoices Automated Service Notice

This email has been seen both this week and last week, and is obviously a phishing attack.

The email itself looks fairly harmless,but there is a real company by this name that sends out invoices and so customers could easily be duped.

The HTML version is as follows:

Now the link 'See Invoice' actually points to: http://itzzs.net?7l=QAUSY1CQVUFS1QXOBsGSJTHS which is sort of dangerous as the original company was started by Izzam group which sort of resembles this link, but if you are being careful you will notice that this link is bogus before proceeding too much further.

We can also see that the originating email address is: [email protected] which is obviously incorrect.

If we attempt to visit the site, we can see that it has already been shut down:

And so no longer poses a threrat.

Please do report these emails as spam as well as this site if you get the chance.

You can see how here: https://blog.sircles.net/post/2018/05/17/reporting-fraudulent-websites-with-your-browser