Threat Level: green Handler on Duty: Manuel Humberto Santander Pelaez

SANS ISC: Bogus emails: Amazon.com - Your Cancellation SANS ISC InfoSec Forums

Watch ISC TV. Great for NOCs, SOCs and Living Rooms: https://isctv.sans.edu

Sign Up for Free!   Forgot Password?
Log In or Sign Up for Free!
Bogus emails: Amazon.com - Your Cancellation

There are bogus order cancellation emails going around claiming to be from Amazon like this:


Dear Customer,

Your order has been successfully canceled. For your reference, here's a summary of your order:

You just canceled order 15-6698-2492 placed on May 9, 2012.Status: CANCELED

_____________________________________________________________________


1 "Mulberry"; 2006, Special Edition

  By: Sorcha Stewart


Sold by: Amazon.com LLC


_____________________________________________________________________


Thank you for visiting Amazon.com!


---------------------------------------------------------------------

Amazon.com

Earth's Biggest Selection

http://www.amazon.com

---------------------------------------------------------------------


The 15-6698-2492 in the copy I received linked to the URL http://repdesign.pt/requires.html which contains this is in the body:
<script type="text/javascript">window.location="http://leibypharmacylevitra.com";</script>

the web server seems to be down:
--2012-05-09 13:43:19--  (try: 7)  http://leibypharmacylevitra.com/Connecting to leibypharmacylevitra.com|37.157.249.2|:80... 

 
It is probably safe to assume that the content of that site is not user friendly.
Here is the full content of the page at repdesign.pt:
<html><head><script type="text/javascript">window.location="http://leibypharmacylevitra.com";</script></head><body><a href="http://leibypharmacylevitra.com">Click</a></body></html>
 
--
Dan
Handler ISC
 
 

Dan

42 Posts
No offense, but this is hardly a new or unusual occurrence. The link is probably to a Canadian pharmacy site. We've seen thousands of similar emails going back more than a year from spoofed/forged sources besides amazon, e.g. ups, usps, linkedin, verizonwireless, bbb, bankofamerica ....
Anonymous
No offense taken, you are correct that these types of emails are not new. However they do come in different forms over time and they keep coming because they are effective. A little reminder can't hurt.
Dan

42 Posts
Thanks for the info. I received an "Amazon cancellation email" this morning noting that I had successfully cancelled my order for "Verdict". Didn't open and warnings flashed as well. It looks like it might be an Amazon response email, but I spamed it away. Thanks again for your posted comments.
Dan
1 Posts

Sign Up for Free or Log In to start participating in the conversation!