Security

Fake “Amazon.com – Your Cancellation” e-mail

31 Comments

I received an item of e-mail reporting to be an Amazon order cancellation. It looked fairly authentic: to the untrained eye with some curiosity, you may be fooled into clicking on the ORDER DETAILS link. If you are in the UK, one of the key clues is the fact that this e-mail is reporting itself as originating from amazon.com – in the UK we would expect such e-mail to come from amazon.co.uk. The same could be said for other non-.com editions of the Amazon site.

Closer inspection reveals that the ORDER DETAILS link doesn’t goto an Amazon web-page, but to a completely different site…in this case you’ll be taken to a site that offers you tablets for helping make something bigger! However, there’s nothing to tell you how dangerous the destination site is…a single click can cause a lot of damage.

I use MailWasher Pro as my client-side anti-spam filtering tool, it’s kind enough to expand links in e-mails such that the true destination is revealed, as the screenshot below demonstrates:

The learning experience behind this blog post is that you should never trust links on face value. Always hover the mouse over the link and see where it ultimately leads to: if it’s not going where you expect it to be going, resist the temptation to “just click on it”! If hovering the mouse over the link doesn’t help you, see if you can find the message source (In Outlook right clicking on an e-mail, choosing Message Options lets you look at the “Internet Headers” and the raw message).

—

FYI, here’s the full body of the original e-mail.

Received: ... from forum.mbfpro.biz ([94.23.20.147])
by twx8...com with smtp (Exim 4.69)
(envelope-from )
id 1No5Qd-0001Xk-S3
for ...; Sun, 07 Mar 2010 01:37:14 +0000
Date: Sat, 6 Mar 2010 23:59:45 +0400 (UTC)
From: "order-update@amazon.com"
To:
Message-ID: <151840.7152476933828043636.JavaMail.correios@na-mm-relay.amazon.com>
Subject: Amazon.com - Your Cancellation (0713-48571-25595)
MIME-Version: 1.0
Content-Type: text/html; charset=UTF-8
Content-Transfer-Encoding: 7bit
X-AMAZON-CLIENT-HOST: online-gp-48l06.iad9.amazon.com
Bounces-to: 20103c7b52838824c217f09b0630caf76b94d527f4@bounces.amazon.com
X-AMAZON-MAIL-RELAY-TYPE: notification
X-AMAZON-RTE-VERSION: 2.0
X-Spam-Status: No, score=4.1
X-Spam-Score: 41
X-Spam-Bar: ++++
X-Spam-Flag: NO

<html>
<head>
<title>Amazon.com - Your Cancellation
</head>
<body bgcolor="#FFFFFF" link="#0066CC">

Dear Customer,
<br />
Your order has been successfully canceled. For your reference, here`s a summary of your order:<br />

You just canceled order #859-8266172-041110

<br />Status: CANCELED

_____________________________________________________________________<br />

<a href="http://almedicgroup.com/robbie.html">ORDER DETAILS</a><br />
Sold by: Amazon.com, LLC
<br />
_____________________________________________________________________<br /><br />