blog.malwarebytes.com Open in urlscan Pro
130.211.198.3  Public Scan

Form analysis
3 forms found in the DOM

<form><span class="fieldset">
    <p><input type="checkbox" value="check" id="chkMain" checked="checked" class="legacy-group-status optanon-status-checkbox"><label for="chkMain">Active</label></p>
  </span></form>

GET

<form id="search-form" onsubmit="submitSearchrightrail(event)" method="get">
  <div class="searchbar-wrap-rightrail">
    <label for="cta-labs-rightrail-search-submit-en" aria-label="cta-labs-rightrail-search-submit-en" aria-labelledby="cta-labs-rightrail-search-submit-en">
      <input type="text" id="st-search-input-rightrail" class="st-search-input-rightrail" placeholder="Search Labs">
    </label>
    <button type="submit" id="cta-labs-rightrail-search-submit-en" aria-label="Submit your search query"><span class=""><img src="https://blog.malwarebytes.com/wp-content/themes/mb-labs-theme/images/search.svg" alt="Magnifying glass"></span>
    </button>
  </div>
</form>

//www.malwarebytes.com/newsletter/

<form class="newsletter-form form-inline" action="//www.malwarebytes.com/newsletter/" _lpchecked="1">
  <div class="email-input">
    <label for="cta-footer-newsletter-input-email-en" aria-label="cta-footer-newsletter-input-email-en" aria-labelledby="cta-footer-newsletter-input-email-en">
      <input type="text" class="email-input-field" id="cta-footer-newsletter-input-email-en" name="email" placeholder="Email address">
    </label>
    <input name="source" type="hidden" value="">
    <input type="submit" class="submit-bttn" id="cta-footer-newsletter-subscribe-email-en" value="">
  </div>
</form>

Text Content

Who doesn't like cookies?

We use cookies to help us enhance your online experience. If that sounds good,
click “Accept All Cookies” or review our Privacy and Cookie Policy.


Close
Accept All Cookies


 * Your Privacy

 * Strictly Necessary Cookies

 * Performance Cookies

 * Functional Cookies

 * Targeting Cookies

 * More Information

Privacy Preference Center

Active

Always Active



Save Settings

Allow All

The official Malwarebytes logo The official Malwarebytes logo in a blue font B

We research. You level up.

       
Personal
Personal
 * Security & Antivirus
 * Malwarebytes for Windows
 * Malwarebytes for Mac
 * Malwarebytes for Chromebook
 * Malwarebytes Browser Guard
 * Overview

 * Security & Antivirus for Mobile
 * Malwarebytes for Android
 * Malwarebytes for iOS
 * Online Privacy
 * Malwarebytes Privacy VPN

 * Get Started
 * Explore all Personal Products
 * Explore Pricing

 * FREE TRIAL OF MALWAREBYTES PREMIUM
   
   Protect your devices, your data, and your privacy—at home or on the go.
   
   Get free trial

Business
Business
   Solutions
 * BY COMPANY SIZE
 * Small Business
    1-99 Employees 
 * Mid-size Businesses
    100-999 Employees
 * Large Enterprise
    1000+ Empoyees
 * BY INDUSTRY
 * Education
 * Finance
 * Healthcare
 * Government

   Products
 * CLOUD-BASED SECURITY MANAGEMENT AND SERVICES
 * Endpoint Protection
 * Endpoint Protection for Servers
 * Endpoint Detection & Response
 * Endpoint Detection & Response for Servers
 * Incident Response
 * Malware Removal Service
 * Nebula Platform Architecture
 * CLOUD-BASED SECURITY MODULES
 * DNS Filtering 
 * Vulnerability & Patch Management
 * Remediation for CrowdStrike®
 * NEXT-GEN ANTIVIRUS FOR SMALL BUSINESS
 * For Teams

 * Get Started
 *  * Find the right solution for your business
    * See business pricing
   
   --------------------------------------------------------------------------------
   
    * Don't know where to start?
    * Help me choose a product
   
   --------------------------------------------------------------------------------
   
    * See what Malwarebytes can do for you
    * Get a free trial
   
   --------------------------------------------------------------------------------
   
    * Our team is ready to help. Call us now
    * +1-800-520-2796

Pricing
Partners
Partners
 * Explore Partnerships

 * Partner Solutions
 * Resellers
 * Managed Service Providers
 * Computer Repair
 * Technology Partners

 * Partner Success Story
 * Marek Drummond
   Managing Director at Optimus Systems
   
   "Thanks to the Malwarebytes MSP program, we have this high-quality product in
   our stack. It’s a great addition, and I have confidence that customers’
   systems are protected."

 * See full story

Resources
Resources
 * Learn About Cybersecurity
 * Antivirus
 * Malware
 * Ransomware
 * See all
 * Malwarebytes Labs
 * Explore

 * Business Resources
 * Reviews
 * Analyst Reports
 * Case Studies
 * See all
 * Press & News
 * Learn more

 * Events
 * 
   
   
   
   Featured Event: RSA 2021

 * See Event

Support
Support
 * Technical Support
 * Support
 * Premium Services
 * Forums
 * Vulnerability Disclosure

 * Training for Personal Products
 * Training for Business Products

 * Featured Content
 * 
   
   
   
   Activate Malwarebytes Privacy on Windows device.

 * See Content

FREE DOWNLOAD
CONTACT US
COMPANY
Company
 * About Malwarebytes
 * Careers
 * News & Press

SIGN IN
Sign In
 * My Account
 * Cloud Console
 * Partner Portal

SUBSCRIBE


New business customers save 15% on powerful, easy-to-use EDR – See Offer >

Check out our MITRE ATT&CK Top performance!  View Results >

Cybercrime | Social engineering


AMAZON “NOTICE: TICKET NUMBER” PHISH SEEKS CARD DETAILS

Posted: February 12, 2015 by Christopher Boyd
Last updated: March 30, 2016

Phishy goings on as a fake Amazon support mail asks potential victims for
address info and payment details. There are enough clues that something might
not be right, and we take closer look at what the scammers are up to.

We see fake Amazon emails every now and again, and below you can see the most
recent addition to our spamtraps.

The email subject line suggests support tickets and urgent action required:

Notice: Ticket Number PIA-9U3C-A1P4-3R2-5R18225A

Things go slightly off the rails after that, because the phish has been sent
from an email address claiming to be customer support but not quite getting it
right:

Costumer Support.Amazon

Well, that didn’t get off to a great start. On the other hand, anybody recently
purchasing novelty clown costumes might be a little more likely to fall for
this.



The email reads as follows:

Welcome to Amazon ,

We need to confirm your account information,you must confirm your amazon account before we close it.

Click the link below to confirm your account information using our secure server:

They go on to mention orders, payments, settings and Kindle management to make
it all seem a little bit more realistic.

The Sign-In button, marked as “Sign in to your account to start” takes
clickers to a couple of sites which appear to have been compromised. We start
with

nochisaki(dot)com

which redirects the potential victim to goodforks(dot)com, a record label
website:





After entering email and password, the end-game is in sight as the scammers
responsible for the compromises and phishing pages ask for name, address,
country, city, ZIP, phone number on the first page…



…and payment information on the second.



Note that HTTPs is absent from the above page, and it also lacks the green
“Identity Verified” Padlock in the URL bar. This email is already caught as spam
in Outlook, though we can’t say for sure how many other email providers also
flag this at time of writing. Ignore any emails you’re unsure of, and if in
doubt navigate directly to Amazon by typing it in the browser to avoid these
types of underhanded shenanigans.

Christopher Boyd


RELATED

Apple phish: Summary report statementAugust 7, 2017In "Cybercrime"

Runescape phish claims your email has been changedMay 31, 2022In "Scams"

“Your Account PayPal Has Been Limited” Phishing ScamMay 8, 2015In "Cybercrime"

SHARE THIS ARTICLE

--------------------------------------------------------------------------------

COMMENTS


0 COMMENTS

--------------------------------------------------------------------------------


LEAVE A REPLY

You must be logged in to post a comment. Click here to login or connect a social
media account to leave a comment.

--------------------------------------------------------------------------------

RELATED ARTICLES

Cybercrime


EMAIL COMPROMISE LEADS TO HEALTHCARE DATA BREACH AT KAISER PERMANENTE

June 15, 2022 - We take a look at the latest healthcare breach, an email
compromise of a healthcare employee and explore the fallout.

CONTINUE READINGNo Comments

Scams


THE $43 BILLION BUSINESS EMAIL COMPROMISE THREAT

May 5, 2022 - We take a look at the latest FBI report on Business Email
Compromise which reveals $43 billion in losses from 2016 to 2021.

CONTINUE READINGNo Comments

Scams


STEER CLEAR OF THIS “TESTNTRACE” SMS SPAM

April 13, 2022 - An SMS scam is doing the rounds, claiming you've been in
contact with someone who has COVID-19.

CONTINUE READINGNo Comments

Privacy


APPS REMOVED FROM GOOGLE PLAY FOR HARVESTING USER DATA

April 12, 2022 - We take a look at a collection of apps which were all
harvesting user data via an SDK promising "monetisation".

CONTINUE READINGNo Comments

Scams


UNUSUAL SIGN-IN ACTIVITY MAIL GOES PHISHING FOR MICROSOFT ACCOUNT HOLDERS

March 1, 2022 - We look at a phishing mail which may cause concern for users of
Microsoft services as it claims there's been a suspicious login from Russia.

CONTINUE READINGNo Comments

--------------------------------------------------------------------------------

ABOUT THE AUTHOR

Christopher Boyd
Lead Malware Intelligence Analyst

Former Director of Research at FaceTime Security Labs. He has a very particular
set of skills. Skills that make him a nightmare for threats like you.


Contributors


Threat Center


Podcast


Glossary


Scams


Write for Labs

CYBERSECURITY INFO YOU CAN'T DO WITHOUT

Want to stay informed on the latest news in cybersecurity? Sign up for our
newsletter and learn how to protect your computer from threats.



Imagine a world without malware. We do.

FOR PERSONAL

FOR BUSINESS

COMPANY

ABOUT US

CAREERS

NEWS AND PRESS

MY ACCOUNT

SIGN IN

CONTACT US

GET SUPPORT

CONTACT SALES

3979 Freedom Circle, 12th Floor
Santa Clara, CA 95054
One Albert Quay, 2nd Floor
Cork T12 X8N6
Ireland

   English
Legal
Privacy
Accessibility
Terms of Service


© 2022 All Rights Reserved

Select your language

 * English
 * Deutsch
 * Español
 * Français
 * Italiano
 * Português (Portugal)
 * Português (Brasil)
 * Nederlands
 * Polski
 * Pусский
 * 日本語
 * Svenska

Cybersecurity basics

Your intro to everything relating to cyberthreats, and how to stop them.



 

Loading Comments...

 


You must be logged in to post a comment.