Fake "Amazon.com - Your Cancellation" email
Posted: Sat Nov 13, 2010 3:39 am
I just received this email, supposedly from Amazon.com:
From: order-update@amazon.com
Subject: Amazon.com - Your Cancellation (743-1556239-4894434)
Dear Customer,
Your order has been successfully canceled. For your reference, here's a summary of your order:
You just canceled order #743-1556239-4894434 placed on November 13, 2010.
Status: CANCELED
_____________________________________________________________________
Order #743-1556239-4894434 details
Sold by: Amazon.com, LLC
_____________________________________________________________________
Because you only pay for items when we ship them to you, you won't be charged for any items that you cancel.
Thank you for visiting Amazon.com!
---------------------------------------------------------------------
Amazon.com
Earth's Biggest Selection
http://www.amazon.com
---------------------------------------------------------------------
First of all, I didn't order anything from Amazon. Second, the email said I "just" cancelled the order on at 3:02 AM 11/13/2010, however I received it at 6:02 pm CST on 11/12/2010. (Nine time zones ahead of CST would mean that this email was probably sent right from the middle of ... Scamland.)
What you don't see in this copy is that when you hover your cursor over Order #743-1556239-4894434 details, the actual website is revealed: http://rxchangedirect.net, which is purported to be an "attack" website.
Didn't have to look very far in Google to find that this just is a variation of a phishing scam that has been around for a few years: https://www.viclovan.com/downloads-and- ... %9D-e-mail and http://www.millersmiles.co.uk/report/21019.
According to http://blog.onlymyemail.com/amazon-com- ... aud-email/, "Of course the sender From address is spoofed, this is not a legitimate Amazon communication, and the Reference number is randomly generated in order to evade spam filters that might look for identical subject line contents."
" ... the words “Order Details” are hyperlinked to any number of various attack sites used to download malicious code and/or to capture personal information, passwords and other financial details."
From: order-update@amazon.com
Subject: Amazon.com - Your Cancellation (743-1556239-4894434)
Dear Customer,
Your order has been successfully canceled. For your reference, here's a summary of your order:
You just canceled order #743-1556239-4894434 placed on November 13, 2010.
Status: CANCELED
_____________________________________________________________________
Order #743-1556239-4894434 details
Sold by: Amazon.com, LLC
_____________________________________________________________________
Because you only pay for items when we ship them to you, you won't be charged for any items that you cancel.
Thank you for visiting Amazon.com!
---------------------------------------------------------------------
Amazon.com
Earth's Biggest Selection
http://www.amazon.com
---------------------------------------------------------------------
First of all, I didn't order anything from Amazon. Second, the email said I "just" cancelled the order on at 3:02 AM 11/13/2010, however I received it at 6:02 pm CST on 11/12/2010. (Nine time zones ahead of CST would mean that this email was probably sent right from the middle of ... Scamland.)
What you don't see in this copy is that when you hover your cursor over Order #743-1556239-4894434 details, the actual website is revealed: http://rxchangedirect.net, which is purported to be an "attack" website.
Didn't have to look very far in Google to find that this just is a variation of a phishing scam that has been around for a few years: https://www.viclovan.com/downloads-and- ... %9D-e-mail and http://www.millersmiles.co.uk/report/21019.
According to http://blog.onlymyemail.com/amazon-com- ... aud-email/, "Of course the sender From address is spoofed, this is not a legitimate Amazon communication, and the Reference number is randomly generated in order to evade spam filters that might look for identical subject line contents."
" ... the words “Order Details” are hyperlinked to any number of various attack sites used to download malicious code and/or to capture personal information, passwords and other financial details."