Čudan mail s Amazona

Zarada
1

Jutros sam dobio mail s amazona, točnije s adrese [email protected], evo maila ispod:

image
image885×583 88.4 KB

image
image978×499 29.9 KB

I malo mi je to sad čudno. kad stisnem na gumb, odvede me na stranicu rfi.amazon.com, gdje trebam upisati svoj mail na koji će mi poslati one time password za uploadanje dokumenata.

Je li dobio još netko to?

Strah me da nije scam, a opet moguće da je u redu jer sam prije 2 mjeseca mijenjao podatke radi obrta, pa sada vjerojatno traže nekakvu potvrdu.

Kontaktirao sam podršku putem chata, preusmjerili me na poziv jer oni tu ne mogu ništa. Poziv naravno prema americi, ko kreten čekam 2 minute da bi mi na kraju poslali SMS u kojem moram odgovoriti sa Yes ili No, no zbog naše mreže ne mogu odgovarati na taj SMS haha… katastrofa…

2

Bolje pazi i provjeri to. Meni je nedavno stigao sms da mi netko hoce provalit u amazon.com account, a ne moze bez sms potvrde

3

Djeluje mi da je sve ok. Najbolje je da sačekaš ovih 5 dana, i da vidiš da li će ti isplate staviti na hold. Ako stave, onda pošalješ dokumente :smile:

4

Pa ova prošla uplata od neki dan piše da je isplaćena, ali meni još nije u banku sjela pa me zato to sada brine. Doduše danas je 1. maj pa možda zbog toga kasni

5

Bogami kažu da nije njihov:

image
image1819×747 132 KB

4 Likeova
6

Zanimljivo. Kako onda pošalju email s njihove domene?

7

Dobro si prosao. Ali jesi ti pogrijesio ili ima razlike u mailu ne moze biti s njihove domene

1 Like
8

Provjerio i ono “show original” u gmailu, i sve vodi na Amazon i sve izgleda okej. Čak i ta domena rfi amazon se čini okej, može se čak i u Google-u naći:

image
image790×521 20.2 KB

I čudi me odakle im podatak BATALE i puno ime i prezime. Istraživao sam internet, čak sam u par primjera vidio da amazon support kaže da je prevara, a da zapravo nije i da im blokiraju isplate haha…

2 Likeova
9

Mozda je i amazon poceo sa pishingiom haha

10

Daj mail header ovdje.
Bit ce kristalno jasno kako je osmisljen phishing.

1 Like
11 
Received: by 2002:a05:6124:1984:b0:3a0:68bb:a356 with SMTP id fb4csp239260vlb;
        Wed, 1 May 2024 03:05:30 -0700 (PDT)
X-Forwarded-Encrypted: i=1; AJvYcCW+Fho8NoU5qatXzOg5CdkahCu13t9yhhvziBknKHbwNpqwbEsLiWP24rs1E6eetwh7Q3HqOg0eN4qdxaUYJCUJ7w==
X-Google-Smtp-Source: AGHT+IGs/s4fzRzd15zbSGjHfg9FRAL1dAZq7xOdrKHhyaNfoGSStRtYjbic6GMbtZAaam0ANx6xXn7Il2s=
X-Received: by 2002:a05:6830:1e02:b0:6ed:e4fc:b78e with SMTP id s2-20020a0568301e0200b006ede4fcb78emr2293935otr.26.1714557929412;
        Wed, 01 May 2024 03:05:29 -0700 (PDT)
Authentication-Results: mx.google.com;
       spf=none (google.com: a25-63.smtp-out.us-west-2.amazonses.com does not designate permitted sender hosts) smtp.mailfrom=a25-63.smtp-out.us-west-2.amazonses.com;
       dkim=pass [email protected] header.s=jbtrzo4z4gvb5esdul2bxwqhzti3vtx3 header.b=S4Uqxsqw;
       dkim=pass [email protected] header.s=7v7vs6w47njt4pimodk5mmttbegzsi6n header.b=ksi1gE38
Received-SPF: none (google.com: a25-63.smtp-out.us-west-2.amazonses.com does not designate permitted sender hosts) client-ip=54.240.25.63;
Received: by 2002:a9d:7d0b:0:b0:6ee:670c:e4c4 with POP3 id 46e09a7af769-6ee670ce635mf1143544a34.2;
        Wed, 01 May 2024 03:05:29 -0700 (PDT)
X-Gmail-Fetch-Info: [email protected] 1 mail.online-zarada.com 110 [email protected]
Received: (qmail 19690 invoked from network); 1 May 2024 09:29:04 -0000
Received: from a25-63.smtp-out.us-west-2.amazonses.com (54.240.25.63)
  by h388.mywahosting.com with SMTP; 1 May 2024 09:29:04 -0000
DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/simple; s=jbtrzo4z4gvb5esdul2bxwqhzti3vtx3; d=amazon.com; t=1714555743; h=Date:From:To:Message-ID:Subject:MIME-Version:Content-Type; bh=VPaLheYK8aH6qzLbf/p4UdwT64Kxt5ifYxHmfmdPHI0=; b=S4UqxsqwFnR2B1DiFcQT6RZEk1PE3wYEYO6oKFIVV8gDRSZR7ks0owHCn2CkG9CH mqRwMoSb6QD1sX2GbUDhjx0RQeAsoZQsnBuWIzod2Oo879XL4UBlLrTSCFG87OI2dD9 X0l2qUDTQJooMzBkJWFILfGxo/TosP3G2+hzGbCg=
DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/simple; s=7v7vs6w47njt4pimodk5mmttbegzsi6n; d=amazonses.com; t=1714555743; h=Date:From:To:Message-ID:Subject:MIME-Version:Content-Type:Feedback-ID; bh=VPaLheYK8aH6qzLbf/p4UdwT64Kxt5ifYxHmfmdPHI0=; b=ksi1gE38Pa1cdRLPfBxjtBbOOuF4JJvjW/svrBmMtmxTPzjqEtmBJ0PHpHWLh52j t7JOc1mUMLUfkejRopaB6AAz3PcU3Lgx1c06BfkBmy3JJO5oil9wLuKfGuHLITgZkZX nD2en71BL1oMDf29GaYSmbdYLiO7h6DuYx2F4erg=
Date: Wed, 1 May 2024 09:29:03 +0000
From: "[email protected]" <[email protected]>
To: [email protected]
Message-ID: <0101018f337c6dde-d500d139-4ae2-486d-8de4-b984fff74ce6-000000@us-west-2.amazonses.com>
Subject: Action required - Amazon account verification
MIME-Version: 1.0
Content-Type: multipart/alternative; boundary="----=_Part_593342_1949905875.1714555743704"
X-AMAZON-MAIL-RELAY-TYPE: notification
Bounces-to: 202405010929030b4aae2bcaac426d924c559f59e0p0fe-C37MDR1TGQW28V@bounces.amazon.com
X-AMAZON-METADATA: CA=C37MDR1TGQW28V
X-Original-MessageID: <urn.rtn.msg.202405010929030b4aae2bcaac426d924c559f59e0p0fe@1714555743705.>
Feedback-ID: 1.us-west-2.rdzROVNU4Ie6UEvJOunP6JDKqJ3if06FJy9qthmk+BU=:AmazonSES
X-SES-Outgoing: 2024.05.01-54.240.25.63
12

cini se da je ovo domena… al to je legit hm…

13

Header je krajnje zanimljiv.
Ovo definitivno nisu amateri koji samo masiraju mail putem neke od dostupnih wembail skripti (RoundCube, SquirrelMail i slično).
Catch je u IPv6 adresi i kombinaciji DKIM/SPF zapisa, kao i postavkama na tvojem mail serveru od mywayhosting[dot]com.

Kad ulovim malo vremena objasnim što trebaš napraviti na serveru kako više ovakvi mailovi ne bi prolazili.
LP

1 Like
14

Analyzing the Header

  • Inconsistencies: The “From” address looks like “[email protected]” at first glance, but genuine Amazon emails come from domains ending with @amazon.com.

  • SPF Failure (Received-SPF): “spf=none” indicates the sending domain (a25-63.smtp-out.us-west-2.amazonses.com) is not officially authorized by Amazon. Legitimate Amazon email should generally pass SPF checks

.

  • DKIM Signatures: While DKIM signatures pass, this doesn’t guarantee authenticity. Phishers sometimes manage to get these right. It’s a good sign when they fail, though.
15

Novci s Amazona mi i dalje nisu sjeli, iako su navodno uplaćeni 30.tog, sve više mislim da mail ipak nije scam, nego da Amazon odjeli međusobno i ne surađuju baš najbolje. NIkad do sada nisam imao problema s uplatama, i baš sada imam kada sam dobio taj mail.

2 Likeova
16

Moze li info sa vise detalja? Da li je ovo zaista scam?

1 Like
17

Ja jos uvijek nisam saznao 100%, jedino znam da bisam dobio isplatu s Amazona i dalje nakon evo skoro 15 dana…

18

Meni nikada nije kasnila, uvijek mi dođe 29. ili 30. u mjesecu.

1 Like
19

Isto tako do ovog mjeseca

20

Zašto bi neko slao “lažni” mejl i onda te prebacivao na pravu domenu da popuniš dokumente?