An email pretending to come from Cpanel, isn’t cpanel … can you smell trouble? from blog The Technology blog and podcast

An email pretending to come from Cpanel, isn’t cpanel … can you smell trouble?

To protect the identity, I will not be putting the entire email out here, but someone at MENVI forwarded the email to me.

The email claimed that there were emails pending, and claimed to come from our cpanel. The problem? One of the URL’s definitely did not go to our domain, and the one that did go to our domain is actually an invalid address and I got my customized 404 error page when checking it out which I expected.

The link at the bottom points to https://bafybeid3diuhfvimw4whoifn5gxuxcwrkb7rlkdhuptfb2pjun3lx2rawy.ipfs.dweb.link (not linked) which is definitely not MENVI’s domain!

The link is much longer and is a link to try and get their information and includes the address. Something tells me it redirects, and this is where you can use your mouse as a sighted person if it was a full HTML link. and email.

When analyzing this, there are no redirects, but all I’ll tell you is that it is nasty! I’ve never seen anything like this, and it is not a good sign.

One of the links I can give you is to menvi.org/activity which actually doesn’t even exists, as the email indicates that you can go there to view activity.

The from name is: cPanel on menvi.org and the address it apparently comes from is which is completely different than menvi.org.

From my experience, all cpanel email comes from the domain in which it originates, I.E. as an example.

I want people to understand that i’m here to try and help the best I can. I smelled a scam when the subject line says menvi.org Email configuration settings for (address removed) 4 Unread Message!

How can email work whereby you’re getting an email for pending email? The server doesn’t tell us about pending email, only thatit fails or its held to be delivered elsewhere. You don’t get email at your address when it comes to email waiting for you, I don’t believe that ever works.

Again, to protect their identity, I’ve removed the name and address because people don’t need to know to whom it was delivered.

This type of email can be sent to any email address to try and get people to click and divulge their credentials.

8 out of 90 vendors according to Virus Total found the link at the bottom of the email to be malicious! (blockquote> Learn about Virus Total

Ten of the 90 report it as either Phishing or Malicious.

Here’s what you can do.

• Right click the link an select copy link or copy link location.
• Visit Virus Total and select the button for scan URL.
• Paste the URL directly in to the box and press enter.
• Look at the analysis.

For those using screen readers, I have a guide which you can find on the blog pages that will assist you with getting the link address. But sighted users can use their mouse to hover over the link and it’ll show them where it is going.

The Technology blog and Podcast is the guide.

They must have updated, as now it says that it was last analyzed 12 hours ago.

The detection tab, the first tab, shows information useful to you but there’s more!

Under the details tab, it yields other aspects including media sharing, not recommended site, elevated exposure and more.

The final tab has no comments but the community can comment on this.

I’ve sent this analysis to the person in question.

While adding information to this article, I visited the page and it has our web site with a popup for email address and password and that it is only used to verify the info.

I will say this. Anyone who decides to send an email saying there are pending emails and getting people to click because they’re trying to “get information to verify the account” (in quotes) should find something else to do. Luckily, the person in question understood that something was off, and sent it to me for review and instruction.

Stay aware. Stay alert, and stay protected!

---

Informazioni sull'articolo

An email pretending to come from Cpanel, isn’t cpanel … can you smell trouble? was released on November 2, 2023 at 4:30 pm by tech in musings,security news and commentary.
Last modified: November 2, 2023.

---

Comments (0)

No comments yet.

You must be logged in to post a comment.

go to sections menu

---