Count the Fails...

[W3WN]

This is an actual email sent to our company Help Desk this morning. I am omitting the users name for reasons I trust are obvious.

Semi-rheorical question: How many points of fail do YOU see in this situation?
----------------------------------------------------------------------------------------
From: Help Desk
Sent: Tuesday, August 20, 2013 9:46 AM
To: IT
Subject: [Ticket #12695] Link in email will not open - Spiceworks



On Aug 20, 2013 @ 09:46 am, (name redacted) wrote:

I received an email this morning from the USPS saying:

"Your package has arrived on August 17th, but the messenger was unable to deliver the package. For more information , print and read the Shipping Label."

There was a link to the label but when I try to open it, the system responds "Not Found The requested URL /inf/phop was not found on this server.

I copied the address from the browser. It is :

http://www.rappenegger.de/info.php?id=NUHtpQV52NH/aMKqzvA2nz9s88msXn1nqz7whzE+TRg=

If I try to forward the email, stuff is overlapping.

(name redacted)




----------------------------------------------------------------------------------
:doh:
Let's see, what are the obvious points of fail? :chin:

Well, this is what I told him in response to the ticket:
----------------------------------------------------------------------------------
Please do NOT attempt to respond to this email. This is bogus. This is almost certainly a "phishing" attempt by someone trying to get an indirect way into your computer.

1. The US Postal Service does not send emails announcing a non-delivery of a package. If anything, they'd leave a note in your mailbox or on your door.
2. The US Postal Service does not use "messengers". They use "postal carriers" (it's not politically correct to say "mail men" anymore)
3. The US Postal Service would have an email address ending in usps.gov or usps.com. Not rappenegger.de . That's not even a server in the US.

If you are expecting a package that was not delivered, call your local post office.

But please, do NOT respond to this email.

[K7SGJ]

It does sound phishy, however, you can elect to have the USPS send the sender or the addressee deliver notification via email if the email address is provided. One important point you posted was if they were expecting a delivery to contact the postal service. The other was the notification ending in .de unless that was possibly the sender who was advised the package was undeliverable. In many cases there should be a tracking number, or at the very least the addressee should be aware of an expected delivery. (Barring a gift or something like that)

We ship a minimum of 10 parcels via USPS daily, and the most important part of your post, at least to me, was to not respond to an unknown email, but to try to contact the USPS or the sender and try to find out the status of any expected and undelivered mail. Indeed, if an email from the post office doesn't end .gov, be very suspicious.

Great "heads-up" post, Ron.

[NQ6U]

I dunno, Ron, it looks legit to me....

[kb2vxa]

I tend to go off in some weird directions especially when prompted by a "rapping harrower" loosely translated from German. No wonder the 401 error, the domain is not on the server linked to, it comes back to:
OrgName: RIPE Network Coordination Centre
OrgId: RIPE
Address: P.O. Box 10096
City: Amsterdam
StateProv:
PostalCode: 1001EB
Country: NL

http://www.ripe.net/

It might be a good idea to get back to "name redacted" and inform him of something I just found in my downloads folder after searching out the above.
Shipping_Label_US_Brick_ZIP08723.zip
Scanning with Malwarebytes revealed:
Trojan.Ransom.PA
http://www.f-secure.com/v-descs/trojan_w32_ransom.shtml

[K7SGJ]

I dunno, Ron, it looks legit to me....

By the way, I've been meaning to ask, how'd you come out on that S. African lottery letter deal?

[KJ3N]

Semi-rheorical question: How many points of fail do YOU see in this situation?

"...if I only had a brain..."

http://www.lastwordonnothing.com/wp-content/uploads/2013/06/Wizard-of-Oz-Scarecrow.jpeg

[NQ6U]

By the way, I've been meaning to ask, how'd you come out on that S. African lottery letter deal?

I couldn't go for it, all my funds are tied up in Nigeria.

[K7SGJ]

I couldn't go for it, all my funds are tied up in Nigeria.

Pisser. I think the SA one was the real deal.