Threat Level: green Handler on Duty: Rick Wanner

SANS ISC: Bogus emails: - Your Cancellation SANS ISC InfoSec Forums

Participate: Learn more about our honeypot network

Sign Up for Free!   Forgot Password?
Log In or Sign Up for Free!
Bogus emails: - Your Cancellation

There are bogus order cancellation emails going around claiming to be from Amazon like this:

Dear Customer,

Your order has been successfully canceled. For your reference, here's a summary of your order:

You just canceled order 15-6698-2492 placed on May 9, 2012.Status: CANCELED


1 "Mulberry"; 2006, Special Edition

  By: Sorcha Stewart

Sold by: LLC


Thank you for visiting!


Earth's Biggest Selection


The 15-6698-2492 in the copy I received linked to the URL which contains this is in the body:
<script type="text/javascript">window.location="";</script>

the web server seems to be down:
--2012-05-09 13:43:19--  (try: 7) to||:80... 

It is probably safe to assume that the content of that site is not user friendly.
Here is the full content of the page at
<html><head><script type="text/javascript">window.location="";</script></head><body><a href="">Click</a></body></html>
Handler ISC


42 Posts
May 9th 2012
No offense, but this is hardly a new or unusual occurrence. The link is probably to a Canadian pharmacy site. We've seen thousands of similar emails going back more than a year from spoofed/forged sources besides amazon, e.g. ups, usps, linkedin, verizonwireless, bbb, bankofamerica ....
No offense taken, you are correct that these types of emails are not new. However they do come in different forms over time and they keep coming because they are effective. A little reminder can't hurt.

42 Posts
Thanks for the info. I received an "Amazon cancellation email" this morning noting that I had successfully cancelled my order for "Verdict". Didn't open and warnings flashed as well. It looks like it might be an Amazon response email, but I spamed it away. Thanks again for your posted comments.
1 Posts

Sign Up for Free or Log In to start participating in the conversation!