Unstoppable Domains .crypto

Scam Email Purportedly From NameCheap

Labeled as warning in Warnings and Alerts started by TestCase, Nov 9, 2019.

Replies:
11
Views:
752

  1. TestCase

    TestCase Note: Doesn't play well with others. VIP ★★★★★★★★★★

    Posts:
    2,122
    Likes Received:
    1,496
    BE ALERT!!!

    I received the following SCAM/Phishing email (see attached) that is purportedly from NameCheap. The domain in the "from" address is "[email protected]WS" and it was registered a couple of days ago.

    They seem to be trying to obsfuscate some of the text for whatever reason (spam filters maybe?!?!?) because when I tried to do a copy & paste the body of the email I ended up with a LOT of gibberish. It took a minute to understand what they had done.

    For example, the last paragraph reads, "We take your security and privacy very seriously...." but when I tried to copy and paste it I saw this,

    After focusing my eyes for a moment, I realized what they did was,
    So be careful!!!!

    Ps. Does anyone know what the "0687034230" is all about and why it doesn't appear?
    This is the first time I've ever encountered this particular "hidden/invisible" code/text.
     

    Attached Files:

    Last edited: Nov 9, 2019
    The views expressed on this page by users and staff are their own, not those of NamePros.
  2. deebong

    deebong Galoxy.com VIP ★★★★★★★★★★

    Posts:
    3,006
    Likes Received:
    845
    I have also received this phishing email yesterday and already alerted NameCheap about this with raw email headers. They haven't replied yet!
    phishing_email_alert.png
     
  3. cooljub

    cooljub Established Member

    Posts:
    481
    Likes Received:
    624
    Maybe the numbers are coloured the same as the background then the whole text is tracked back until the letters are together?
     
  4. TestCase

    TestCase Note: Doesn't play well with others. VIP ★★★★★★★★★★

    Posts:
    2,122
    Likes Received:
    1,496
    You got me thinking so I went back and looked at the underlying html of the content and discovered this,
    So that "splains" it!

    Now it has me wondering if those are random digits or they are unique and specific to each individual email.

    Hmmmm...

    @deebong - Can you take a look at the html in your email and see if the number is the same or if your's is different?
     
    Last edited: Nov 9, 2019
  5. deebong

    deebong Galoxy.com VIP ★★★★★★★★★★

    Posts:
    3,006
    Likes Received:
    845
    For me, it's a different combination:

    <span style="font-size:0px;">26899705987345</span>
     
  6. cooljub

    cooljub Established Member

    Posts:
    481
    Likes Received:
    624
    It doesn't matter what the characters are. The fact that the style sheet has attributed a font size of "0" means whatever it is, it won't show.

    There's probably quite a few ways to do something like this. You'd think spam filters would pick these things up.


    Edit: I just realised you're looking at whether the numbers have significance.
    See signature :xf.smile:
     
    Last edited: Nov 9, 2019
  7. TestCase

    TestCase Note: Doesn't play well with others. VIP ★★★★★★★★★★

    Posts:
    2,122
    Likes Received:
    1,496
    LOL (I know the feeling!)
     
  8. TestCase

    TestCase Note: Doesn't play well with others. VIP ★★★★★★★★★★

    Posts:
    2,122
    Likes Received:
    1,496
    I realized the unique numbers might not have any real relevance to the specific email as it would make sense to assign random numbers to each and every email so that spam filters would have a difficult time singling them out/picking them up.
     
  9. SirDrago

    SirDrago NAME JEDI VIP ★★★★★★★★★★

    Posts:
    3,855
    Likes Received:
    8,255
    @tamar I believe is the namecheap rep.

    UPDATE:
    I contacted live support and was told to submit a ticket to their legal/abuse department...

    Why? When I'm chatting with a live friggin person?
    Whatever
     
    Last edited: Nov 10, 2019
  10. TestCase

    TestCase Note: Doesn't play well with others. VIP ★★★★★★★★★★

    Posts:
    2,122
    Likes Received:
    1,496
    I just forwarded the email I received to "[email protected]" and I got an auto-response saying that it had been received and someone would be in contact with me.

    But I sooooo understand your point about being in a chat with a CSR. So much for the CS part...
     
    Last edited: Nov 10, 2019
  11. SirDrago

    SirDrago NAME JEDI VIP ★★★★★★★★★★

    Posts:
    3,855
    Likes Received:
    8,255
  12. SirDrago

    SirDrago NAME JEDI VIP ★★★★★★★★★★

    Posts:
    3,855
    Likes Received:
    8,255

Want to reply or ask your own question?

It only takes a minute to sign up – and it's free!
NameWorth
  1. NamePros uses cookies and similar technologies. By using this site, you are agreeing to our privacy policy, terms, and use of cookies.
    Dismiss Notice
Loading...