Amazon

[Tywysoges Gwen]

The phishing website is blocked already by NetCraft. The sender email address may be forged.

Received: from wp-websitebuilder.com (89.22.100.53)
To: *********
From: =?UTF-8?B?QW1hem9u?= <amazon@support.com>
Date: Sun, 21 Mar 2021 10:54:18 +0000 (UTC)
Return-Path: kbfhvtmzo@farmer.websiterouter.com
X-Sender-IP: 89.22.100.53

Hello

Please confirm your account

We were unable to process your most recent payment. Did you recently change your bank, phone number or credit card?. To ensure that your service is not interrupted, please update your billing information today.

Confirm your account now

We're available 24 hours a day, 7 days a week. If you have recently updated your billing information, please disregard this message as we are processing the changes you have made. If you need further assistance with your order.

Sincerely.

Amazon Security Center

Oriigin IP address = 89.22.100.53
dogado GmbH,
Dortmund,
Nordrhein-Westfalen,
Germany

 

[Tywysoges Gwen]

The phishing website is blocked already by NetCraft. The sender email address probably is forged. The message is identical to the previous post.

Authentication-Results: spf=softfail (sender IP is 185.182.81.72)
Received-SPF: SoftFail (protection.outlook.com: domain of transitioning
support.com discourages use of 185.182.81.72 as permitted sender)
Received: from host1.mfr-system3.com (185.182.81.72)
From: "amazon"<amazon@support.com>
Subject: Please confirm your account
Date: Fri, 2 Apr 2021 21:50:02 +0800
To: Undisclosed recipients:;
Return-Path: amazon@support.com

X-Sender-IP: 185.182.81.72

Origin IP Address = 185.182.81.72
Novoserve GmbH
Hessen, Frankfurt am Main
Germany