The email was completely dodgy, had several typos. There was a lack of instructions on what to do, just a "please contact us". I tried to contact customer service instead of the representative, but it was impossible because I needed an order code, which they never gave me. Emails to the individuals were never replied to and he insisted on only calling and handling a bank transfer over the phone.
The whole situation was very similar to a man in the middle attack.
It turned out to be legit, but the whole situation makes me never want to order anything from them again.
Either the people you are able to contact don't care, because they have no idea what you're talking about, or they don't care because they wrote/required exactly what you're complaining about, out of expediency or ignorance.
https://superuser.com/questions/505503/how-can-you-fake-an-e...
1. Check PTR for IP and verify that the A or AAAA record for that name points back to the same IP.
2. Compare with IP address of server that sent previous mail to you.
3. Check SPF records for the domain.
4. Check MX records for the domain. Keep in mind that they might be using different servers for sending than for receiving though and that MX is for receiving.
Try it, then see how many times you can hit a @gmail address.
So why is this comment on top?
It seems HN got mainstream and with it the usefulness is declining - low quality comments staying on top that can be answered by common sense.
He also says that the email contains a link to the real website, not to a scam website.
So, if it was sent by a scammer what's the purpose? How does it work?
And if it was sent by the company, why are they sending email that looks like a scam?
Received: from pvma00057.prod.fedex.com ([204.135.8.98]:61625 helo=mx28.infosec.fedex.com)
by gator4118.hostgator.com with esmtps (TLSv1.2:ECDHE-RSA-AES256-GCM-SHA384:256)
(Exim 4.87)
(envelope-from <[email protected]>)
id 1dWn4C-00092V-Dd
for [email protected]; Sun, 16 Jul 2017 12:10:48 -0500
DKIM-Signature: v=1; a=rsa-sha256; d=fedex.com; s=edc; c=relaxed/relaxed;
q=dns/txt; [email protected]; t=1500225037;
h=From:Sender:Reply-To:Subject:Date:Message-ID:To;
bh=M2wd7ncO9bsu5aQpoaGPtLYIjzi/OkxO+5qgmnqO1D4=;
b=ktUTxDShfkakjcLd2BEwRVC4X4ItHdPYvR+Dqyj6oiWPWrsuWA98jHqIssipCXHa
XsPn72sxMnWIlwy0LLC3r2WGTUBHg7afy0K804QLQ2ztSHr7CnMZ4jFh0O6A9ElQ
16twStNpiG9XBF4Gho08WHg+EUrKSnTqPwknnhOg+9BVyKZLsQhsGAk1Bl/Vgu9z
55RxPd3VjDlAM04i+sZZaLLTX3TLA8jbMHNgZpwx01j6/whY2RVktfMYvmJZo3n9
6XVJTcUVA3QiXb32Ps9OwGpOZQMSR0EKGrXSEUyk8YEGDZmFkZOgy6cUZBuzKRXs
yPqdVtE4gHvuck8T5nrllg==;
X-AuditID: cc870862-345fb700000012f5-3f-596b9e0d6fb1
NetRange: 204.135.0.0 - 204.135.255.255
CIDR: 204.135.0.0/16
NetName: FEDEX-2009-BLOCK
NetHandle: NET-204-135-0-0-1
Parent: NET204 (NET-204-0-0-0-0)
NetType: Direct Assignment
OriginAS: AS7726
Organization: FedEx (FEC)
RegDate: 2009-07-20
Updated: 2017-04-29
Ref: https://whois.arin.net/rest/net/NET-204-135-0-0-1
OrgName: FedEx
OrgId: FEC
Address: 70 FedEx Parkway
City: Collierville
StateProv: TN
PostalCode: 38017
Country: US
RegDate:
Updated: 2014-06-02
Ref: https://whois.arin.net/rest/org/FEC
I call FedEx Revenue Services, and they can't find anything wrong with the account. They tell me the account isn't suspended. They want the expiration date on my credit card updated before the end of the month, but it hasn't expired yet.
I look at the message source, and it looks like it's really coming from FedEx, and the link really goes to FedEx. I keep looking, and can't find anything wrong in the headers. It's a legit email. It's just stupidity at FedEx.
Sloppy work, FedEx, sending out an email like that. You're training people to click on links they should not click on.