Friday, December 12, 2014

Phishing Email - You sent a iTunes Gift Card to - Examined

Sample Phishing Email - You sent a iTunes Gift Card $200 to ...

If you receive this crafty email similar to below, then it beware it's probably a phishing email attempt that is recently going around. What to do?  Report them, goto bottom of page.

Subject: You sent a iTunes Gift Card $200 to ( Your receipt No.123456789

PayPal logo
12 Dec 2014 02:01:11 BST
Transaction ID: 4V999066CK355555N
You sent a iTunes Gift Card to (
Thanks for using iTunes. To see all the transaction details, log in to your Apple account.

It may take a few moments for this transaction to appear in your account.

Note to seller
This is a $200 itunes card or gift voucher.
Shipping address EMAIL - No Confirmed
Dispatch details
The seller hasnt provided any dispatch details yet.
Unit price
Click here To Cancel This Transaction
iTunes Gift Card Item Number 333332959511
$$200 CAD
$$200 CAD
Postage and packaging
$200 CAD
Insurance - not offered
$200 CAD

How to tell this is a Phishing email ?

  1. Is email is from you to you, then it's phishing.
  2. Hover over all links in email, if it's not from the site then forget it.

    In above example, all the links and source images seem to be from Apple website except the link.

    You can test this
    in the above example, since I crafted that from source HTML of the phishing email. Try it, hover over links to examine the source URL. Note: I have re-coded to report as phishing site to Google.

    In the original phishing email, hovering over pointed to spam site
    . The correct link when you hover over should be
    Reading email in Outlook generated pop-up "Click to follow link"

  3. The best way is to look at message source, see below.

How to examine Email Message Source ?

Now lets look at message source
  1.>Actions->View Message Source. 
  2.>More (down arrow to top right)->Show original.

For this phony email, well look at the top 25 lines of the message, known formally as the "message header".

At line 23 you have Return-Path:
and is suspect because domain was registered in Italy (
.it) and nothing to do with Apple. is being investigate for a Paypal phishing and has reported links to Italian Mafia.

These are valid return-paths for Apple 

  • Return-Path: 
  • Return-Path: 

Why look at "Return-Path"? When the e-mail is put in the recipient's mailbox, a new mail header is created with the name "Return-Path:" containing the address on the MAIL FROM command. So it's a quick hit to determine authenticity.

Report Phishing Email (not as Spam)

  1.>Junk (at Top)->Phishing Scam
  2.>More (downarrow to top right)->Report Phishing 

Report Phishing URLs at Google now 

If you have recievied this email take further action now by click these links


Report phishing at Microsoft and government agencies


No comments:

Post a Comment