On the matter of email scams

Forums › IT Pro and developers › On the matter of email scams

Rickles

3107 posts

Uber Geek
+1 received by user: 445

Trusted

#304408 1-May-2023 15:12

I have noticed that more often than not, thee links given in a scam email will return an Unknown source or 404 error message.

Is this because that by the time I've seen the scam the scammers have moved on to another address to avoid detection?

SirHumphreyAppleby

2938 posts

Uber Geek
+1 received by user: 1860

#3070075 1-May-2023 15:38

Most of us don't click the links.

I would guess it's most likely because the scam sites have been shutdown rather than the scammers moving on to avoid detection. Many of the scams will be sent by malware, so there isn't the opportunity to update the URL if it changes.

Rickles

3107 posts

Uber Geek
+1 received by user: 445

Trusted

#3070122 1-May-2023 18:13

>Most of us don't click the links.<

Absolutely, but these things come in to a machine I am monitoring for an organisation, so have occasionally looked at source details .... on an isolated machine of course 😇

Ruphus

469 posts

Ultimate Geek
+1 received by user: 181

#3070126 1-May-2023 18:30

This is a common technique by scammers to ensure scam emails are delivered to mailboxes. They are aware that security products (like Defender for Office) will investigate the links in emails to determine if the websites are malicious or not. If the site is malicious, the email will be quarantined. If the website is not active (404) then the email will be delivered. Websites will then become available after emails have been delivered, often hours later, to coincide with the start of business for a specific region.

frankv

5705 posts

Uber Geek
+1 received by user: 3666

Lifetime subscriber

#3070532 2-May-2023 15:34

SirHumphreyAppleby:

I would guess it's most likely because the scam sites have been shutdown rather than the scammers moving on to avoid detection. Many of the scams will be sent by malware, so there isn't the opportunity to update the URL if it changes.

Absolutely. If you think about it, the scammer needs the victim to reply. So switching to a new site (including shutting down the old one) is counterproductive.

Also, web sites and domains are paid for with stolen credit cards. As soon as the web hosting company gets the money clawed back, they close down the site.

BlakJak

1329 posts

Uber Geek
+1 received by user: 735

Trusted

#3085254 5-Jun-2023 23:06

They also look at IP's (geofencing) and user agents. They want traffic from their target geo area and from people who will fall for it. Not those who may put up blocks or issue takedowns.

No signature to see here, move along...