As we have noted a couple of times in the past few weeks, spammers and scammers are using the email mailing list confirmation process to send spam. Here’s how that works: someone signs up for a mailing list, and then replies to the confirmation request with their spam. In this case, Amy Happy at amy41211@letmailer.com, seems to be replying to a confirmation message that she, in fact, never received in the first place.

A spate of fake “Amazon.com – Your Confirmation” emails is making the rounds – they are phishing emails, with the supposed ‘Amazon’ links actually being hidden links going to such interesting places as http://drevmash.alfaspace.net/admiral.html, https://www.theinternetpatrol.com/brick-wall/, and meeknew.com. The subject (which so far appears to use the same “confirmation” number for everyone), is “Amazon.com – Your Confirmation (0113-567494-3518071)” and supposedly comes from the email address order-update@amazon.com. In reality, they are coming from IP address 124.217.216.112, and the emails are sent from (almost certainly spoofed) email addresses such as claude.simpson@ameritrade.com and lwjtvbwrqksz@young-world.com.