Welcome to HelloFax Here is Your Fax - spam warning
HelloFax are on the hit list again and thanks to comments from our good friend Patrick Klos, we are now posting articles siting these spam emails as possible email address verification emails.
This HelloFax spam email has once again the same link encoded within it which Patrick informs us may well be just a coded hash of the email address to which the spam email is sent.
In this case we see the link as: http://vermontpancake.com/?1U=encoded-email-address where the 1U= the user to where the email was sent.
This is presumably to monitor where their spam succeeds and to then sell on or send over a more damaging spam knowing which users will be reached without raising their spam blacklist profiles unnecessarily.
You can see the email here:
From: HelloFax <[email protected]>
Sent: 29 October 2018 17:42
To: Recipient
Subject: Welcome to HelloFax, Here is Your Fax
The quickest way to send faxes on-line
Dear Client,
Here is Your Fax
Date and Time: 10/29/2018 09:32 AM
Number of pages: 9
Personal reference number: TGH657348K.
We appreciate you going paper-less!
- HelloFax Community
|
|
|
The link points to: http://vermontpancake.com?1U=Encoded-Email-Address where the Encoded-Email-Address appears to be an encoding of each character of the email address rather than a hash of the whole address because (as pointed out be Patrick Klos) it is the same number of characters as the email address to which it has been sent.
In this case "." character is referred to by the "Y" character in the encoded version. "." is ASCII code 46 and "Y" is 89
If there is any correlation between this and any other email addresses this message is sent to we will post the results later.