cyber.hendryadrian.com
Security Insights · huntress.com

How to Spot a Smishing Attempt: Sender, Link, Text and Urgency Red Flags

· Original article ↗

Summary

A Huntress security-awareness walkthrough examines a fake Amazon account-suspension text and explains how to check its sender and link, spot suspicious wording, and resist pressure to act quickly.

Key points

  • The author received a text impersonating Amazon and claiming the account was suspended, with a 24-hour deadline.
  • The sender used blogger-bukuharian[.]art, which the author checked with Domain Dossier, ICANN and urlscan.io; the results did not appear consistent with Amazon.
  • The message linked to hxxps://l[.]ead[.]me/Unusual-Activity-Amazon-Account-ID-785654 and prompted the recipient to log in; entering credentials could expose them to the attackers.
  • The author used urlscan.io and VirusTotal to examine the link and noted that the page appeared suspicious; the article says the link’s scan results later changed.
  • The article advises checking sender and link details, noticing unusual formatting or grammatical errors, and pausing rather than responding to urgency.

Article Details

Topic
Analysis of an SMS phishing attempt impersonating Amazon

Indicators of compromise

TypeIndicatorContext
DOMAINblogger-bukuharian[.]artDomain used in the sender address for the Amazon-impersonation phishing attempt.
EMAILnoreply-suspended-account-id-39840006@blogger-bukuharian[.]artSender address used in the SMS phishing attempt impersonating Amazon.
URLhxxps[:]//l[.]ead[.]me/Unusual-Activity-Amazon-Account-ID-785654Phishing link sent in the SMS to direct the recipient to a credential-harvesting page impersonating Amazon.

Tools

Domain DossierThere’s a lot we can do to verify who this sender actually is, but for simplicity’s sake, let’s start with Domain Dossier, ICANN and urlscan.io.urlscan.ioThere’s a lot we can do to verify who this sender actually is, but for simplicity’s sake, let’s start with Domain Dossier, ICANN and urlscan.io.VirusTotalBut the real kicker? Check out the results returned to me after copying and pasting the link into VirusTotal:

Related Articles