3 ms·
> The email appears to have been sent from Teamnort@saless.cc. Interestingly enough when trying a WHOIS on saless.cc it appears the domain is not registered. W
by 5ESS 5y ago
> The email appears to have been sent from Teamnort@saless.cc. Interestingly enough when trying a WHOIS on saless.cc it appears the domain is not registered.
What?! That’s even more interesting than your main problem.
However considering your main problem I see 2 possibilities:
1. SimpleMail service was compromised
2. A local Xfinity store was compromised. I used to work at a telecommunications provider brick n mortar store and there was a common scam going around where sophisticated threat actors would call the store phone and convince the (low wage, low competence) employees that they’re calling from the “corporate office” and provide instructions to install a RAT, thus compromising the computer systems at the store. (There was no admin password on the computers, this was a franchise for one of the most popular US cellular companies in 2021, im positive this scam is still happening every day)
- encryptluks2 5y agoAfter further review, it appears that the email may have actually been sent through Intuit using fake info with Teamnort@saless.cc as the reply-to. If you call the number, they usually answer saying they are Norton or PayPal. I've already notified Intuit and RingCentral who they appear to be using. This is the link to the "invoice" in the email which is on the intuit.com domain: http://links.notification.intuit.com/ls/click?upn=LEV65WI9EZ1l5TkUt4hKqzq6J49VEXJMRhUxqRckK3UK6eeEy0A-2FylQ0WpPN9IR9nATq3WhntsTLMCi919IHWNGN3Tj-2FK2VMh8LqgxBr-2B2zIBjvRevZonaUcP-2F-2FKTCJIf-2FIn7ByiURMhob3UXToez3NMhweIUVN-2B-2BrYjy61x8vuWd7frlJ5mkcU0T1lCoQUJJjf-2FOkYf-2F7w2B-2FW2uRj8Ubvllze9o3ogZx31nAWcKkhLGIfah7G21XluMlB6ANpvqK0g89N46U8t-2FNE315ASww-3D-3DQAgR_qKXDVQyKHas9w5ytTrAVVEEECagSwEJYsWyFvjbQ03mi0ilAZeMGGMWbcXtBKBi7nQnkJfICcYTbxNQ9Uaas7We06vyFcP1uIGLFkUD66B34l9ZB5D49vei-2B6y9mTHZppU51N7k1wWvEqfiIPXsP0amhNMuubEhUlhGR6oQUx62cIEwn1X2Y8K6lwNuGKrvue82rMZRCzREnDWRgoQucSrDvGrcdcGdjgN2YYLtqRXWJtN27NXkQDLoHqBKKdXvqW2-2FOUaeszgvOnP2-2BEpMLjjCIlcVB-2FTm19dlofWRgOCxYi8yIsePBNq7VOJTmxB3vV-2B1ZCl-2BBRLyBMVrrAOQ8XzhMGYQ6mSsqIbnfMo5N-2BzN92jHOfYO6qM1e6Xtkj9G4vEZjpUXrs94GikjL9PZUnAot6OYTg0ef6Iw1LX41CKLcP5bZkDClC3PBAqV-2FJL54MR9fOMW-2F-2FpBK7UFbuKhi3Lof8CtSi3Nyh8et36wzqe4UE-2BJqPV8SXnkcYDJah2hjcea08vQdxxnXPGPo377DWIX-2FhMpla2HeU8cYOfi6Ooz6tWkTplGeeZNM947wJQia0EWqrxHMRYBGONhLsi-2B9ZfOJSMEfI3-2F-2FZo-2BbV-2FeabNm2wifBMK59ywnyxDLoDzHqvysq-2F-2BNSndaR7ZqKSjsMWA-3D-3D http://links.notification.intuit.com/ls/click?upn=LEV65WI9EZ...