• How best to check a suspicious email with URL links without opening it.

    Home » Forums » Outside the box » The Junk Drawer » How best to check a suspicious email with URL links without opening it.

    Author
    Topic
    #2294330

    Today I got an unusual email, spam actually, but of a particular kind tat I found interesting enough to check several URL links in it for potential phishing or communicable malware, appearing in the form of buttons, to get more information.

    I say it is “spam”, and weird enough for me to feel suspicious of, because it is an invitation to visit online an exhibition at a private art gallery I never heard of, and this exhibition opened a few days ago and closes tomorrow. Normally, such an invitation is sent in advance of the event, not almost at the end. In any case, the artists whose works are being exhibited either do not interest me (Warhol) or I’ve never heard of. The works being shown, according to the email, are “post-Warhol”, a recent period in Western art that generally does not appeal to me enough to bother watching its works, even online. So how come I got selected to be invited?

    Now I am going to describe the procedure I followed, so others might comment on it and maybe suggest other perhaps even better ways of doing this, without spending a lot of time doing it.

    I did not open the email, but did my checking on its image in the preview pane. On the advice from some of you here, for a while I have been using this Google Website to do the checking:

    https://transparencyreport.google.com/safe-browsing/search?url=https:%2F%2Fus1-usndr.com%2Fen%2Fmail_link_tracker%3F

    Where one pasts the URL of each link in succession (here garnered by hovering the pointer over each button) on a field available for this and clicks a looking-glass shaped icon.

    Here is the beginning of one of those suspect links (copied first to an ASCII file):

    First, the prefix is “https” etc, and then : “us1-usndr.com/en/mail_link_tracker?hash=6rkb34rq…” followed by a whole lot more data. (There is something odd here at AskWoody that insists in making anything that starts in “https” and two slashes into html, even if it is plain text when viewed as “text”.)

    A second later comes the verdict. In my case this always was:

    “Google Transparency Report, Safe Browsing site status: No unsafe content found”

    Followed by this note:

    Google’s Safe Browsing technology examines billions of URLs per day looking for unsafe websites. Every day, we discover thousands of new unsafe sites, many of which are legitimate websites that have been compromised. When we detect unsafe sites, we show warnings on Google Search and in web browsers. You can search to see whether a website is currently dangerous to visit.

    I did not click on any of the email links, anyway, and I deleted the email itself, after taking a screen shot of the more relevant part of the message:

    Screen-Shot-2020-09-06-at-6.07.23-PM

    Ex-Windows user (Win. 98, XP, 7); since mid-2017 using also macOS. Presently on Monterey 12.15 & sometimes running also Linux (Mint).

    MacBook Pro circa mid-2015, 15" display, with 16GB 1600 GHz DDR3 RAM, 1 TB SSD, a Haswell architecture Intel CPU with 4 Cores and 8 Threads model i7-4870HQ @ 2.50GHz.
    Intel Iris Pro GPU with Built-in Bus, VRAM 1.5 GB, Display 2880 x 1800 Retina, 24-Bit color.
    macOS Monterey; browsers: Waterfox "Current", Vivaldi and (now and then) Chrome; security apps. Intego AV

    1 user thanked author for this post.
    Viewing 6 reply threads
    Author
    Replies
    • #2294487

      The spoofers are getting really good.  I got one recently, allegedly from American Express, that contained the last five digits of my credit card and which was very professionally done.  It said that a new card had been sent to me and that I should have already received it.  (My card does not expire until 2022, so that was my first red flag.)

      I called American Express, using the number on the back of my card, and their people told me that they had NOT sent me a new card.  All of us know that if I had clicked on the I-did-not-receive-my-card link, bad things could have happened.

      American Express security people are using what I sent them to try to track down the spoofers.

      Once upon a time, I worked for the Federal government and had a highly-secure, classified-information computer.  I realized that someone was trying to penetrate the system.  I got lucky and tracked them down (through 12 servers spread around the world) to a specific address in the Ukrane.  We passed the information on to that country’s computer security people, and they caught the bad guys red-handed.  It turns out that those hackers had been draining the bank accounts of Russian oil oligarchs and had not previously been caught.

      This was great news, right?  Not really, when my high-level security clearance was next up for a review, I had to explain why I had received a “special commendation” from the Russian Federation.

      Ours is a dangerous world.

      2 users thanked author for this post.
    • #2294620

      If you’re doubtful about any link mentioned on a page or in an email, you can always go to “https://www.virustotal.com/en” (without the quotes, of course), select the “URL” option and type or copy/paste the url in there. It will then be scanned for safety by up to 70 some scanners currently available and you will be presented with the results within about a minute or so, all at once.

      The above-mentioned site will also scan suspicious files in the same manner, just select the “File” option instead. Patch Lady @sb made me aware of this site’s usefulness many moons ago!

      2 users thanked author for this post.
    • #2294662

      I choose ‘save as text’ w/o using the preview pane. The look in note pad. How is the preview pane any different than just opening.

      🍻

      Just because you don't know where you are going doesn't mean any road will get you there.
      • #2294698

        Wavy: About the “glitch” I mentioned: I copied the https address to an ASCII file and from there to my opening comment of this thread, so it was just ASCII text not html when I copied it here.

        How is looking at email in the preview panel like opening the email? Good question. My tentative answer is that at a government agency where I do my professional correspondence and where the IT people are very strict about security, we are allowed to see the mails in the Outlook preview pane without opening them. Anyone else has a different opinion on this?

        Ex-Windows user (Win. 98, XP, 7); since mid-2017 using also macOS. Presently on Monterey 12.15 & sometimes running also Linux (Mint).

        MacBook Pro circa mid-2015, 15" display, with 16GB 1600 GHz DDR3 RAM, 1 TB SSD, a Haswell architecture Intel CPU with 4 Cores and 8 Threads model i7-4870HQ @ 2.50GHz.
        Intel Iris Pro GPU with Built-in Bus, VRAM 1.5 GB, Display 2880 x 1800 Retina, 24-Bit color.
        macOS Monterey; browsers: Waterfox "Current", Vivaldi and (now and then) Chrome; security apps. Intego AV

    • #2294696

      ? says:

      i’m bored waiting for the cold front to put out the forest fire(s) so, i will share my unwanted junk email fix proceedures. first i use linux (pick your favorite flavor ’cause it is always free) on a 10 dollar sandisk stick. next i browse to an aol account that has been open since ’03 or 04 (the only one out of four other major providers) that allows junk into my mailbox where there i can choose from many examples delivered daily. next right click (view message source) to open in sandbox and plug into Googled “spam email header reader,” i usually open “https://toolbox.googleapps.com/apps/messageheader/,” because i’m assuming they glean the interesting sections for futher scrutiny? then on to “https://mxtoolbox.com/EmailHeaders.aspx,” (lots of good info) then on to “https://mailheader.org/,” ’cause it is a .org, then “https://mha.azurewebsites.net/,” because like goog i assume micro loves to harvest, and then i finish off with “https://www.iptrackeronline.com/email-header-analysis.php,” where at the bottom i can quiz the ns (domain name whois query.) then after all that i finish with a nice “https://www.speedguide.net/ip/,” and run the ever popular “black list check” (they always are.) oh, and yes i usually ship the romanian, lithiuanian, DE, UK, french submissions (not many from SA these days) off to my (good) friends at homeland security, “https://us-cert.cisa.gov/report-phishing,” for good measure. i don’t know if any of this does anything to sterm the flow of this undesirable corespondance, but i always feel better after. so there you have it and now i’m a bit closer to trading in the shorts and flip flops for the winter parka…

      2 users thanked author for this post.
    • #2294851

      This was great news, right? Not really, when my high-level security clearance was next up for a review, I had to explain why I had received a “special commendation” from the Russian Federation.

      Kate Fazzini’s book, Kingdom of Lies, is an unusally good book to postulate 😉 on what really happens behind the scenes amid the cyber-kingdoms of transnational, virtual corporate states.

      Human, who sports only naturally-occurring DNA ~ oneironaut ~ broadcaster

    • #2294855

      OscarCP – this is also interesting to me because some of the bad guys smartened-up to appreciate that an aficionado of art won’t often be thoughtful enough to spot or suspect malware when they see it. The bad guys in this case did some clever social engineering to create phishing exploits.

      Human, who sports only naturally-occurring DNA ~ oneironaut ~ broadcaster

    • #2294870

      I have another question since we are asking: is web mail (which I loathe ) safer than using an email client??

      🍻

      Just because you don't know where you are going doesn't mean any road will get you there.
      • #2295068

        It’s the same thing, but a mail client usually stores mail locally.

        In both you connect to your email provider with a username and password, but a client stores the login internally.

        cheers, Paul

        1 user thanked author for this post.
    Viewing 6 reply threads
    Reply To: How best to check a suspicious email with URL links without opening it.

    You can use BBCodes to format your content.
    Your account can't use all available BBCodes, they will be stripped before saving.

    Your information: