Package Tracking Email

telcodad

Found this very suspicious email in my Spam folder this morning. If it was actually legit, why would you need to click just to see the order number and the estimated delivery date? 😉

vaxvms

Look at the content and ask yourself Who is it from?

antdude

And why firebaseapp.com? 😛

InternetJeff

Are you expecting a shipment?

telcodad

InternetJeff Are you expecting a shipment?

With all the online purchasing my wife and I do these days, we’re always expecting a shipment of one kind or another.

Oakenshield

I also got this, there was a reference to some Cloudflare server

~$ host v20.wcsitzpro.com
v20.wcsitzpro.com has address 104.21.48.1
v20.wcsitzpro.com has address 104.21.112.1
v20.wcsitzpro.com has address 104.21.32.1
v20.wcsitzpro.com has address 104.21.16.1
v20.wcsitzpro.com has address 104.21.64.1
v20.wcsitzpro.com has address 104.21.80.1
v20.wcsitzpro.com has address 104.21.96.1
v20.wcsitzpro.com has IPv6 address 2606:4700:3030::6815:1001
v20.wcsitzpro.com has IPv6 address 2606:4700:3030::6815:2001
v20.wcsitzpro.com has IPv6 address 2606:4700:3030::6815:4001
v20.wcsitzpro.com has IPv6 address 2606:4700:3030::6815:6001
v20.wcsitzpro.com has IPv6 address 2606:4700:3030::6815:5001
v20.wcsitzpro.com has IPv6 address 2606:4700:3030::6815:3001
v20.wcsitzpro.com has IPv6 address 2606:4700:3030::6815:7001

the sender was packagetracking@aha17-8ce39.firebaseapp.com

but I couldn’t figure out yet how to report phishing emails with full headers just like I used to do when I was using dslreports (i Just signed up so maybe my question seems ridicolous)