The Expiring Mailbox Scam

This is a fairly common scam that plays on fear to make you do something without thinking too much.  "Your account is being disabled because you did something wrong so would you kindly click the link to fix it?"  Nothing is actually wrong with your account but they try to make it look official, scary, and have a deadline.

The Scam E-Mail

Identifying Traits

  • Incorrect domain.  This one comes from "ri1l.com" which is not the domain of Microsoft mail servers or our mail servers.

  • Link goes somewhere random.  Putting your cursor of the "Resolve Issues Now" link without clicking it will show where that link is sending you.  Similar can be done on most cellphones but long-pressing on the link rather than tapping on it.  In this case it goes to "happythaitravel.com".

  • Claims to come from internal team.  The e-mail claims to come from "Internal Maintenance Team".  For very large companies this would probably get overlooked.  If in doubt, call to make sure it's legit.  Especially if it's something asking for your credentials.

What It Does

If you actually click the link (don't do this!), it will take you to an SSL certificate alert.  The bad guys are using the default SSL certificate for their firewall in front of the host server for their scam website.  Likely they're actually using someone else's website that they broke into.  If you click through this warning, Chrome (if you're using it) will show another alert that this site is known to be deceptive.  Clicking through this additional very bad sign gets an SSL error.  So after all this work the bad guys didn't set up their site correctly and no one sees anything.

in News