Bogus Amazon account compromise notice leads to phishing

A phishing email impersonating Amazon is hitting users’ inboxes, trying to trick them into believing that various computers connected to their Amazon account and threatening account suspension unless they “confirm” their account information (click on the screenshot to enlarge it):

In spite of the atrocious spelling and grammar mistakes in the email, the link takes victims to a high-quality spoof of the Amazon.co.uk login page that asks users to submit their email address, Amazon account password, then redirects them to a spoofed Amazon.com page asking for their name, address, date of birth and credit card information.

Avira’s Sorin Mustaca points out a few interesting details about this phishing attempt: the jumping from one to the other Amazon domains, the fact that some of the spoofed pages’ source code was lifted from the legitimate ones, and that the spoofed page actually returns an error if the victim enters an email address that is too long.

Despite the aforementioned jumping, it’s highly likely that most users who follow the link won’t notice the difference. If they believed that poorly written email came from Amazon, they are probably not the most perceptive of users.