Scam email - What's it trying to do?

Hi there,
I just got a scam email which had 2 parts, the scam (energy company bs), but hidden in the email (only visible in raw view or searches), it has the following:

<p>Hello,</p>
<p>Somebody just used this email address to sign up at Cloudflare.</p>
<p>If this was you, verify your email by clicking on the link below: https://dash.cloudflare.com/email-verification?token=7JxHtx...eY0M If this was not you, any other Cloudflare accounts you may own, and your internet properties are not at risk.</p>
<p>You can remove this account by clicking on the link below.</p>
<p>https://dash.cloudflare.com/unintended-registration Token: aa...2b9 Thanks, The Cloudflare Team</p>

<p>Hello,</p>
<p>Somebody just used this email address to sign up at Cloudflare.</p>
<p>If this was you, verify your email by clicking on the link below: https://dash.cloudflare.com/email-verification?token=7JxHtx...eY0M If this was not you, any other Cloudflare accounts you may own, and your internet properties are not at risk.</p>
<p>You can remove this account by clicking on the link below.</p>
<p>https://dash.cloudflare.com/unintended-registration Token: aa...2b9 Thanks, The Cloudflare Team</p>

<p>Hello,</p>
<p>Somebody just used this email address to sign up at Cloudflare.</p>
<p>If this was you, verify your email by clicking on the link below: https://dash.cloudflare.com/email-verification?token=7JxHtx...eY0M If this was not you, any other Cloudflare accounts you may own, and your internet properties are not at risk.</p>
<p>You can remove this account by clicking on the link below.</p>
<p>https://dash.cloudflare.com/unintended-registration Token: aa...2b9 Thanks, The Cloudflare Team</p>

<p>Hello,</p>
<p>Somebody just used this email address to sign up at Cloudflare.</p>
<p>If this was you, verify your email by clicking on the link below: https://dash.cloudflare.com/email-verification?token=7JxHtx...eY0M If this was not you, any other Cloudflare accounts you may own, and your internet properties are not at risk.</p>
<p>You can remove this account by clicking on the link below.</p>
<p>https://dash.cloudflare.com/unintended-registration Token: aa...2b9 Thanks, The Cloudflare Team</p>

Obviously hiding the tokens, but what's happening here? Is this just to make Gmail think the email isn't a scam? Is someone actually trying to log in?
Any info about what these links could do (because there's no way in hell I'm clicking them) would be great!

Erisa•12/6/24, 10:42 AM

Is this just to make Gmail think the email isn't a scam? Is someone actually trying to log in?

i cant answer this part for you with the limited information, id think it would only truly be a legit login if it came from @ cloudflare.com and had fully valid SPF and DKIM signing though.

Any info about what these links could do (because there's no way in hell I'm clicking them) would be great!

assuming the tokens are even valid (which is possibly a reach):

the first one verifies an account registered to whatever email the token was sent to, this one you do not want to click if its legit because it will give someone a verified account with what could be your email
the second one is used for when someone registers an account on your email without consent and, again assuming the token is even valid, deletes the account that was created. this one, assuming the token is valid and the link actually leads to its intended destination (check for sneaky unicode characters in domain, etc.), is safe to click

EErisa > Is this just to make Gmail think the email isn't a scam? Is someone actually ...

PineaOP•12/6/24, 10:54 AM

This came through on my secondary email anyway, so no CF account

PineaOP•12/6/24, 10:54 AM

The thing is that like, the cloudflare part is hidden below other stuff

PineaOP•12/6/24, 10:54 AM

PineaOP•12/6/24, 10:54 AM

the email looks like that (which like, clearly a scam)

PineaOP•12/6/24, 10:55 AM

I find it so weird that they've given an email with dangerous cloudflare links, but they never render

PPinea This came through on my secondary email anyway, so no CF account

Erisa•12/6/24, 10:57 AM

well my point is one might have been created, thus making it potentially dangerous to click

PineaOP•12/6/24, 10:58 AM

That makes sense, i'm definitely not going anywhere near them links lol

PPinea That makes sense, i'm definitely not going anywhere near them links lol

Erisa•12/6/24, 10:59 AM

you probably should remove the image btw, because it has the full link visible and any curious person could access it and do the potentially dangerous action

PineaOP•12/6/24, 11:00 AM

thats fair

PPinea I find it so weird that they've given an email with dangerous cloudflare links, ...

Erisa•12/6/24, 11:01 AM

the way you screenshotted it though makes me realise why

so there are a few different ways different email clients can interpret an email, either as html or as plain text, these are denoted by the "Part" and "content-type" sections there.

if an email client is html-compatible (most are), it will display the email as the fancy html that you saw.
if it supports text only, it will instead display the cloudflare verification links. maybe its two traps bundled into one, or maybe the bad actor has no idea what theyre doing, who knows

Erisa•12/6/24, 11:01 AM

oh actually, nevermind, thats text/html also

Erisa•12/6/24, 11:01 AM

but the point stands that they are two separate parts and it depends on how the email client inteprets it, maybe check the content-type of the other

PineaOP•12/6/24, 11:02 AM

interesting

PineaOP•12/6/24, 11:02 AM

I do find it weird that Apple's mail app lets you search for "cloudflare" and it comes up, but won't render it in the email

Erisa•12/6/24, 11:02 AM

yeah that is weird

Erisa•12/6/24, 11:02 AM

maybe theres css to hide it

PineaOP•12/6/24, 11:02 AM

Actually same in the gmail website

EErisa maybe theres css to hide it

PineaOP•12/6/24, 11:03 AM

But it has no classes or anything

PineaOP•12/6/24, 11:03 AM

although it's outside of the whole <html> so maybe thats weird

Erisa•12/6/24, 11:03 AM

its in a separate email part entirely

Erisa•12/6/24, 11:03 AM

but yeah, weird

PineaOP•12/6/24, 11:03 AM

But they've gone straight for <p> not <html>

Erisa•12/6/24, 11:03 AM

indeed

Erisa•12/6/24, 11:04 AM

i dont think theres a great deal of insight you can surmise from this alone, but i would guess its trying to take advantage of some types of mail clients

PineaOP•12/6/24, 11:04 AM

Fair

PineaOP•12/6/24, 11:05 AM

I mean I cURL'd the links fro the first part (not cloudflare), and it has a fake "send message" form, loads of placeholder text, and script tags I don't trust

PineaOP•12/6/24, 11:06 AM

Anyway yeah, I was interested what they were trying to achieve and how dangerous them links were, so thank you!

Erisa•12/6/24, 11:06 AM

hard to tell the overall goal sadly

EErisa hard to tell the overall goal sadly

PineaOP•12/6/24, 11:08 AM

Turns out at the start, there's also an EA section

PineaOP•12/6/24, 11:08 AM

but it does include this:

------=_Part_naJAsxHz_021975899757836419.IlJQGkaYdTqg
Content-Type: multipart/parallel; boundary="_9bee47b7-fc01-4dcf-a4ea-98271700f497_"

--_9bee47b7-fc01-4dcf-a4ea-98271700f497_
Content-Type: multipart/alternative; boundary="_6141f463-c090-4c07-9f5d-8aa656b2f260_"

--_6141f463-c090-4c07-9f5d-8aa656b2f260_
Content-Type: text/plain; charset=utf-8

------=_Part_naJAsxHz_021975899757836419.IlJQGkaYdTqg
Content-Type: multipart/parallel; boundary="_9bee47b7-fc01-4dcf-a4ea-98271700f497_"

--_9bee47b7-fc01-4dcf-a4ea-98271700f497_
Content-Type: multipart/alternative; boundary="_6141f463-c090-4c07-9f5d-8aa656b2f260_"

--_6141f463-c090-4c07-9f5d-8aa656b2f260_
Content-Type: text/plain; charset=utf-8

(EA > Solar > Cloudflare)

Erisa•12/6/24, 11:08 AM

it could still even be possible its what you theorised, trying to avoid spam detection by posing as legit emails

Erisa•12/6/24, 11:08 AM

lol

Erisa•12/6/24, 11:08 AM

which one is text/plaintext/plain

PineaOP•12/6/24, 11:08 AM

cloudflare

Erisa•12/6/24, 11:08 AM

Erisa•12/6/24, 11:09 AM

so it was what i originally thought then, clients not supporting html will show the cloudflare links

PineaOP•12/6/24, 11:09 AM

so they list it in 2 different types?

Erisa•12/6/24, 11:09 AM

and maybe some spam detections only run on the text part or something, idk

PineaOP•12/6/24, 11:10 AM

true, yeah

PineaOP•12/6/24, 11:10 AM

also should I open the unintended registration one?

PineaOP•12/6/24, 11:10 AM

nvm that page doesnt exist and it just goes to /

------=_Part_naJAsxHz_021975899757836419.IlJQGkaYdTqg Content-Type: multipart/parallel; boundary="_9bee47b7-fc01-4dcf-a4ea-98271700f497_" --_9bee47b7-fc01-4dcf-a4ea-98271700f497_ Content-Type: multipart/alternative; boundary="_6141f463-c090-4c07-9f5d-8aa656b2f260_" --_6141f463-c090-4c07-9f5d-8aa656b2f260_ Content-Type: text/plain; charset=utf-8

Scam email - What's it trying to do?

Similar Threads

Similar Threads

Similar Threads