Phishing? EClinicalWorks “Portal login information”

2024-05-02 • SEND FEEDBACK |
Related: cyber social engineering, phishing, security

re: phishing
re: Computer Security: 7 Rules to Keep Hackers at Bay

Never click on links in emails. Unless you are 100% sure. Which is arguably never the case.

This one almost got me—I somehow assumed it might be from my independent doctor, a very wrong assumption as it turns out: “absolutely not”.

What passed the plausibility check is that they used my name along with my semi-private email. And I’ve seen things of this style before. The grammar and spelling are correct, which is often not the case with scammers. But nowhere in there is there any reference to the actual relationship, which is why I checked.

EClinicalWorks is a legitimate outfit using AI in the medical field, which a web search shows. But that doesn’t make the email legitimate.

It has most of the hallmarks of a scam eg no personal details other than publicly-known things (first name and email). No expectation of receiving it. “no-reply” return address. General claims of benfits that will accrue. An unrecognizable domain of "mycw99.ecwcloud .com" = WTF.

And... I would bet that quite a few people would click on through.

The headers suggest that this is from Amazon. I don’t know if it is or not since it is “amazonses.com” whatever that is. This is seriously poor judgment by Amazon, if that’s who it’s from.

Return-Path: <0100018f3b95ef9e-a45e018d-666c-4668-b22a-f03627ef41a2-000000@amazonses.eclinicalmail.com> Received: from d217-169.smtp-out.amazonses.com (23.249.217.169) by llc4.com

“your health care”: where?!
“our office”: whose office?
“our practice”: which practice?

It takes a seriously incompetent person to send out a mail like this. Or a skilled scammer.

“your health care” — by whom?
Phishing?