Phishing e mail from no-reply@con.sonos.com

Here’s an odd one… got this today, is this for real? Feels dodgy as why would you request my email when you appear to have it??? 

You could try to use a temporary email address.

Here’s an odd one… got this today, is this for real? Feels dodgy as why would you request my email when you appear to have it??? 

 

It’s your MAILING address that has been requested, not your email. In any case, looks dodgy but it depends which email address it has actually come from. Is it from the email address per the name of this thread? 
 

Which if it is Patrick Spence is in my Sonos account information… so they should be able to access that? 

@Corry P is this something anyone can check? email looks like patrick.spence@sonos.com

“submitting a Sonos diagnostic via Reddit” ?? Is that a new undocumented feature? 😂

even without asking for a mailing address that screams spam.

Obviously the from address is easy to fake and examining the chain of email servers the message was sent through should reveal more details of where it originated from.

My question would be if the email address sent to matches a specific email address you use only for Sonos and isn’t a catch all or common across you use everywhere, where did being a Sonos owner/user and a name which may or may not be accurate end up linked together, unless it’s just a general mass spam sending to existing lists hoping to get lucky with wherever it ends up delivered.

Following Patrick’s Q&A on Reddit, he offered a window (24 hours I think?) where people could submit their system issue to the Sonos team and the team would specifically look into them, as a one-off goodwill offer.

So if Ian_S did that, it’s possible, however unlikely, the email is legit. 

High level spammers and hackers routinely alter the email headers, often in characteristic ways. It’s a lot of unproductive work when attempting to track them down. My business account receives too many phishing attempts. I have a filter that recognizes many of the perpetrators because they tend to use (purchase) the same phishing apps. My filter returns a rejection code to the server. It’s interesting that there is some quality control along the way because most of the perpetrators give up after a while. Hyjacked systems have probably relayed many of the messages. My rejections get noticed by hijacked system administrators and they’ll block their link in the chain. I don’t waste my time attempting to track the chain of relays.

@Rhonny interesting. You’d have hoped a carrot would have been mentioned as an incentive to get more people to submit, so it then wouldn’t be a surprise to receive an email. Although with the speed spammers work at these days that could have backfired.

@buzz I don’t disagree and rarely investigate headers unless I’m occasionally curious and know what good looks like. The spammer and botnets have become far more sophisticated than they used to be. Not just for email, but also website attacks.

Maybe I should have just submitted an issue on Reddit rather than spending the last few months helping countless people with theirs on here.

Any recognition for that, Patrick….? No? Cheers.