Protonmail Warning

[Wow612]

Yesterday on PTM I got a email saying:








1. You have a DHL shipment addressed to you. To view document information.

Please Click Here or copy and visit This URL : http://dhl/tracking/document/information/confirmdeliverylocation 

from your browser.

2. Kindly complete the tracking procedure to get your tracking number and also confirm your delivery address.








Email looked pretty decent but i assume this is what the warning was about? I also got the tutanota emails. This happening to anybody else?

 

[DoomKitty]

Yes those are them.  Don’t click on anything obviously and don’t reply to them!!  You can choose to “report phishing” ( click on the down arrow button above the email in question) which will notify protonmail about the scam and will put it in your spam folder.  

 

[Wow612]

@DoomKitty Will do. Looked at the sender email and I traced it back to somebody with a public designer balloon business. Stay safe!

 

[Idaknowbetter]

YES! I am terrified that I may have paid $ to them instead of my intended vendor, now that I see the warning!

havent been on forum much lately, so how long has this been going on?

 

[Idaknowbetter]

Also, I just tried to confirm email receipt via protonmail with a vendor, from our forum, that I hadn’t contacted before. 
I like to follow up new emails to new sources with a PM on here. 
they responded saying they hadn’t gotten an email from my protonmail email address.

first time that has ever happened! 
I am freaking worried!

 

[Wow612]

@Idaknowbetter I noticed the warning today when i got on. Yeah i got confused because of the email. Did a slight search on the email that emailed me, got their phone number, business fb ect. Hopefully it all goes okay though

 

[lookinforthebiscuits]

I've also been receiving the phishing emails in my Protonmail account. There were quite a few at the end of last week and a few this week.

I stand to be corrected on this, but it's very unlikely that Protonmail itself has been compromised. That would be big news if it had. What's far more likely is that a vendor(s) email account was compromised, the email addresses contained in the address book were harvested and those addresses were spammed with these phishing emails. Clicking on any of the links/opening any of the attachments in those emails likely means either your device was infected with malware and/or your Protonmail account has been compromised. Either way, it's a big problem for all of us.

All members (and vendors for that matter) should ensure they are free of malware and change their mail account passwords asap.

 

[porkandbeansboy]

Does anybody have a recommendation for an email provider to replace with protonmail. I remember someone telling me about how they use Thunderbird with their email which I got to check into.

I haven't received any of these phishing emails on either one of my protonmail accounts. I'm assuming using temp.pm and any email provider would be enough right?

 

[DoomKitty]

@porkandbeansboy For providers that offer free accounts check out Tutanota and Mailfence. Runbox and Mailbox and Posteo are good too imo but cost varying amounts.  Any provider has its pros and cons so research accordingly. As for phishing scams, not clicking on links in suspicious emails (or any email without at least checking the link first) is your first defense.  Even if someone sends you a temp.pm it can contain a malicious link, or what looks like a temp.pm link might not in fact be one.  Thunderbird is a great desktop email application (not a provider, just an application) with many good security features.  Definitely recommended. 

 

[2earls]

I was going to mention this last night and I think someone else has brought it up, but try to avoid using any obvious keywords like bitcoin or payment.

My conversation with one of the vendors was going along as usual until I requested his bitcoin address and that initiated a reply from the scammer. First email was just the wallet # and then it was followed up with some generic chit chat like "and is everything good with you? ". I guess this was an attempt to make it seem personal. 

 

[Idaknowbetter]

So should I delete my email with proton, which I plan on doing now that I was indeed hacked.  (Olart and I worked it out, and he actually pinpointed the point at which it happened for me.)

how does that affect this forum membership since it is affiliated w/ my protonmail account? 

don’t remember anything in the rules about how to change over email address. I just remember reading that users may not have multiple accounts. 
@2Pearls, can you help me out with this one?
 

 

[2earls]

Hello everyone,

I want to bump this thread because some of us are once again getting the original "lockandload" emails that were the start of this whole Protonmail scam.

They send a variety of phishing emails,  but the one that catches many people is this "you have an encrypted email from Tutanota" and if you click on the link then they get in your emails. 

Don't open any emails on Protonmail unless you know the sender and never fill out any forms, confirm any information, or click on any links. Even if they look legitimate.

For anyone who wasn't around when this scam was going strong, what happens is the scammers intercept emails and reply as your vendor with phony payment information. To protect yourself double check any email from a vendor that has payment info. If the email address is a 100% match to what it should be you are alright, but if it's the same address with a different email provider or the address is off by one letter then DON'T send the payment.

Seems like this scum is making another big push to snare potential victims so please don't become one. If you have concerns pm me.

 

[Ruthiejams]

Yes.Tony warned me about them. Then, the second phishing try by someone wanting us to click the blue banner..lol..I just reported it as phising.jeepers. Why do they think we use proton mail? Fumbled crooks!!!

 

[aenima1336]

Six "confidential Mails" to verify my pm account. In one hour. 

Anyone else?

 

[lookinforthebiscuits]

Six "confidential Mails" to verify my pm account. In one hour. 

Anyone else?

Can confirm I received the same (though only one). Reported as phishing. These assholes never give up. 

 

[Painful heart]

@aenima1336 I got the same crap!!! I didn’t open the link!!! 

 

[Painful heart]

Are these damn scammers? I’m not dumb opening something Idk about. 

 

[DoomKitty]

@Painful heart Most definitely scammers!!  Got one earlier saying my protonmail was going to be closed immediately unless i clicked the link to stop it LOL.  Whats most funny is these script kiddies dont even really try!!! They never even attempt to make the sender address look remotely real.  Just plain lazy lol!! Really hope no one is falling for these .

 

[eagan1]

Never ends unfortunately.be vigilant people.like we all don't have enough bullshit to deal with at the time.peace