Strange email...

[CZroe]

I didn’t order anything but that name and address are right. Funny thing is, I don’t officially use that mailing address for anything except the occasional Amazon delivery (not to suggest Amazon has been compromised).

It looks like they want me to think that the email is from someone working for the state of Alabama but that TLD is wrong (katherine.blaze@adph.state.al.us instead of al.gov). The blank “Company” line in the sig speaks volumes.

I’ve already spoken with my mother and brother. It sounds like the kind of thing my mother would order but she would not have it shipped to my address and she claims to know nothing about it. My brother doesn’t know anything about it either.

I get the feeling that they want me to respond that I did not order it in order to verify that the address they have for my name and email is correct for some database of I’ll-gotten personal info.

 

[Chaotic42]

I'd definitely not respond. Worst case you get a free radon test.

 

[CZroe]

Just got a related email...

The UPS tracking number doesn’t work on UPS’s website. The domain in the tracking URL is “sendgrid.net,” so I made sure not to click it and to go to UPS.com instead. That tracking number doesn’t work there (yet?), so it’s further evidence that this is some kind of scam. Not sure what their end game is or how they even have that address but they’re definitely trying hard to convince me of something.

 

[PliotronX]

Thank you, I needed a laugh!

 

[corkyg]

Last week I got two emails from deceased classmates with no subject. I just deleted them from the POP box.

 

[CZroe]

The thing about this is that my mother does have some cockamamie idea about living underground in Alabama in case of a Russian EMP (wish I were joking), so the free radon test that presumes to be from some State of Alabama agency hits a little close to home. Even if she forgot ordering something like this, she never would’ve had it shipped to me... most all my stuff goes to her address. *shrug*

 

[CZroe]

The plot thickens:
The day before the emails I got an email from Chase saying that a new card was being sent to me even though I didn’t need or request it. It seems obvious to me that it was being replaced in response to some compromised system somewhere, but when it arrived a couple days ago I realized that it was my Amazon Visa through Chase. Since the address in the email was only ever used for a few Amazon orders, I thought this seemed consistent with a data breech and follow-up phishing scam...

...then, this happened:

OK, so that that adph.al.us email address may be from from the Alabama Department of Public Health after all. The state.al.us part forwards to alabama.gov in a web browser but neither alph.state.al.us nor al.us will take you anywhere, which is what made me think it was fake before.

The tracking number must not have been in UPS’ system yet when I checked before. It works now.

More confused than ever. Something weird is going on. Maybe someone is using free government programs to confirm addresses obtained with stolen Amazon account information?