A fake FedEx email is making the rounds and because the link to get the shipping information is cleverly hidden in an image you might be tempted to click before evaluating the legitimacy of this email.

We’ll take this email apart step by step so you can get an understanding of just how fake it is.

Let’s start with the FedEx logo – how many of you noticed that the logo isn’t quite right.  Here’s their logo image from their website.

Both the font and color are wrong in the email.  It’s also missing the registered trademark or copyright symbol which is prevalent whenever you see “FedEx” used online and in emails.

Next, for the sake of logic, were you expecting a parcel from FedEx?  Or were you excited by the idea that someone sent you something unexpected so you hit “Get Shipment Label” before thinking about it?  And while we’re considering it, where does “Get Shipment Label” take you?  It certainly doesn’t take you to fedex.com – instead it takes you to master-insight.com.  Well what is that?  master-insight.com was registered earlier this year through GoDaddy to an entity appearing to be located in Hong Kong.

Not very likely that master-insight.com knows anything about any parcels either delivered or undeliverable to you.

So let’s look at the who the email reports to be from: “FedEx SmartPost <support@fefmont.org>”.  Ok so then what is fefmont.org?  Fefmont.org comes up as registered to an organization Franciscanas del Espiritu Santo de Montpellier in Madrid.  The organization in Madrid translates to Franciscan Sisters of the Holy Spirit and has domains franciscanasmontpellier.org and fefmont.es, .es is the country code for Spain.

Expecting a parcel from Spain were you?

Finally looking into the headers confirms the European tie.

195.76.183.201 is a RIPE IP Address (RIPE is the European version of ARIN which stands for American Registry for Internet Numbers).

After all of that, does anything about this email seem legitimate?  Obviously that was rhetorical.  But so many will be so excited by a secret surprise parcel that they won’t stop to evaluate the legitimacy of this email before clicking “Get Shipment Label”…

[whohit]FedexSpain[/whohit]