"Here's your latest bill from Origin showing what you've used and how much to pay." Yeh right ! It is just another fake phishing email, this time sent from the phony domain "energyoforigin.net"
Those who actually do have an account with Origin Energy can instantly recognise the message is fake because :
originofenergy.net is a bogus domain name deliberately selected to deceive the unwary.
Hovering your mouse over the " View Bill " button reveals a hyperlink to an unfamiliar and highly suspicious website, which is actually a compromised Microsoft SharePoint account containing dangerous Malware. As you know, this is exactly the type of link that you never click !
Owner of the domain originofenergy.net
This domain name was registered only yesterday, Tuesday, 13th June 2017 in China, likely using a false name.
WHY ? Because there have been reports of these Origin Energy phishing messages having been sent in recent weeks from differing domain names, which will all have now been Blacklisted. So, they just setup another domain and continue their email scam.
Source of the email message
Viewing the email header code reveals the message originated from the IP address 188.8.131.52, which is a mail server located in Paris, France.
Now a familiar pattern
Nothing new here. We have seen it all before. Check out the other articles below.
The same cybercriminal crew registering domains in China with mail server located in France sending emails containing a dangerous link to a compromised Microsoft SharePoint account URL.
While Government authorities do warn the general public about emails like this and recommend people report scams to websites like Scamwatch, until such time as somebody actually takes positive action to track down the perpetrators, the activites of these cybercriminals will continue unimpeded.