{
  "generated": "2026-09-03",
  "licence": "CC BY 4.0",
  "note": "Domains and URLs are defanged ([.] / hxxp). Indicators change weekly; absence never means safe.",
  "count": 17,
  "indicators": [
    {
      "type": "sender",
      "value": "account-alert@amazon.com (spoofed)",
      "family": "amazon-account-alert-phishing",
      "family_status": "dormant",
      "first_seen": "2019-08",
      "sources": [
        "https://soft2secure.com/knowledgebase/account-alert-amazon-com-scam"
      ]
    },
    {
      "type": "attachment",
      "value": "Word document (.doc) attached to some copies",
      "family": "amazon-account-alert-phishing",
      "family_status": "dormant",
      "sha256": null,
      "sources": [
        "https://soft2secure.com/knowledgebase/account-alert-amazon-com-scam"
      ]
    },
    {
      "type": "subject",
      "value": "[Statement from Amazon is available] [Daily Report Email] — Your account checking setting data has been changed on {date} {report ID}",
      "family": "amazon-account-alert-phishing",
      "family_status": "dormant",
      "first_seen": "2019-08",
      "channel": "email",
      "sources": [
        "https://soft2secure.com/knowledgebase/account-alert-amazon-com-scam"
      ]
    },
    {
      "type": "subject",
      "value": "[Amazon Statement Report] [Automatic Daily Mail] — Verify your billing and/or shipping address using a web browser {report ID}",
      "family": "amazon-account-alert-phishing",
      "family_status": "dormant",
      "first_seen": "2019-08",
      "channel": "email",
      "sources": [
        "https://soft2secure.com/knowledgebase/account-alert-amazon-com-scam"
      ]
    },
    {
      "type": "subject",
      "value": "[Daily Email Report] Latest: It appears that your account settings have been changed on other devices {date} / Number {report ID}",
      "family": "amazon-account-alert-phishing",
      "family_status": "dormant",
      "first_seen": "2019-08",
      "channel": "email",
      "sources": [
        "https://soft2secure.com/knowledgebase/account-alert-amazon-com-scam"
      ]
    },
    {
      "type": "sender",
      "value": "Qq1LVKa@memberloyaltyprogram[.]com",
      "family": "digitspro-delivery-fee",
      "family_status": "archived",
      "first_seen": "2019-12",
      "sources": [
        "https://soft2secure.com/knowledgebase/digitspro"
      ]
    },
    {
      "type": "sender",
      "value": "w6065y4@bbscanner[.]com",
      "family": "digitspro-delivery-fee",
      "family_status": "archived",
      "first_seen": "2019-12",
      "sources": [
        "https://soft2secure.com/knowledgebase/digitspro"
      ]
    },
    {
      "type": "sender",
      "value": "cocobrouartdu06@outlook[.]fr",
      "family": "digitspro-delivery-fee",
      "family_status": "archived",
      "first_seen": "2019-12",
      "sources": [
        "https://soft2secure.com/knowledgebase/digitspro"
      ]
    },
    {
      "type": "sender_domain",
      "value": "memberloyaltyprogram[.]com",
      "family": "digitspro-delivery-fee",
      "family_status": "archived",
      "first_seen": "2019-12",
      "sources": [
        "https://soft2secure.com/knowledgebase/digitspro"
      ]
    },
    {
      "type": "sender_domain",
      "value": "bbscanner[.]com",
      "family": "digitspro-delivery-fee",
      "family_status": "archived",
      "first_seen": "2019-12",
      "sources": [
        "https://soft2secure.com/knowledgebase/digitspro"
      ]
    },
    {
      "type": "sender_domain",
      "value": "ecogadgetslive[.]com",
      "family": "digitspro-delivery-fee",
      "family_status": "archived",
      "first_seen": "2019-12",
      "sources": [
        "https://soft2secure.com/knowledgebase/digitspro"
      ]
    },
    {
      "type": "sender_domain",
      "value": "turboanalysis[.]net",
      "family": "digitspro-delivery-fee",
      "family_status": "archived",
      "first_seen": "2019-12",
      "sources": [
        "https://soft2secure.com/knowledgebase/digitspro"
      ]
    },
    {
      "type": "subject",
      "value": "I do know {password} is your password",
      "family": "password-sextortion",
      "family_status": "active",
      "first_seen": "2018-10",
      "channel": "email",
      "sources": [
        "https://soft2secure.com/knowledgebase/porn-blackmail-email-scam"
      ]
    },
    {
      "type": "subject",
      "value": "Save Yourself",
      "family": "password-sextortion",
      "family_status": "active",
      "first_seen": "2019-08",
      "channel": "email",
      "sources": [
        "https://soft2secure.com/knowledgebase/save-yourself-email-scam"
      ]
    },
    {
      "type": "subject",
      "value": "Your account has been hacked by ChaosCC hacker group",
      "family": "password-sextortion",
      "family_status": "active",
      "first_seen": "2019-09",
      "channel": "email",
      "sources": [
        "https://soft2secure.com/knowledgebase/chaoscc-hacker-group-email-scam"
      ]
    },
    {
      "type": "sender",
      "value": "bigpondservice@bigpond.com (spoofed)",
      "family": "telstra-bigpond-account-suspension",
      "family_status": "archived",
      "first_seen": "2017-04",
      "sources": [
        "https://soft2secure.com/knowledgebase/bigpond-email-scam"
      ]
    },
    {
      "type": "phone",
      "value": "+1 (888) 202-7560",
      "family": "zeus-virus-detected-alert",
      "family_status": "archived",
      "first_seen": "2017-04",
      "last_seen": "2017-04",
      "sources": [
        "https://soft2secure.com/knowledgebase/zeus-virus-detected-alert-scam"
      ]
    }
  ]
}