# A new low in phishing messages **URL:** \ **Category:** Miscellaneous and Personal Stuff I Must Share\ **Created:** [September 27, 2023, 9:35pm UTC](https://boards.straightdope.com/t/a-new-low-in-phishing-messages/990791 "2023-09-27T21:35:21Z")\ **Posts on this page:** 7\ **Page:** 1
**Author:** ![Napier](https://avatars.discourse-cdn.com/v4/letter/n/ce73a5/32.png) [@Napier](https://boards.straightdope.com/u/Napier)\ **Post date:** [September 27, 2023, 9:35pm UTC](https://boards.straightdope.com/t/a-new-low-in-phishing-messages/990791/1 "2023-09-27T21:35:21Z")
U.S.P.S. - Your package arrived at the warehouse but could not be delivered due to incomplete address information. Please confirm your address in the link. [http://uspz########.top](http://uspz########.top) (Please reply 1 and restart iMessage to activate the link or copy the link to open in your Safari browser) The U.S.P.S. team wishes you a great day! * * * That, Dopers, is the txt message I just got on my phone. I put the ###s in place of some of the link, not wishing to become part of the problem. But this message is just a marvel. I have to restart my messages app? I have to believe that the Post Office can’t deliver to me but can figure out how to reach my cell? I have to accept that “uspz” is a suitable substitute for “usps”? I have to set aside that the link is to the shady “.top” domain? But I think the real cherry on top is that the message comes from “[sexhuman1@hotmail.com](mailto:sexhuman1@hotmail.com)”. ---
**Author:** ![gnoitall](https://avatars.discourse-cdn.com/v4/letter/g/bb73d2/32.png) [@gnoitall](https://boards.straightdope.com/u/gnoitall)\ **Post date:** [September 27, 2023, 9:41pm UTC](https://boards.straightdope.com/t/a-new-low-in-phishing-messages/990791/2 "2023-09-27T21:41:43Z")
> [@Napier](#): > > I have to set aside that the link is to the shady “.top” domain? TIL “.top” is a (technically) legitimate top level domain, intended as a generic easy-access TLD for anyone that can’t crack the “.com” mafia. > **[.top](https://en.wikipedia.org/wiki/.top)** > > .top is a generic top-level domain, officially delegated in ICANN's New gTLD Program on August 4, 2014. > The domain name extension .top is managed and operated by the .top registry (registry backend ZDNS) which belongs to Jiangsu Bangning Science & Technology Co., Ltd. in Nanjing, China and can be registered by anyone since November 18, 2014 without special requirements. > A second level domain under the top level domain (TLD) .top can consist of digits, letters, hyphens and specific special chara... And also, I learned that because it so little regulated it’s pretty much just spammers and scammers. > .top domains are often used for malware and phishing, and the TLD is included in the list of those banned for some antimalware vendors such as Malwarebytes. .top is blocked by default by Snort rules. ---
**Author:** ![pulykamell](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/pulykamell/32/3166_2.png) [@pulykamell](https://boards.straightdope.com/u/pulykamell)\ **Post date:** [September 29, 2023, 1:53pm UTC](https://boards.straightdope.com/t/a-new-low-in-phishing-messages/990791/3 "2023-09-29T13:53:49Z")
> [@Napier](#): > > But I think the real cherry on top is that the message comes from “[sexhuman1@hotmail.com](mailto:sexhuman1@hotmail.com)”. Hah! I get these messages a couple times a month these days. Never had as interesting a return address, but I did get one directly texted from a +63 (Philippines) phone number, which I found somewhat unusual for the USPS to be using. 😉 ---
**Author:** ![chappachula](https://avatars.discourse-cdn.com/v4/letter/c/d2c977/32.png) [@chappachula](https://boards.straightdope.com/u/chappachula)\ **Post date:** [October 2, 2023, 1:52pm UTC](https://boards.straightdope.com/t/a-new-low-in-phishing-messages/990791/4 "2023-10-02T13:52:30Z")
Alright folks, let’s get to the real issue here: if the email came from sexhuman1, then simple logic proves that there must be another sexhuman. ( Presumably the first, the original one. before there was a need to start adding digits to the name) And now, I really,really, really want to meet her. But not the clones. After all, sexhumans one-thru-nine are just wannabe sexhumans. But me, I demand the best, the original, the genuine thing. ---
**Author:** ![SmellMyWort](https://avatars.discourse-cdn.com/v4/letter/s/ea5d25/32.png) [@SmellMyWort](https://boards.straightdope.com/u/SmellMyWort)\ **Post date:** [October 3, 2023, 6:53pm UTC](https://boards.straightdope.com/t/a-new-low-in-phishing-messages/990791/5 "2023-10-03T18:53:49Z")
Apparently I have prizes waiting for me at Walgreens, Harbor Freight, Ace, Home Depot, and about 10 other businesses, all for for contests I never had to bother entering! ---
**Author:** ![Napier](https://avatars.discourse-cdn.com/v4/letter/n/ce73a5/32.png) [@Napier](https://boards.straightdope.com/u/Napier)\ **Post date:** [October 3, 2023, 9:21pm UTC](https://boards.straightdope.com/t/a-new-low-in-phishing-messages/990791/6 "2023-10-03T21:21:03Z")
> [@SmellMyWort](#): > > for contests I never had to bother entering I know the feeling. I have constant problems with my Chase credit card – getting frozen, getting temporarily restricted, having security problems, etc etc etc. Fortunately they make it easy to go right from the txt messages to a site where I can enter the correct information. Except, bless my soul, I’ve never had a Chase credit card. ---
**Author:** ![Zyada](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/zyada/32/3028_2.png) [@Zyada](https://boards.straightdope.com/u/Zyada)\ **Post date:** [October 3, 2023, 10:01pm UTC](https://boards.straightdope.com/t/a-new-low-in-phishing-messages/990791/7 "2023-10-03T22:01:44Z")
Yeah, but when you get to sexhuman69 …