Strange E-Mail - scam?

Did you read the text part of a dual text/HTML e-mail? Maybe the payload was in the HTML?

nib

is it a multipart/mixed email with the text URL pointing at the genuine DVLA site and the html URL pointing at a cloned scam site?

I see gov.xn--uk-o2t

Right click the URL and select 'copy link location' (or similar), then paste into a word processor like Notepad.

I don't see any punycode/IDN in Chris's original, just a few stray encodings of iso-latin1 characters

Right click the URL and select 'copy link location' (or similar), then paste into a word processor like Notepad.

But that isn't in Chris's original message, someone's quoting has done that to it

Save off the email as a .eml or whatever, and study it with your hex editor.

After the hex editor review, switch to a text editor and review the header section before the body-proper of the email begins.

You can slowly take apart email, a piece at a time, if you have the time to waste on it.

Maybe just the format of the mime header is scary (multi-part mime). There is no reason for an attachment to contain "exotic" characters for the filename. Or for that matter, .lnk file types :-) For example, "bill.pdf" is plenty-good for an attachment. There should not be a monkey-joe character sequence for a filename. Reviewing things like that with a hex editor, helps identify if there is hidden stuff there.

Paul

It's only got an HTML part, that's converted to plain text (by mutt) using lynx.

No, just a single (text/html) part.

I did that too, nothing untoward that I could see.

It IS in Chris's original message: "For your security, always verify that web addresses begin with ‘

In both Chris's original and the above, Thunderbird includes the trailing single quote as part of the url, but not the leading one. Thunderbird view source shows ‘

As others have said, hover your mouse cursor over the

Which is an illegally constituted and nonexistent domain name ...

It looks like an ineptly constructed phishing attempt. I've had completely blank emails from places that were obvious spam sources, presumably intended to contain something.

I think it's an artifact. Claws-Mail does not show anything other than the text as shown in the OP's first post. Saving the email and examining it with text and hex editors shows the same. There are certainly no html tags there, which in an html email would contain the actual URL.

Of course, we didn't see the message source of the email as the OP received it. I've received emails which look fine in Claws, as I don't have html rendering enabled, but which do contain malicious URLs in the html code after the text. This is why I run with html disabled.

Did you look at the howard knight copy?

How do you smuggle a hooky URL in a plain text message?

I see that, complete with the mangled smart quotes, here is is as a hex dump

if you can find the hex sequence for xn-- in there 78, 6E, 2D, 2D kindly point them out

something is being magiced-up within *your* client.

in which case, it is seamonkey *INVENTING* the xn--uk-o2t part, please inspect the message source ...

That's punycode encoding