# Liu Hongtian

Here's another email I received.&#x20;

<figure><img src="https://content.gitbook.com/content/qpzdj1tPRpELJdvxuVYh/blobs/TpjwcWOPgkzDzrBgpmdv/image.png" alt=""><figcaption></figcaption></figure>

First thing to ask, who is Liu Hongtian? Doing a search on him doesn't tell me anything regarding NUS mail admin. Also, what's with the weird bar graph and font differences in the email?&#x20;

When visiting the website, all we see is this.

<figure><img src="https://content.gitbook.com/content/qpzdj1tPRpELJdvxuVYh/blobs/PiWbtsj2tno4wwp2frHO/image.png" alt=""><figcaption></figcaption></figure>

So this is another low-level scam from another credential harvesting website. When we key in some fake credentials, we get this:

<figure><img src="https://content.gitbook.com/content/qpzdj1tPRpELJdvxuVYh/blobs/j0yOVeVrWcsO9h6YXekr/image.png" alt=""><figcaption></figcaption></figure>

Pretty much obvious that this would be receiving some kind of hit on a remote server and then probably fitting into a text file to be sold online.

We can take this a step further, and instead start to use DNS on it to see where the server's from.

<figure><img src="https://content.gitbook.com/content/qpzdj1tPRpELJdvxuVYh/blobs/4ayOZci1Vhh707BySCc9/image.png" alt=""><figcaption></figcaption></figure>

<figure><img src="https://content.gitbook.com/content/qpzdj1tPRpELJdvxuVYh/blobs/SmvL39n0JEmSoKVODfZx/image.png" alt=""><figcaption></figcaption></figure>

Intriguing, but it looks like it was spoofed. I don't think we can host servers here, doesn't look right. Unless they have a huge boat or something, I dunno.

<figure><img src="https://content.gitbook.com/content/qpzdj1tPRpELJdvxuVYh/blobs/oBI7sCOHUpCrW6ji71V9/image.png" alt=""><figcaption></figcaption></figure>

## Conclusion

Scam!&#x20;
