Fishing from PyPI ?

[MRAB]

On 2018-08-03 22:43, Vincent Vande Vyvre wrote:
> I've received a mail askink me to confirm my identity on PyPI.
> 
> The begining of the message:
> 
> -------------------------------------
> 
> Your account VinsS on PyPI
> <https://pypi.us18.list-manage.com/track/click?u=b96f861be540deb98fd700265&id=9a19d150cf&e=8824682d0f>
> does not have a verified primary email address.
> 
> Please take 2 minutes to verify your email:
> 
>    * To ensure that every email we send is going to its intended recipient
>    * To ensure email sent from PyPI isn’t marked as spam by email clients
>      and service
>    * *If you do not verify, you will not be able to upload to PyPI, or be
>      added as a maintainer to projects. You will no longer receive
>      notifications from PyPI.*
> 
>      To verify, visit your Account Settings
>      <https://pypi.us18.list-manage.com/track/click?u=b96f861be540deb98fd700265&id=1763135c31&e=8824682d0f>
>      page.
> 
> -------------------------------------
> 
> The Account Settings
> <https://pypi.us18.list-manage.com/track/click?u=b96f861be540deb98fd700265&id=1763135c31&e=8824682d0f>
> is :
> https://pypi.us18.list-manage.com/track/click?u=b96f861be540deb98fd700265&id=1763135c31&e=8824682d0f
> 
> Phishing ? yes, no ?
> 
If you want to be sure, ignore the links in the email, and check PyPI at 
the URL that you know is correct.

Given that the email says "https://pypi.us18.list-manage.com" and PyPI 
is at "https://pypi.org/", it does look suspicious.