Phishing is an attempt to steal user's personal information such as username, password, credit card number etc. The main idea of such attack is that the attacker pretends to be a trusted web-site which asks the user to re-enter the personal information and in this way steels it.

learn more… | top users | synonyms

1
vote
2answers
48 views

How to secure yourself against jQuery preventDefault phishing?

This is bugging me for a while now due to the potential security risk it involves. Basicly by accident I discovered that this code is perfectly valid and works without a problem: jQuery: ...
0
votes
0answers
15 views

Brand new domain and server using URL Rewrite flagged by Google for Phishing [migrated]

I set up a VM with 1and1.com and registered a domain. I'm running an app (Jira) that runs on its own Tomcat instance but I have set up URL Rewriting based on this article so that IIS can handle the ...
6
votes
1answer
64 views

Does iPhone home button act as Secure Attention Key?

On an iPhone, does pressing the home button act as a Secure Attention Sequence? The home button is a physical button. You can press the home button whereever you are and go back to the home screen. ...
0
votes
1answer
19 views

Unsolicited opt-out from data brokers

I received several automated emails at an early hour from several data brokers (e.g., Spokeo) asking me to confirm an opt-out for my email address and name. I did not request these, but did so about ...
2
votes
0answers
25 views

Information on the Elderwood Project/Platform [closed]

I've read Symantec's whitepaper on the Elderwood Project and the blog update on the Elderwood Platform. They both make for a very interesting read, especially in the zero-day exploit meta-analysis ...
1
vote
1answer
66 views

Email phishing scam asking customers for card details

I work for a small ecommerce company and over the weekend we received a few emails from customers claiming to have received an email asking them to confirm their card details to process their orders. ...
1
vote
1answer
90 views

I think i might have accidentally clicked a phishing link, how can i be sure? [closed]

Long story short I might have accidentaly clicked a phishing link is there any kind of test I can do or anything I can do to check?
1
vote
2answers
60 views

Difference between DNS spoofing and phishing [closed]

I am writing a bachelor thesis and I am having a hard time figuring out the difference between phishing and DNS spoofing. From what I understand, DNS spoofing is a way to achieve a succesfull phishing ...
16
votes
3answers
2k views

Can malware change the website visited by browser?

I heard in a security talk today (I didn't have the opportunity to ask questions): The speaker mentioned that he observed (2 years ago) that a possible malware on a given computer was behaving such ...
2
votes
2answers
124 views

Wordpress blog hacked?

There is a Wordpress blog running on Wordpress 4.0. Anyone having the company webmail can signup to the blog using their Google+ account and submit blog posts. Once posted they will be sent to some ...
28
votes
2answers
2k views

I have registered a .com domain and received an e-mail from domainadmin.com

I have registered a .com domain and received an e-mail from domainadmin.com, it looks extremely like a phishing e-mail, but after a research I am ultimately confused whether this thing is legitimate ...
0
votes
0answers
26 views

Security Flaw in all “logging by” system - phishing opportunity

We all face such popups. How can you assure that it's NOT phishing, if It's not in the browser. UIWebView (View that displays this logging view) is controlled by application we really don't even ...
1
vote
1answer
141 views

This facebook page looks different - phishing attempt?

After logging on to a public wifi, I was redirected to this page appearing to be from facebook, and being done via https: which looks markedly different from my normal facebook page I understand ...
2
votes
2answers
170 views

Hack: anymonous URL on my Joomla Website[Resolve] [closed]

My website has been hacked again. There are many foreign URLs such as here. I've checked the database and there is nothing strange in my database. Does anyone know what kind of hack attack is like ...
1
vote
2answers
67 views

Suspicious SMS getting received on selected browsing

I am receiving several suspicious SMS messages with links telling me that I have requested subscription to their services (which I have not) asking me to confirm subscription. These SMS appear only ...
3
votes
4answers
129 views

One Time Password via Text Message: Possible exploits?

Is there a credible scenario in which the OTP (One Time Password) for online credit card transactions ( specifically for Verified by Visa) can be bypassed? Context: A guy I know was cheated via the ...
3
votes
1answer
155 views

Phishing email from Avast - Headers look totally legit?

Below is the email with headers. I never registered on the site, so it's clearly phishing, but the links in the email point to the real Avast site. The delivery path also looks legit since both IP ...
0
votes
1answer
65 views

Is there a “how to” about Gmail fraud, updated at least once per week?

My Gmail account has just been cracked and many of my contacts are receiving fake emails, claiming that I'm in troubles and requesting money. Searching for advice, using Google, about what actions ...
0
votes
2answers
75 views

Phishing email sent to me within a few hours after a related incident, what should I do?

A few hours ago I was helping a family member pay for something on a government website with one of his credit cards, but for whatever reason it didn't go through, so we used another card and it ...
5
votes
4answers
419 views

Can someone steal cookie contents via a phishing attack?

If someone successfully set up a phishing website on a fake wireless network for say, bankofamerica.com, and lets pretend that SSL was not used, would they be able to run a script on the server that ...
0
votes
1answer
70 views

Have i been phished? [closed]

I recently opened a link from a "friend", while I was on my workplace. It was some really simple stupid game "Super Mario" type. I opened it, played for 10 seconds and closed the link. What felt ...
-1
votes
2answers
125 views

Fake Microsoft Security Department [duplicate]

some Indian man called home saying that he's calling from some Windows Security Department, and there are about 16 other people connected to my computer and the're doing illegal things on my computer. ...
0
votes
0answers
36 views

Application of digital watermarking for session hijack

I know digital watermarking can protect the media from man-in-middle and replay attack. Is it good also for session hijack attack or phishing attack?
4
votes
1answer
68 views

phishing message in Outlook signature?

One of my organization's users just showed us an interesting problem: every message they tried to send (in OWA 365) contained the following scary text: Your mailbox has exceeded one or more size ...
8
votes
5answers
519 views

Is there anything I can do about IDN homograph attacks?

I have been reading about IDN homograph attacks, and I cannot think of any better way than Tell my users not to trust emails asking for passwords, etc Buy all domains similar to mine (expensive and ...
2
votes
3answers
205 views

Strange unsolicited email sent to almost never used email address

What initially looked like typical spam now seems extra odd and is bugging me (only figuratively I hope). Ostensibly, a sales rep from DomainNameSales.com (DNS), which I'd never heard of, sent an ...
5
votes
8answers
472 views

Checking “return” parameter in login page

My login page accepts the "return" parameter, which should contain URI to redirect user if he wasn't logged in and tried to access page which isn't accessible by unauthenticated users. It could be ...
1
vote
0answers
93 views

Open redirection unique token bypass

I am currently analyzing one job portal web application in which there is an open redirect vulnerability. Vulnerability description is as follows: Request type: GET Vulnerable Parameter: dest ...
2
votes
1answer
211 views

What does this potentially malicious code do?

While reading a website called 4chan/b/ someone posted this code snippet, i was wondering what it does when executed? it appears to be C code, how harmful is it? This is the full post: Run a live ...
0
votes
1answer
159 views

Clicked link on fake email which appeared to be from friend [duplicate]

I receieved an e-mail which at first glance appeared to be from a friend, I clicked on the link provided without thinking as we would often exchance links to sites. The link went nowhere i.e page not ...
-6
votes
1answer
160 views

how to back track a phishing attach? (without being infected) [closed]

This morning i received this funky looking email from Cerys Evans about a private message he sent my way. First and foremost I want to mention the lack of design talents this attack employed and ...
-4
votes
3answers
277 views

Why doesn't Google Safe Browsing block the IP addresses of malicious websites?

If you visit a blocked domain name like www.thelotbet.cn from Google Chrome, Opera or Firefox, you will get a warning from Google Safe Browsing that this is a malicious website. But if you visit the ...
0
votes
2answers
135 views

How did an attacker spoof (or add to) this myspace's login form?

In the attack detailed here, I see that a hacker has actually added a malicious post link. What I do not understand is how the attacker added it to the actual myspace.comdomain. Obviously this is an ...
0
votes
1answer
87 views

which password was paired with my gmail address

Recently media have reported that a file of about 5 million gmail address and password pairs was published on a Russian Bitcoin forum. A media article on the leak Other media have reported that the ...
1
vote
1answer
77 views

Suspicious phone call claiming MS Office not updated lately

I recently received two phone calls where the caller indicated that according to their log activity, MS Office has not been updated lately. They offered to help me get those updates. What kinds of ...
2
votes
1answer
108 views

Could I counter SiteKey MitM attack with user-agent identification?

I find it very strange that bank use service like SiteKey without user-agent identification. This still makes them very vulnerable to MitM attack which is exactly what they are trying to protect ...
35
votes
5answers
5k views

Are there actions taken against websites that deliver malware?

There are serious tools and services such as Google Safe Browsing for malicious and phishing websites, and others fully dedicated to phishing websites such as Phishing.org. What is done against these ...
1
vote
3answers
106 views

Prevent someone from using your site for phishing?

So I have a site where users can create online surveys and send them out to whomever they like. Over the past few months we have seen an uptick in one particular user who creates an account, then ...
3
votes
1answer
5k views

Is this Facebook email real or phishing?

I received this email from what is supposedly Facebook today. Here's a screenshot: I was not aware I had credits or credits existed on Facebook and apparently I have $2.30 worth. It looks legitimate ...
3
votes
2answers
302 views

How browser detects Phishing Pages?

I want to know how browsers detect phishing pages.And also what methodology browsers use to detect phishing pages?
2
votes
1answer
151 views

Anti-phishing educational resources for users?

I'm am looking into conducting a phishing campaign to gauge how susceptible my workplace is to phishing attacks. Part of this will involve guiding "duped" users to materials or resources that will ...
2
votes
2answers
177 views

Is my PC safe? need help

About 6 days ago my parents who aren't great with PCs got phished on gmail, and the account started spreading spam. It had been hacked on an Argentinian IP, and then logged in from IMAP and SMTP from ...
3
votes
1answer
151 views

How to detect if a user is logged in to a specific website?

I just learn about tabnabbing. Tabnabbing is a computer exploit and phishing attack, which persuades users to submit their login details and passwords to popular websites by impersonating ...
1
vote
4answers
129 views

What to do after a co-worker has been phished?

One of our co-workers followed a phishing link and entered their Google for Business account credentials. We have reset their password, is there anything else we need to do? (We also used this as a ...
0
votes
2answers
267 views

website hacked - phishing form

My Drupal 7.28 site has been hacked through the the tmp dir which was not protected by .htaccess file. The hacker managed to delete the main .htaccess file and upload some bogus google docs 2014 ...
2
votes
1answer
112 views

Is asking for credentials from a separate trusted domain an acceptable practice?

I know of at least two pages that I would have just assumed were a phishing scheme if I didn't know any better. Serverfault.com is a stack exchange site on a different domain, however if you click to ...
0
votes
2answers
575 views

PayPal phishing attempt?

[This is a "soft" question and as such I'm not sure it's appropriate for this site. However, it does involve information security.] I have an email address, me@gmail.com that is not associated with ...
0
votes
1answer
104 views

How can clicking a link in a Facebook users news feed compromise their account [closed]

I've been confused about how it is possible to compromise a Facebook user's account simply if that user clicks a link. Recently a friend of mine on Facebook posted a series of links to what appeared ...
1
vote
2answers
208 views

Pionee Red: Is this a Phishing attack? What should we do?

I have just received an email from a close friend, which had "Pionee Red" as the subject, and the following body: you've a new private message from your friend Click To View The Full Message As I ...
2
votes
1answer
129 views

Crawling for Phishing Websites

OBJECTIVE: We have a requirement to run active scan for detecting and monitor phishing websites for a particular brand. We want to be as real-time as possible. That would mean that using sites like ...