Phishing is an attempt to steal user's personal information such as username, password, credit card number etc. The main idea of such attack is that the attacker pretends to be a trusted web-site which asks the user to re-enter the personal information and in this way steels it.

learn more… | top users | synonyms

3
votes
1answer
59 views

Best way to prevent phishing by turning off HTML links

phishing attacks are very common nowadays. Innocent victims click on suspicious links in emails and get infected. I know that to prevent phishing, one of the ways is to educate users on the proper ...
8
votes
1answer
183 views

How to check if iCloud password popup is legitimate?

I was away from the computer when this popup appeared and I've no idea what triggered it. How do I know if it's legitimate popup from App Store or a phishing attempt by some malware? Back in my ...
5
votes
1answer
143 views

Phishing message in Outlook signature?

One of my organization's users just showed us an interesting problem: every message they tried to send (in OWA 365) contained the following scary text: Your mailbox has exceeded one or more size ...
1
vote
1answer
40 views

If You Use Secure Sites with Extended Validation Certificates How Much Do You Still Have To Worry About Phishing Sites Impersonating Them?

Was mulling over the issue of protecting users from password-stealing phishing sites when an interesting question that hadn't occurred to me before popped into my head: Let's say that I decide to ...
4
votes
0answers
395 views

Finding your 'pornstar name' by combining, e.g. your first pet's name and your mother's maiden name. Was this originally a form of phishing? [closed]

It worked like this -- you were at a party and each person said their first pet's name, e.g. 'Binky' and their mother's maiden name 'Robinson' and the (supposedly hilarious) result was the 'pornstar' ...
7
votes
3answers
2k views

Is this phishing or the real PayPal?

This has all traits of phishing, apart from the extended validation SSL cert. Is this site run by the real PayPal?
4
votes
2answers
142 views

Phishing/Malware redirection through AdExchange on Android

Issue: Yesterday I discovered a strange behaviour in the Chefkoch.de App. During the search for recipe, Firefox opens up with a (German) phishing warning screen. This happened not only on this ...
72
votes
8answers
10k views

How to distinguish between a scam and a genuine call?

My bank called me the other day and the person who spoke to me failed to give me a single evidence that he is calling from my bank. The bank number is hidden just like many other companies maybe ...
0
votes
1answer
64 views

How much information, at maximum, can a phisher/scammer obtain?

My iPhone was recently stolen and since then I've been receiving messages and emails saying that 'a sound was played on your iPhone' or 'your iPhone was found. Visit here to confirm your location'. ...
7
votes
3answers
276 views

Conducting a succesful phishing test

How do you usually conduct a safe phishing exercise to test the staff's security awareness? How do you ensure that staff are not offended by such an exercise? Would you in some circumstances also ...
2
votes
3answers
96 views

Site hack with email phishing scam [closed]

We have a small business website that has been compromised. They are somehow getting customers order details and contacting them requesting their credit card details. We have had our web team and a ...
1
vote
2answers
102 views

How to prevent phishing mails from being successful? [duplicate]

I'd like to know what the best methods are to prevent success of phising mails. This question contains the following subquestions: What are the best ways to determine incoming phising mails (on a ...
0
votes
0answers
111 views

deliver a malicious payload via a cloned website

I've been tasked with conducting an internal pentest, I'm relatively new to this so please bare with me. Some time ago, I used setoolkit and I would have the option to clone a website and attach a ...
1
vote
3answers
264 views

How to prove ownership of a website?

We all know how banks identify themselves to users. No, not through TLS certificates. The users pay no attention to those. No, I'm talking about branding-- all those fancy logos and stock photos that ...
5
votes
5answers
3k views

What are the advantages of multi-level authentication?

By multi-level authentication, I am referring to the fact that the user makes use of a primary username password keypair to log into his account. Then, to perform some other actions, such as authorize ...
69
votes
6answers
13k views

Why do phishing emails have spelling and grammar mistakes?

Are the spelling and grammar mistakes in phishing emails done on purpose? Is there some wisdom behind it? Or they are simply indicative of the fact that they've been written by someone who does not ...
8
votes
1answer
11k views

Looking for URL Blacklists of Malicious Websites [closed]

Is there a maintained list of URLs that contain malicious content. These URLs may be involved in Phishing, Scams, Viri, or other Malware. Please indicate in your answer if the list is freely ...
3
votes
5answers
178 views

How can a user detect when a web server is phishing his credentials?

These days so many websites/apps (including StackExchange) allow logging in using your Facebook, GoogleId, or LinkedIn credentials. Whatever method you choose, you are presented a box to enter your ...
2
votes
4answers
175 views

Suspicious SMS getting received on selected browsing

I am receiving several suspicious SMS messages with links telling me that I have requested subscription to their services (which I have not) asking me to confirm subscription. These SMS appear only ...
3
votes
2answers
243 views

Spear phishing data set

Are there any existing data sets of spear phishing emails available? I've found a bunch of data sets of phishing emails, but that's not what I'm looking for. I'm not looking for mass phishing ...
4
votes
3answers
791 views

What to do when iPhone is successfully phished

My girlfriend watched "some" pages on her iPhone and facebook.you-won.com page appeared. She didn't know how to get rid of that JavaScript alert, so she clicked OK. After that she closed the page, and ...
3
votes
0answers
72 views

How to indicate that content in an iframe is untrusted

As part of a website I am developing, untrusted content is displayed in a sandboxed iframe. The content is loaded using the srcdoc attribute, but the iframe is sandboxed using sandbox="allow-scripts", ...
12
votes
1answer
2k views

Fell for phishing scam. Is my gmail account with 2-step verification vulnerable?

I can't believe it happened to me but I entered Gmail account's user-name and password into a website as part of a phishing scam. I use Gmail's 2-step verification and have changed my password. Is ...
7
votes
1answer
392 views

Javascript phishing attack sucker: Do I need to be worried? [closed]

So, I'm an idiot. I opened a javascript phishing attack file. I would really, really appreciate some help with decoding the Javascript to figure out whether I'm in trouble, and what sort. I'm on OS X ...
2
votes
1answer
93 views

Why do phishing sites use images instead of just copying the HTML?

Why do phishing sites use pictures of the full site (e.g., they took screenshot and broke it up) instead of just copying the real HTML and modifying the target for form submission of ...
12
votes
3answers
18k views

Apparently PayPal-affiliated site with very suspect security

History I got an email this afternoon to my gmail from "paypal@e.paypal.com" with mailed-by: na.e.paypal.com and signed-by: e.paypal.com. Gmail did not report it as spam/phishing/suspicious and it ...
9
votes
5answers
802 views

Is there anything I can do about IDN homograph attacks?

I have been reading about IDN homograph attacks, and I cannot think of any better way than Tell my users not to trust emails asking for passwords, etc Buy all domains similar to mine (expensive and ...
6
votes
1answer
118 views

How do I protect myself from the aftermath of the OPM hack?

As a federal employee, I, along with some 4 million other Americans had our information compromised in the recent OPM (office of personal management) hack. Former and current addresses, names of ...
1
vote
1answer
114 views

Can a 0800 and 00800 be from different companies in UK [closed]

I recently received a call from a 00800 number, that seemed like a prerecorded message asking me to press some keys to continue. I disconnected. I later googled the number and I noticed that a ...
4
votes
1answer
4k views

A “new domain registration” spam?

About 6 days ago I purchased a new domain under .org TLD from a local registrar. Few days later, I have received this strange message (which BTW fell to Gmail spam bin), which looks like some kind of ...
2
votes
4answers
82 views

Preventing phishing of few critical websites

Suppose $S$ is a set of known websites which are very important. Assume there is an anti-phishing tool company $A$ which is aware of such websites. Can the company A reliably develop an anti-phishing ...
19
votes
4answers
3k views

“Phishing” red flags and countermeasures

Given the recent spate of intrusions into various networks which have included compromise of subscriber identity and contact information, I figured it would be good for us to have a thread on how to ...
0
votes
2answers
183 views

How to secure yourself against jQuery preventDefault phishing?

This is bugging me for a while now due to the potential security risk it involves. Basicly by accident I discovered that this code is perfectly valid and works without a problem: jQuery: ...
6
votes
1answer
120 views

Does iPhone home button act as Secure Attention Key?

On an iPhone, does pressing the home button act as a Secure Attention Sequence? The home button is a physical button. You can press the home button whereever you are and go back to the home screen. ...
24
votes
4answers
4k views

Effectiveness of Security Images

Do security images such as those presented upon logging into banks provide any tangible security benefits, or are they mostly theater? Per my understanding, if somebody is phishing your users, it's ...
2
votes
0answers
64 views

Information on the Elderwood Project/Platform [closed]

I've read Symantec's whitepaper on the Elderwood Project and the blog update on the Elderwood Platform. They both make for a very interesting read, especially in the zero-day exploit meta-analysis ...
1
vote
1answer
143 views

Email phishing scam asking customers for card details

I work for a small ecommerce company and over the weekend we received a few emails from customers claiming to have received an email asking them to confirm their card details to process their orders. ...
1
vote
2answers
372 views

Difference between DNS spoofing and phishing [closed]

I am writing a bachelor thesis and I am having a hard time figuring out the difference between phishing and DNS spoofing. From what I understand, DNS spoofing is a way to achieve a succesfull phishing ...
1
vote
1answer
302 views

I think i might have accidentally clicked a phishing link, how can i be sure? [closed]

Long story short I might have accidentaly clicked a phishing link is there any kind of test I can do or anything I can do to check?
15
votes
3answers
3k views

Can malware change the website visited by browser?

I heard in a security talk today (I didn't have the opportunity to ask questions): The speaker mentioned that he observed (2 years ago) that a possible malware on a given computer was behaving such ...
2
votes
2answers
240 views

Wordpress blog hacked?

There is a Wordpress blog running on Wordpress 4.0. Anyone having the company webmail can signup to the blog using their Google+ account and submit blog posts. Once posted they will be sent to some ...
29
votes
2answers
4k views

I have registered a .com domain and received an e-mail from domainadmin.com

I have registered a .com domain and received an e-mail from domainadmin.com, it looks extremely like a phishing e-mail, but after a research I am ultimately confused whether this thing is legitimate ...
1
vote
1answer
246 views

This facebook page looks different - phishing attempt?

After logging on to a public wifi, I was redirected to this page appearing to be from facebook, and being done via https: which looks markedly different from my normal facebook page I understand ...
0
votes
0answers
30 views

Security Flaw in all “logging by” system - phishing opportunity

We all face such popups. How can you assure that it's NOT phishing, if It's not in the browser. UIWebView (View that displays this logging view) is controlled by application we really don't even ...
2
votes
2answers
411 views

Hack: anymonous URL on my Joomla Website[Resolve] [closed]

My website has been hacked again. There are many foreign URLs such as here. I've checked the database and there is nothing strange in my database. Does anyone know what kind of hack attack is like ...
35
votes
5answers
5k views

Are there actions taken against websites that deliver malware?

There are serious tools and services such as Google Safe Browsing for malicious and phishing websites, and others fully dedicated to phishing websites such as Phishing.org. What is done against these ...
3
votes
1answer
553 views

Phishing email from Avast - Headers look totally legit?

Below is the email with headers. I never registered on the site, so it's clearly phishing, but the links in the email point to the real Avast site. The delivery path also looks legit since both IP ...
0
votes
1answer
88 views

Is there a “how to” about Gmail fraud, updated at least once per week?

My Gmail account has just been cracked and many of my contacts are receiving fake emails, claiming that I'm in troubles and requesting money. Searching for advice, using Google, about what actions ...
4
votes
1answer
470 views

How secure is JavaScript based OAuth 2.0

JavaScript based OAuth exposes the client ID of the application and it trusts only on the domain requesting the access token. The domain name can be forged with a DNS hijack (or a virus affecting ...
0
votes
2answers
134 views

Phishing email sent to me within a few hours after a related incident, what should I do?

A few hours ago I was helping a family member pay for something on a government website with one of his credit cards, but for whatever reason it didn't go through, so we used another card and it ...