Phishing is an attempt to steal user's personal information such as username, password, credit card number etc. The main idea of such attack is that the attacker pretends to be a trusted web-site which asks the user to re-enter the personal information and in this way steels it.

learn more… | top users | synonyms

-2
votes
3answers
62 views

Email from supposedly Apple (mycloud.ssl.com)

I got an email where it says that Apple recently failed to validate my payment information and therefore they need to ask me to complete a short verification process in order to verify my account. At ...
8
votes
2answers
619 views

Did scammers take control of a subdomain to host phishing site?

This morning I received a text message (ostensibly) from my bank: We need to contact you. Please visit https://paymentassistance.nationwide.co.uk for more information My spidey sense immediately ...
3
votes
1answer
58 views

Revising Phising Email & it's payload… did I do this right?

Recently my company got a widespread phishing email sent to them, thankfully no one clicked the link (which is great!) Since I'm a student and a current intern working in IT Security I wanted to see ...
0
votes
2answers
117 views

Was GMail hacked?

I was logging in to my gmail and this phising alert screen showed. Is safe to continue? I know that is very rare that this shows when opening GMail, but I prefer to be safe. It seems that this ...
4
votes
1answer
79 views

Sites that allow user-generated content

Is there a way to identify which popular sites will host arbitrary user-generated content? I am doing some analysis to detect phishing sites. It would be nice to use the popularity of a website as a ...
-1
votes
0answers
58 views

Hacked site/hosting? Or hacked browser?

I need some help. I have a security plugin installed and I received an email notification telling me that A file change was detected on my system for my site. I logged in and noticed no unusual ...
2
votes
1answer
94 views

How to identify coded content in a phishing page [closed]

First of all, I'm a completely dummy in information security. Today morning I've received an email that make me curious. It was a kind of phishing page which was not detected by the Gmail's spam ...
0
votes
1answer
52 views

Is pull inherently more secure than push?

Users of a service are waiting for something to happen - a money transfer for example. An attacker might forge an email notification, that executes an XSRF attack. Alternatively, I could leave it up ...
1
vote
1answer
58 views

Unexpected phishing attempt by SMS

I just received this text message (screenshot), which claims to be from the national postal service, informing me that I have a package waiting for me. I have a user account on their website, so them ...
1
vote
2answers
71 views

Who do I inform when a website is compromised

I often receive phishing emails claiming to be big companies like PayPal. When I check the link I remove anything which could be used to confirm that it was me who clicked and open the link in a ...
8
votes
3answers
251 views

Is it enough to look at the sender's email address?

I use Gmail. When I receive an email, Gmail displays the sender's email address. So far I've always looked at this address when receiving sensitive mails, to avoid phishing. For example, I know by ...
1
vote
2answers
190 views

Is this a legitimate Microsoft email or is this a Phishing email and how can I tell?

I am a mobile application developer using Microsoft Azure with my MSDN subscription to develop my back-end of the application. Today I got the following email: So given my above background this ...
6
votes
2answers
408 views

Prevent phishing attacks through abuse of IOS URL scheme

I am building an IOS application that will have the following flow: A user completes registration from the web. Upon completion of registration, a link is sent to his email. Once the link is clicked ...
4
votes
1answer
44 views

How can I safely view the code of a VBA macro?

I have received a phishing email with the usual bogus bill in the form of a Word document. I am curious about what the probable virus wants to do so I would like to inspect the code. At the moment ...
2
votes
0answers
37 views

Something phishy going on with email [duplicate]

I own my own domain. For a month or so I've been getting emails from addresses I don't know with "see attached image" or "find the attached invoice", with a zip/rar file attached. Of course, I ...
1
vote
2answers
83 views

Unsolicited opt-out from data brokers

I received several automated emails at an early hour from several data brokers (e.g., Spokeo) asking me to confirm an opt-out for my email address and name. I did not request these, but did so about ...
16
votes
2answers
1k views

Ongoing Executive Impersonation Attack

A friend of mine runs a small business that was recently targeted by a relatively sophisticated "executive impersonation" wire transfer spearphishing attack. The attacker registered a domain that was ...
0
votes
1answer
89 views

What are these links that have been sent to me multiple times on facebook?

2 friends of mine have sent me very suspicious links on facebook, which ask me for credentials on an external site. Entering hello@example.com in the username, and 1234 for the password let me in, and ...
3
votes
1answer
54 views

One of my open files turned into a list of URLs and codes after clicking a link on a phishing email?

So I received a non-filtered email earlier today supposedly from Itunes under my email address with an invoice for Netflix subscription. Some of the links were genuine, but ultimately I clicked on a ...
4
votes
1answer
70 views

Databases with spam, phishing email examples [duplicate]

I'm working on a little project trying to see if I can predict the likelihood that an email is in fact a security risk (phishing, spam, social engineering, etc). I order to do this I need to have a ...
2
votes
1answer
102 views

Unable to Spoof DNS in Kali

I am new to Kali But not new to Information Security. Warming up with Kali, I tried to dns_spoof. But that didn't quite work. Here is what I did. Tampered ip_forward to 1 in /proc/sys/net/ipv4 ...
3
votes
2answers
186 views

“fake” phishing mails from CST

I work in the computer security team of my company and my team leader ask me to send "fake" phishing mails to my colleagues. The mails intended to lure them into clicking on the embedded links (the ...
0
votes
1answer
149 views

Does it Matter That Universal Windows Platform (UWP) is Open to Phishing Attacks?

A few years ago (a little over three now to be exact), I brought up what I consider to be a rather obvious (and serious) security issue with the Universal Windows Platform (UWP): The ability to use ...
31
votes
2answers
4k views

Where to report malicious URLs, phishing, and malicious web sites?

I recently discovered that my web site was hacked: there was a hidden HTML div that's about selling shoes...! I googled the text in question and voila: thousands of sites have been hacked. Check this ...
1
vote
0answers
148 views

Attackers on sc.imp.live.com [closed]

"Deceptive site ahead Attackers on sc.imp.live.com may trick you into doing something dangerous like installing software or revealing your personal information (for example, passwords, phone ...
5
votes
4answers
121 views

How does a CSRF logout pose a potential threat to a website?

Websites like SuperLogout logs the user out from several websites at one go. I want to know in what way does this pose a potential threat to the users of the website? How can this be combined with a ...
7
votes
4answers
2k views

Is a mobile app more secure for mobile use than the “normal” website?

An untrained end user who uses a mobile web browser is vulnerable to phishing and can't easily verify the the authenticity (or security) of a website among other issues. Also, it is very easy to ...
2
votes
1answer
174 views

Scam caller claimed to have elderly friend's “Windows unique identifier”

An elderly friend received a telephone call similar to this Information Security SE post and this one. The caller claimed that my friend's computer had a problem that needed to be fixed. My friend ...
18
votes
4answers
5k views

Is there a way to download a PHP file without it being executed?

I recently got a phishing mail of unusually bad quality; "Please imediatly sign in under the following link, as we are your bank, you know"-ish. The link points to an unconvincing URL with .php at the ...
0
votes
1answer
165 views

SETOOL Kit:Error: “Unable to Clone the site. Check your network connection”

I have to tried to check whether a site is vulnerable to Phishing attack or not using "Setool kit" in Kali Linux. But when I tried to clone a site using this Setool Kit in Kali Linux, I got an error ...
1
vote
1answer
95 views

Spear Phishing attempt, how to respond? [closed]

I'm a software developer for a software development company responsible for multiple products, and I typically handle our IT needs as we're quite a small company. We had a suspicious incident today ...
3
votes
2answers
143 views

Why can't my email server automatically identify spoofed addresses?

I get this question from business stakeholders a lot, and I have tried to solve this problem on my own. I have a potential approach, but I want to challenge my assumptions. In my mind, it should be ...
5
votes
1answer
78 views

Do people use “phising” as a real term, or just a mistaken spelling of “phishing”

Is "phising" a commonly accepted term, or just a mis-spelling of "phishing"? I've always understood "phishing" is a common security term. However, recently I've started seeing serious articles and ...
4
votes
4answers
3k views

One Time Password via Text Message: Possible exploits?

Is there a credible scenario in which the OTP (One Time Password) for online credit card transactions ( specifically for Verified by Visa) can be bypassed? Context: A guy I know was cheated via the ...
5
votes
1answer
54 views

How do I verify that in-app social login dialogs are secure?

If I have a mobile app that supports some kind of social login feature, say, to login to the app from my Facebook account, and if the app opens the Facebook login page inside the app in a mobile, is ...
0
votes
1answer
122 views

Phishing Gmail account [duplicate]

I received a mail from a friend who I was playing together in a multiplayer game. And it had a link to phishing page which would ask to login to view the file that the sent me. And my antivirus found ...
3
votes
3answers
165 views

Does this concept attack work to harvest credentials and 2FA using offline fake site?

My concept is this: Client connects to Malicious\Eviltwin AP Client connects to www.facebook.com but this one is a fake offline site by the fake dns server Client enters user and password ---> ...
-2
votes
2answers
63 views

User's submitted ID in URLs, can it open some vulnerability? [closed]

On the website I'm building users can submit links to various of their personal page: YouTube accounts, Twitter, Facebook and a lot more. When he does so he furnishes the ID to his account. For ...
5
votes
1answer
14k views

Is this Facebook email real or phishing?

I received this email from what is supposedly Facebook today. Here's a screenshot: I was not aware I had credits or credits existed on Facebook and apparently I have $2.30 worth. It looks legitimate ...
7
votes
1answer
109 views

fake website used for phishing purposes

Our real web site is www.abc.com. Recently Intel notified us of another web site www.fake.com having some parts of the site appearing the same as our real site. This is obviously a phishing site. Not ...
0
votes
1answer
92 views

“Secure” emails from unfamiliar source(s)

The context is long, so I'll ask my question first. If an encrypted message is received from an unfamiliar sender and it's spam, how can I avoid receiving further messages of the same sort? If it's ...
1
vote
2answers
1k views

Liliane Bettencourt scam? [closed]

I got a text message from an Elizabeth.Zamora@Bridgeportct.gov sub; RE: donations!!! "donation was made to you by Mrs. Liliane Betterncourtm, contact her at: lilianebettencour@163.com" for ...
2
votes
1answer
106 views

Should we trust online banks with our credit card information?

I'm thinking of buying a product for someone using the steam platform. Being in Germany, the best (least expensive) option would be to use a local bank. Logging in, choosing a product and checking out ...
-2
votes
1answer
70 views

Rate The Viability Of My Phish-Proof System [closed]

I have recently finished building my first (and so far only) phish-proof login system and I would like the experts to test it. The system is hosted at http://www.daera.net/noph/nophlogin.htm Is it ...
0
votes
1answer
81 views

SEToolkit cloned website can be viewed over internet, but does not harvest credentials

I've been working with SEToolkit's website cloner/credential harvester. Everything works fine locally: The clone opens on the victim pc, victim inputs credentials, after submitting the victim is ...
1
vote
0answers
299 views

WifiPhisher not creating a fake access point

I recently came to know about WifiPhisher. To test it, I set up an access point using my Windows laptop and tried to obtain its password using this tool in my Ubuntu machine. So, when I run the ...
0
votes
4answers
168 views

Phish Proof Website. Possible? [closed]

Seeing how big names like Gmail, Yahoo! (despite the login seal) and Hotmail (Live Mail) are prone to phishing attacks, this raises the question of whether it is possible (theoretically) to safeguard ...
1
vote
2answers
105 views

How does Stripe Checkout prevent phishing attacks?

The Stripe Checkout overlay (https://stripe.com/checkout) pops up within a site and does not show the associated URL. A malicious website could create its own overlay that looks like Stripe's, and ...
3
votes
4answers
4k views

Yahoo Email Keeps Getting Phished

I keep getting spam emails from myself (and I am sending them to others as well) on my Yahoo Mail account. I have already went through two password changes which I thought were secure. My very last ...
2
votes
0answers
105 views

Installing a cocoapod and 'github' asks for login credentials?

I just added a cocoapod and got this >ls Podfile superApp Podfile.lock superApp.xcodeproj Pods superApp.xcworkspace >pod install Updating local specs ...