0

I received an email from what looked like a friend, it had a suspicious link I inspected the email address and saw that the username was spot on but the domain name was totally different. I also put the link through a suspicious link checker and it came through as such. The username is quite a unique one I'm very suspicious as it feels like a personal attack. That said I don't how these phishing people operate so am asking for your thoughts

  • 2
    When you say "the username was spot on but the domain name was totally different", presumably you are comparing it to your friend's email address. If the domain name is different, then surely you now know that it isn't from your friend. Given that you've said all this in your question, it's unclear to me what you expect anyone else to be able to tell you... Are you able to clarify your question? – Alex Hague Jun 21 at 9:52
  • You are correct I did know it was not from a friend. My question is, is it likely am I being targeted personally as the username is very unique. – Thooomie Jun 21 at 11:06
  • Can you edit your question to be more specific? Right now your question is "asking for your thoughts". What specifically do you want to know? – multithr3at3d Jun 21 at 20:10
  • I would like your thoughts\answers on the chances of this being a personal attack and not a random attack considering the username etc. – Thooomie Jun 21 at 22:28
  • Most likely, it is just a random phishing e-mail. But it is impossible to be more affirmative than that without more information. – A. Hersean Jun 24 at 15:26
2

I would like to bring your attention to a malware called Trickbot. This TrendMicro article on Trickbot should bring you up to speed.

I have worked with the malware a couple of times in recent months and you might be interested in one of its capabilities.

It is able to steal email credentials & address-books. The compromised sender email address will then be used to spoof the subsequent mass emails to the potential victims in the address-book.

Essentially by doing this, the chances of this malware infecting another user by clicking it is way higher. The intention is to let the victim's guard down by putting a familiar name to the malicious email. Victims would assume that the sender is legitimate, like a friend or a colleague, and would then click the link and compromised itself and the cycle continues. So let's say an address book of 150 recipients, all it takes is one out of the 150 to keep the chain going.

You might've witnessed this malware first hand, notify your friend through proper channels, and see what is going on.

as it feels like a personal attack.

I can see why you would feel this way, I am not ruling out the personal attack reasoning. But I am just letting you know that there is a way that there are automated/customized personal attacks being crafted where you are just a potential victim of another victim.

| improve this answer | |
  • Appreciate your response. Just to give some further information. I had 1 email on Thursday from friend 1 and then a second email today from friend 2 who is friend 1s partner? It looks and feels like first attempt didn't work so... – Thooomie Jun 21 at 13:00

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.