Stack Exchange Network

Stack Exchange network consists of 174 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange

Phishing is an attempt to steal user's personal information such as username, password, credit card number etc. The main idea of such attack is that the attacker pretends to be a trusted web-site which asks the user to re-enter the personal information and in this way steels it.

1
vote
1answer
39 views

Phishing email repository for analysis [closed]

Is there a repository of known phishing emails somewhere that is available for analysis purposes? I want to test some mitigation theories and need a good collection of data to test against.
-1
votes
1answer
24 views

Whois History resources authentic source

I have couple of doubts related to Whois records. For a particulate domain... How authentic are the Whois records? As per my research the records are not permissible in courts (or at least would ...
-1
votes
1answer
166 views

People using my email address (and only that) for booking hotels. What kind of scam is this?

I have faced the same issue twice: 2 people, whose names are definitely not the same as mine, used my email address to book hotels through a well-known hotel company and a lesser-known hotel booking ...
1
vote
0answers
69 views

Website marked as dangerous (phishing) in the past. How to get off blacklists?

One of our clients got his website infected almost a year ago. The site indeed contained some malicious files on the FTP server, and it got marked as dangerous, with suspicion of phishing attempts. A ...
0
votes
1answer
60 views

How to handle a phishing site?

I launched my company website a month ago, now when I google using website name a phishing site that has exactly copied my site appears in the first page. It also has a better rank than my website ...
1
vote
1answer
81 views

What is this phishing technique called using subdomains

I'm writing a blog post analyzing a list of phishing domains and I'm coming across a lot of IDN homograph attack domains and these "subdomain attack domains" but I cannot find the technical/good way ...
2
votes
1answer
79 views

Is this phishing? How can I be sure? And what can be gained?

Yesterday I received an email that I assumed/hoped was legitimately from a prospective employer that I interviewed with several weeks ago. The timing of the email couldn't have made more sense as they ...
0
votes
0answers
59 views

Is registrar.eu legit or did I just fall for a scam?

Yesterday I registered a .com domain from an EU based company. Today, I received an email that I have to verify my e-mail address or my domain will be suspended after a given deadline. Since it ...
1
vote
2answers
71 views

Why would a phishing blacklist be hashed?

I was planning to comment on the question at Finding phishing sites to certain domain and suggest searching Google's blacklist for keywords or substrings of a domain name in question. But then I ...
1
vote
0answers
47 views

Finding phishing sites to certain domain

My work currently involve finding phishing site to a certain domain/ company. I was wondering if there are some tools/ Online services that I can use to find phishing sites. I would like to know; ...
2
votes
0answers
61 views

Does Google check for Unicode characters to determine spam now in Gmail?

I was reading some tweets from @pwnallthethings regarding the John Podesta spear phishing emails. What the email looked like: The Change Password button link, notice the domain com-...
1
vote
1answer
94 views

Should I reply to an email saying that I requested online access to a website?

I received an email saying I requested access to a website. The email also includes a one-time passcode. I did not do anything that would require a one-time passcode. At the bottom of the email is a ...
3
votes
2answers
254 views

Why do they put cyrillic letters in phishing email?

I have just received this email: Fог уоuг ргоtесtіоn, уоuг Αррlе ID іѕ аutоmаtісаllу disabled. Wе hаνе ргеνеntеd аn unuѕuаl ѕіgn іn аttеmрt оn уоuг Αррlе ассоunt.Тhіѕ ассоunt hаѕ Ьееn lоскеd ...
2
votes
2answers
62 views

Can ISPs be helpful in preventing spam?

I have received a number of phishing emails from various domains. I would like to prevent the domain from sending emails so that other people also don't get taken advantage of. I have not been ...
6
votes
1answer
172 views

Is noreferrer enough to secure links?

Is the use of noreferrer enough for links that use target="_blank" in order to avoid reverse tabnabbing For context here is an explanation of the issue: "Target=_blank - the most underestimated ...
1
vote
4answers
166 views

Capture emails of users who clicked my link [closed]

a follow up question to this: Tracking click-through for organization-wide phishing email test I am going to send an email (fake phish) to all my org. users via email. I want to test the users so if ...
1
vote
0answers
40 views

Phishing email linking to sharepoint address [duplicate]

Our organization got some sort of phishing email that contained an attachment which linked to sharepoint - ie. https://someaddress.sharepoint.com/:b:/... etc. The link takes you to that "sharepoint" ...
2
votes
2answers
6k views

Is 'account-security-noreply@accountprotection.microsoft.com' a legitimate sender of security alerts?

I have been getting emails from "account-security-noreply@accountprotection.microsoft.com" (as verified in metadata) about unusual activity. The internet has very conflicting information about if ...
6
votes
2answers
904 views

Tracking click-through for organization-wide phishing email test [closed]

My organization wants to send out a test phishing email to all employees after a week of security awareness. I plan on drafting a basic HTML page and including a misspelled link to it in an email ...
1
vote
0answers
31 views

Is it possible for old text messages to be used in an SMS spoofing attempt?

Background The company I work for maintains an application that allows users to subscribe to notifications via SMS or email. SMS messages are sent to the user's SMS gateway as an email. The Issue ...
0
votes
1answer
464 views

Accidently opened a phishing email, is my computer infected by malware?

I was looking through my unread emails when I accidently opened a Paypal phishing one. I thought it was legit because I saw in the preview it was from "Service-Intl@Paypal.com", but I got some doubt ...
2
votes
1answer
300 views

Is someone trying to break in my WIFI router?

We have a WIFI router with SSID: "dummyssid" with our own WPA2 password. Today unexpectedly, another WIFI SSID was available in the WIFI scan list with exactly same as of our SSID: "dummyssid" but ...
4
votes
2answers
196 views

Can opening an email be tracked with a wav file?

I work for a large company and they are currently running a phishing training program. I received one of these "safe" phishing emails and found something I don't really understand. There are several ...
2
votes
1answer
75 views

Chrome popup - what if button labels for “Accept/Cancel” are exchanged?

Almost all websites show inline modal popups in chrome. How can I be sure that "Cancel" is really cancel and "OK/accept/allow" are properly labeled by the website?
6
votes
3answers
256 views

What security holes are introduced by clicking an unknown link?

I recieved an email today that told me that "My account was comprised", an obvious fishing attempt, or so I thought. When I clicked the link, just for the fun of it, it brought me to a page which ...
0
votes
2answers
74 views

phishing from chrome

This just showed up in Chrome. It's obviously phishing - the mangled English and weird url give it away. How would it work? Asking me for info I shouldn't give them? My system then slowed down. ...
1
vote
1answer
86 views

Can SMS messages be traced when they come from a computer?

From Amazon SNS, I can send SMS messages to any mobile phone. To recipient phones, the SenderId is just a string of my choosing. The messages cannot be replied to. I receive quite a few phishing ...
6
votes
2answers
3k views

An email from gaia.bounces.google.com

I received an email from gaia.bounces.google.com, supposedly from Google, which asked me to click on a link to check my security status. Is this legitimate? I searched with my Norton Safe Search but ...
3
votes
0answers
190 views

Paypal payments redirecting to fraudulent URL [closed]

At my place of work, our paypal appeared to have been compromised so that a clone of paypal would appear and ask for customer credentials. The url it directed to was https://checkoutnow.mdigo.com/...
4
votes
2answers
608 views

Why would PayPal send messages from another domain?

I have just received a message asking to consent to PayPal policy updates from the domain: https://epl.paypal-communication.com The actual link is full of trackers. Given the domain name, it sounds ...
1
vote
2answers
193 views

Spoofed digitally signed email

So I received an email from "paypal.com" yesterday (and looks like most people did too(1)) and I've verified the ascii letters are indeed what they appear as (No capital I instead of L in paypal.com ...
0
votes
2answers
782 views

Is this email from DigiCert about SSL certificates genuine?

A few days ago, I received the email below (supposedly) from DigiCert, about an SSL certificate. I am the owner of the domain (redacted to example.com) but I guess it's kind of trivial to look this up ...
2
votes
1answer
17k views

Is this email from OneDrive a phishing attack?

Today I received an email claiming that my OneDrive account is going to be deleted as it has been unused for the past two years. This is probably true. The email urges me to visit OneDrive to ...
1
vote
1answer
103 views

Phishing Analysis

I am currently analyzing and exploring daily phishing attempts. Some at points, I am unable to definitively verify if this is, in fact, a phishing attempt. When analyzing phishing attempts, ...
6
votes
3answers
458 views

Why does DKIM verification succeed with a signature from Yahoo when all headers are spoofed to look like GMail?

Today I got a scam e-mail which I decided to disect. I quickly found that it was sent from a GMail address (From, Reply-To, Return-Path) but that the mail itself came from Yahoo. HELO from Yahoo ...
0
votes
0answers
290 views

Someone signed up to several websites using my Email address and was created from my home IP, but with a different browser than we have on any device?

I had 3 different emails sent to me overnight signing me up for websites I have never heard of. All 3 using the same woman's name, Lydia Watkins. I own a retail business so many people know this email ...
1
vote
2answers
76 views

Blocking Business Email Compromise (BEC) emails

I am recieving phishing emails like the one depicted below, with the sender being a legit member of our organization. How can I block this kind of email? What should be done? Is malwarebytes capable ...
16
votes
3answers
592 views

Why are developers using embedded user agents for 3rd party auth? What are the alternatives?

I've noticed a trend in mobile and desktop apps in recent years with the advent of OAuth (and it may also affect other frameworks) to request a user to sign up or log in using 3rd party authentication ...
0
votes
0answers
27 views

Could certificate authority be bypassed? [duplicate]

"The DNSChanger Trojan replaces the name servers with their own in order to direct web and other requests from the infected host to a set of attacker-controlled servers that can intercept, inspect, ...
3
votes
1answer
61 views

Is there anything that a regular user can do to help remove fake websites?

I'm talking about domains like msn.org and stackoveflow.com that impersonate major websites and serve up malicious ads such as the "critical alert from Microsoft" ad. I've tried reporting these ads ...
8
votes
2answers
566 views

CVV Credit Card Phishing

Caller 18777348472 had my name & last 4 digits of my credit card and indicated he was from fraud prevention: someone tried to charge $600 through Amazon. He asked me to verify that I had the card ...
1
vote
2answers
767 views

What are the possible ways to exploit a login page? [closed]

In a recent interview I was asked how can you bypass a login page, all it has is Username, password and login button. I was able to come up with below possible ways, SQL Injection Phishing ...
80
votes
8answers
18k views

Company does not want any names on phishing reports

We have been recently contracted to run phishing tests for a company. Let's call it a company but basically they are obligated, by law, to assess the security of their environment with phishing ...
1
vote
2answers
64 views

Receiving validation mails with wrong address

Lately I have been receiving unexpected validation/confirmation mails from various social media and/or e-commerce sites, asking me to validate my account or giving me the overview of my last order. I ...
4
votes
0answers
1k views

Whatsapp Unicode Phishing Link [closed]

I have been receiving messages from relatives that goes like this: AirAsia is rewarding everyone with 2 free plane tickets to celebrate 24 Years of quality service. Get your free ticket at: http://...
1
vote
1answer
104 views

User accessed Phishing link but didn't provide the credential but got hacked?

One of my colleagues received a phishing email in which he clicked on a link. The domain (www.phishing-link.biz) redirected to adfx.xxx.edu which does look like adfs authentication page. Colleague ...
2
votes
1answer
153 views

Phishing email with encoded url params

I received a phishing email with the following format: hxxp://<%legitimateSite%>/~!@%23$%25%5e&()_+~!@%23$%25%5e&()+~!@%23$%25%5e&*()+~!@%23$%25%5e&()_+~!@%23$%25%5e&()+~!@%...
2
votes
1answer
313 views

OpenID Connect/OAuth 2.0 and “fake” official apps

My question mostly pertains to OpenID Connect, but can be applied to OAuth 2.0 as well. When it comes to an OpenID Connect Client doing the "authorize" dance with the OpenID Connect Provider, the ...
1
vote
2answers
74 views

Is it a coincidence that I received phishing emails for PayPal after I made a large deposit? [closed]

I recently made a very large deposit into a PayPal account. Not long after (a day or two), I have received phishing emails to steal my PayPal information. The deposit came from eToro (I pulled out ...
26
votes
3answers
6k views

Another domain is using our web app's IP address. How to prevent it? [duplicate]

Our web application is being mimicked by another domain, https://www.djjpl.com.sg. On ping, it gives the same IP address as ours. Every git push to our server reflects on that domain. We want to stop ...