Stack Exchange Network

Stack Exchange network consists of 174 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange

Questions tagged [phishing]

Phishing is an attempt to steal user's personal information such as username, password, credit card number etc. The main idea of such attack is that the attacker pretends to be a trusted web-site which asks the user to re-enter the personal information and in this way steels it.

1
vote
0answers
49 views

What would you do as first day of CSO or Head of CyberSecurity [closed]

I was asked this question at an interview today and was unable to give a structured answer since there is so many things a head of security can do. The additional info that I had were : - You can ...
1
vote
1answer
61 views

Strange phishing email

I received a strange phishing email the other day that seemed to use span tags to encode "hidden" values within the email's body: <meta http-equiv="Content-Type" content="text/html; charset=utf-8"&...
0
votes
0answers
73 views

Tracking down which AdServer is sending phishing sites

When visiting a German news site (different ones, which do not belong together and have different AdNetworks connected) through the Facebook mobile App, the website opens and shortly after there opens ...
1
vote
3answers
189 views

Accidentally clicked a phishing link, am I at risk?

I clicked a link from a fake Twitch streamer and now I'm scared of being spied on. I typed my account details but didn't actually sent them because I realized it was a fake link right before clicking ...
2
votes
0answers
84 views

What does this phishing email achieve? [duplicate]

The email is formatted as an email from Google notifying me that I need to respond to an intrusion attempt on my account. There are no other links other than these href mailto links ("Oui Moi!" and "...
2
votes
1answer
260 views

How is this website redirect working?

Someone sent me a URL via WhatsApp (httpx://cadburys-prizes[.]com) that allegedly lets me claim a free box of chocolates. Obviously this is fake and I've seen similar websites before. If I view the ...
1
vote
0answers
70 views

Possible phishing victim. How to proceed? [closed]

I was trying to buy tickets for a show on an official web page. This will be the last show of this band so the server went down pretty quickly. The band tweeted about difficulties and then someone ...
-1
votes
1answer
107 views

Can we infect our system by opening a email with outlook 2016?

I read that it is possible to get a virus just by opening a mail (not even clicking at any links on it or opening the attachments), because scripts can be attached to it. Is this also true for ...
1
vote
1answer
34 views

What's the use of DKIM/SPF if it only validates the Enveloppe From?

DKIM and SPF are mentioned as powerful mitigations for having your domain abused for phishing. But when I send a mail like this: Return-Path: <me@mydomain.example.com> From: Citibank security ...
-1
votes
1answer
51 views

Check emails are genuine [closed]

unitedstatescustoms66@gmail.com tescoextrashippingcompany147@gmail.com I have received messages from the email letting me know about luggages and parcel being sent a soldier whom I have been talking ...
1
vote
3answers
71 views

Would Gmail server be able to protect me from phishing attacks if I'm using a stock email app on Android?

I have a Gmail account and I am using Samsung email app. Recently I have switched to the Gmail app because I thought using the Gmail app would be safer because that app would automatically filter ...
0
votes
1answer
41 views

How can a router or my ISP protect against phishing? [duplicate]

I see a few services advertising the ability to protect against phishing and ransomware attacks. ISPs sell services which supposedly protect you and some routers like Check Point 700/900 series. Is ...
2
votes
2answers
92 views

Does U2F prevent phishing of passwords?

U2F is touted as a new 2 factor authentication standard that has built in defense against phishing attacks. As I understand it, this works by registering the device with each service, thereby creating ...
1
vote
1answer
112 views

Send GET request from a PDF file

I'm currently working on a security Proof Of Concept where I need to show the danger of opening an unknown PDF file. Internet says that many malwares use Javascript in PDF document (AcroJS) to ...
0
votes
1answer
83 views

Why are there no browser feature or extension to only check the domain and username to prevent phishing?

One of the recommendations to prevent phishing using look-alike domain names (like www.google.com.phishing.org or IDN homograph attacks) is to use a password manager or a physical security token like ...
2
votes
3answers
360 views

Should I enter fake password to phishing site?

Hope I have chosen correct forum to ask this question. The other day it happened to me. I got e-mail from my admins requesting me to update my password. "Not again" I mouthed and clicked the link. ...
0
votes
1answer
111 views

SEToolkit Not Cloning Login Page

I am trying to clone a login page with SEToolkit in the latest version of Kali Linux. SEToolkit simply isn't working. I have tried running it with normal user privileges and sudo. I have placed in ...
2
votes
1answer
72 views

What are Outlook's safe links? [closed]

People using outlook.com as their mailbox may know this: If you receive an e-mail with a web link in it and copy the link with "right-click + copy link location" you will receive an outlook protection ...
1
vote
1answer
120 views

Outlook was redirected to the server clblgn.sceur.ch to get new settings

I (that is, we, our company) has clicked on "Allow" when Outlook has presented us with a redirect to autodiscover-s.outlook.com on our macs to get new settings. Today, we got a popup asking to connect ...
2
votes
2answers
169 views

How do I protect myself against SIM hijacking/social engineering?

There are several posts like these: https://medium.com/@N/how-i-lost-my-50-000-twitter-username-24eb09e026dd https://motherboard.vice.com/en_us/article/5984zn/listen-to-sim-jacking-account-ransom-...
1
vote
3answers
348 views

Is this a phishing email?

I've just received the strangest email: I don't understand why anyone would send an email like this. It doesn't look to be asking for credentials of any kind. Is this a scam which is designed for ...
0
votes
1answer
228 views

Why hasn't the one-click attack taken over the world?

This is a follow-up question related to Is single-click phishing possible?. If such a convenient attack is possible, I assume everyone on the internet should already be hacked. Why hasn't that ...
2
votes
2answers
212 views

Is single-click phishing possible?

For Chrome, IE/Edge, Safari, Firefox, Opera released after 2018, is it possible for a phishing to succeed by just enticing a user to click a URL? Notice: The user only does a click on the URL, no ...
1
vote
1answer
129 views

Phishing email repository for analysis [closed]

Is there a repository of known phishing emails somewhere that is available for analysis purposes? I want to test some mitigation theories and need a good collection of data to test against.
-1
votes
1answer
27 views

Whois History resources authentic source

I have couple of doubts related to Whois records. For a particulate domain... How authentic are the Whois records? As per my research the records are not permissible in courts (or at least would ...
-1
votes
1answer
208 views

People using my email address (and only that) for booking hotels. What kind of scam is this?

I have faced the same issue twice: 2 people, whose names are definitely not the same as mine, used my email address to book hotels through a well-known hotel company and a lesser-known hotel booking ...
1
vote
0answers
75 views

Website marked as dangerous (phishing) in the past. How to get off blacklists? [duplicate]

One of our clients got his website infected almost a year ago. The site indeed contained some malicious files on the FTP server, and it got marked as dangerous, with suspicion of phishing attempts. A ...
0
votes
1answer
68 views

How to handle a phishing site?

I launched my company website a month ago, now when I google using website name a phishing site that has exactly copied my site appears in the first page. It also has a better rank than my website ...
1
vote
1answer
128 views

What is this phishing technique called using subdomains

I'm writing a blog post analyzing a list of phishing domains and I'm coming across a lot of IDN homograph attack domains and these "subdomain attack domains" but I cannot find the technical/good way ...
2
votes
1answer
93 views

Is this phishing? How can I be sure? And what can be gained?

Yesterday I received an email that I assumed/hoped was legitimately from a prospective employer that I interviewed with several weeks ago. The timing of the email couldn't have made more sense as they ...
0
votes
0answers
72 views

Is registrar.eu legit or did I just fall for a scam?

Yesterday I registered a .com domain from an EU based company. Today, I received an email that I have to verify my e-mail address or my domain will be suspended after a given deadline. Since it ...
1
vote
2answers
81 views

Why would a phishing blacklist be hashed?

I was planning to comment on the question at Finding phishing sites to certain domain and suggest searching Google's blacklist for keywords or substrings of a domain name in question. But then I ...
1
vote
0answers
94 views

Finding phishing sites to certain domain

My work currently involve finding phishing site to a certain domain/ company. I was wondering if there are some tools/ Online services that I can use to find phishing sites. I would like to know; ...
3
votes
1answer
142 views

Does Google check for Unicode characters to determine spam now in Gmail?

I was reading some tweets from @pwnallthethings regarding the John Podesta spear phishing emails. What the email looked like: The Change Password button link, notice the domain com-...
1
vote
1answer
112 views

Should I reply to an email saying that I requested online access to a website?

I received an email saying I requested access to a website. The email also includes a one-time passcode. I did not do anything that would require a one-time passcode. At the bottom of the email is a ...
3
votes
2answers
275 views

Why do they put cyrillic letters in phishing email?

I have just received this email: Fог уоuг ргоtесtіоn, уоuг Αррlе ID іѕ аutоmаtісаllу disabled. Wе hаνе ргеνеntеd аn unuѕuаl ѕіgn іn аttеmрt оn уоuг Αррlе ассоunt.Тhіѕ ассоunt hаѕ Ьееn lоскеd ...
2
votes
2answers
68 views

Can ISPs be helpful in preventing spam?

I have received a number of phishing emails from various domains. I would like to prevent the domain from sending emails so that other people also don't get taken advantage of. I have not been ...
6
votes
1answer
251 views

Is noreferrer enough to secure links?

Is the use of noreferrer enough for links that use target="_blank" in order to avoid reverse tabnabbing For context here is an explanation of the issue: "Target=_blank - the most underestimated ...
1
vote
4answers
174 views

Capture emails of users who clicked my link [closed]

a follow up question to this: Tracking click-through for organization-wide phishing email test I am going to send an email (fake phish) to all my org. users via email. I want to test the users so if ...
1
vote
0answers
52 views

Phishing email linking to sharepoint address [duplicate]

Our organization got some sort of phishing email that contained an attachment which linked to sharepoint - ie. https://someaddress.sharepoint.com/:b:/... etc. The link takes you to that "sharepoint" ...
2
votes
2answers
17k views

Is 'account-security-noreply@accountprotection.microsoft.com' a legitimate sender of security alerts?

I have been getting emails from "account-security-noreply@accountprotection.microsoft.com" (as verified in metadata) about unusual activity. The internet has very conflicting information about if ...
6
votes
2answers
922 views

Tracking click-through for organization-wide phishing email test [closed]

My organization wants to send out a test phishing email to all employees after a week of security awareness. I plan on drafting a basic HTML page and including a misspelled link to it in an email ...
1
vote
0answers
45 views

Is it possible for old text messages to be used in an SMS spoofing attempt?

Background The company I work for maintains an application that allows users to subscribe to notifications via SMS or email. SMS messages are sent to the user's SMS gateway as an email. The Issue ...
0
votes
1answer
3k views

Accidently opened a phishing email, is my computer infected by malware?

I was looking through my unread emails when I accidently opened a Paypal phishing one. I thought it was legit because I saw in the preview it was from "Service-Intl@Paypal.com", but I got some doubt ...
2
votes
1answer
510 views

Is someone trying to break in my WIFI router?

We have a WIFI router with SSID: "dummyssid" with our own WPA2 password. Today unexpectedly, another WIFI SSID was available in the WIFI scan list with exactly same as of our SSID: "dummyssid" but ...
4
votes
2answers
440 views

Can opening an email be tracked with a wav file?

I work for a large company and they are currently running a phishing training program. I received one of these "safe" phishing emails and found something I don't really understand. There are several ...
2
votes
1answer
78 views

Chrome popup - what if button labels for “Accept/Cancel” are exchanged?

Almost all websites show inline modal popups in chrome. How can I be sure that "Cancel" is really cancel and "OK/accept/allow" are properly labeled by the website?
6
votes
3answers
277 views

What security holes are introduced by clicking an unknown link?

I recieved an email today that told me that "My account was comprised", an obvious fishing attempt, or so I thought. When I clicked the link, just for the fun of it, it brought me to a page which ...
0
votes
2answers
82 views

phishing from chrome

This just showed up in Chrome. It's obviously phishing - the mangled English and weird url give it away. How would it work? Asking me for info I shouldn't give them? My system then slowed down. ...
1
vote
1answer
155 views

Can SMS messages be traced when they come from a computer?

From Amazon SNS, I can send SMS messages to any mobile phone. To recipient phones, the SenderId is just a string of my choosing. The messages cannot be replied to. I receive quite a few phishing ...