Skip to main content
184 votes
Accepted

Why do phishing e-mails use faked e-mail addresses instead of the real one?

While one could create a mail with @amazon.com as SMTP envelope and/or From field of the mail header, the mail would likely be blocked since this domain is protected with Sender Policy Framework (SPF),...
Steffen Ullrich's user avatar
152 votes
Accepted

Company does not want any names on phishing reports

This initial campaign established a baseline first. So, yes, it's normal. "How do we as a company stand? To what level do we need to train? Do we have, as a whole, secure users or do we have, as a ...
baldPrussian's user avatar
  • 2,778
128 votes

Company does not want any names on phishing reports

No, because by giving names you are assigning blame, security needs to move away from blaming individuals and instead take it as a whole. It's the same as finding a security vulnerability in a web ...
McMatty's user avatar
  • 3,260
103 votes
Accepted

Why is a link in an email more dangerous than a link from a web search?

The results of a search engine are based on previously collected data; i.e. the engine does not start to scan the whole internet when doing a search, but it looks through an index of seen and stored ...
Steffen Ullrich's user avatar
101 votes

When is phishing education going too far?

I think there is an underlying problem that you will need to address. Why do the users care that they are failing? Phishing simulations should, first and foremost, be an education tool not a testing ...
schroeder's user avatar
  • 131k
97 votes
Accepted

What is the purpose of a targeted email without any meaningful content?

Attempting to send a message to a non-existant email address will typically result in a “bounceback” message with an error code like 510 or 550 invalid address. If you try several addresses and there ...
Relaxed's user avatar
  • 1,737
95 votes

Is there any definitive way to tell if an email is a phishing attempt?

There are a number of both technical and non-technical ways that someone can identify a phishing attempt. Communicate out of Band. The easiest reliable way is to communicate with the proposed sender ...
DKNUCKLES's user avatar
  • 9,217
86 votes

Why is a link in an email more dangerous than a link from a web search?

Let me use an analogy: It's for the same reason we tell our children not to take sweets from strangers, but at the same time we allow them to buy some in the supermarket with their pocket money. Or ...
Marcel's user avatar
  • 4,103
85 votes
Accepted

Is this account change PDF email (supposedly from Paypal) an exploit?

This is just regular malware spam. The evil part of this message is likely the attached PDF it mentions. It likely contains an exploit which targets a vulnerability in one or more PDF readers and ...
Philipp's user avatar
  • 49.5k
84 votes
Accepted

New Hires get phishing emails very quickly - Reasoning and how to stop

Presumably, your MX record is suffering from a directory harvest attack (DHA). There are lots of ways to do this and unless you're very savvy at pouring through your mail logs, most of them are (by ...
Adam Katz's user avatar
  • 11.9k
77 votes

Are there any security risks in replying to an SMS message?

Some telephone or SMS numbers allow for an additional charge that is automatically recovered by your phone provider and reversed to the owner of the number. This is mainly used (legally) for some TV ...
Serge Ballesta's user avatar
77 votes
Accepted

How could a scammer know the apps on my phone / iTunes account?

It's a game of probability and chances are high that you might have one of the most popular apps in history installed on your device. My guess is that the scammer does not know anything about you. ...
SeeYouInDisneyland's user avatar
76 votes
Accepted

Are non-English speakers better protected from (international) phishing?

There is a really, really good paper on this here. Tl;dr: 95% of spam is in English In f.ex. Germany only 17% of the spam is in German In Scandinavia it's less than 1% in the local language ...
AdHominem's user avatar
  • 3,026
59 votes

When is phishing education going too far?

We have been getting push back from end users that they have no way of distinguishing a legitimate email that they would receive day to day from truly malicious phishing emails. This is an indication ...
Blrfl's user avatar
  • 1,608
58 votes

Redacting URLs as an email-phishing preventative?

First of all, it would be a usability nightmare. Second, it wouldn't even fix the problem it purports to. While it could be effective to phishing mails designed for 'normal' clients, attacks designed ...
Ángel's user avatar
  • 19k
56 votes
Accepted

Another domain is using our web app's IP address. How to prevent it?

Our web application is being mimicked by another domain ... The domain in question is configured to resolve to the same IP address as yours. That's why it looks like they mimic you when in fact it is ...
Steffen Ullrich's user avatar
54 votes
Accepted

What is the purpose of hiding spam links in some obscure forum posts?

It could be an attempt to boost the spam sites in search engine results by creating backlinks to it, which is a common SEO technique (although debatable how effective it is, as search engines can ...
Gh0stFish's user avatar
  • 13.3k
50 votes

How to protect against SIM swap scammers?

You don't use SMS for a second factor. SMS is not secure by any means. The text is on clear, the traffic is on clear, and it's trivially easy to get a new SIM by pretending to be the victim. I once ...
ThoriumBR's user avatar
  • 54.6k
49 votes

Company does not want any names on phishing reports

I think the correct angle to look at this, is to ask the following question: With the amount of people that failed the test, what (security) goals would be accomplished if the company had these names?...
Tom K.'s user avatar
  • 7,991
48 votes

Apart from losing €40, is there any further risk if someone has my prepaid credit card number and home address?

Call the credit card company! They have procedures for this including blocking your credit card and replacing it. You might even be able to get the 40€ back. There is a lot of articles about this ...
Jester's user avatar
  • 663
47 votes
Accepted

What is the best way to respond to phishing emails sent from a government domain?

It is likely that the from header has been forged. I get emails from fake .govs quite often, mostly they end up in my spam filter. The hyperlink within is either unique, allowing tracking, or just ...
AstroDan's user avatar
  • 2,248
45 votes

Browser is accepting italic/bold Unicode as part of SPAM email's URL

Previous answers both tell part of the story here, but there's a few different aspects to understand. Firstly, why do these code points exist? Unicode has the ambition to replace all previous ways of ...
IMSoP's user avatar
  • 3,910
40 votes

Is it ever safe to open a suspicious HTML file (e.g. email attachment)?

Editors, and common libraries used by editors, may have vulnerabilities like buffer overflows. Your attacker would need to know (or guess) what editor you use and craft an exploit specifically for ...
Thomas's user avatar
  • 509
38 votes
Accepted

Why doesn't Gmail make it clearer that emails have been signed by DKIM and delivered over TLS?

TL;DR: Mail delivery using TLS and signing using DKIM are weak protections, compared to accessing a web site using HTTPS. They should not be assumed to provide the same security and the indicators ...
Steffen Ullrich's user avatar
37 votes
Accepted

Is it illegal to DDoS a phishing page?

If you do a DDoS by sending large amounts of traffic to that site, you're very likely creating a lot of collateral damage since other services in (parts of) the network will suffer as well if the ...
Teun Vink's user avatar
  • 6,938
36 votes

When is phishing education going too far?

There's one possible point to make that I haven't seen in other answers, but have seen in the real world. Users say they "have no way of distinguishing a legitimate email that they would receive day ...
James_pic's user avatar
  • 2,736
36 votes

Is a safelinks.protection.outlook.com link phishing?

Depending whether this is an organizational email or Outlook.com, it's one of the following: Office 365 Advanced Threat Protection ATP Safe Links. Advanced Outlook.com security for Office 365 ...
Esa Jokinen's user avatar
  • 19.1k
35 votes
Accepted

How can I trust that this is Google?

How do I trust that I am typing my password for google You do not. Apps should allow you to do that through actual Safari browser in another window, where you can see the address bar.
Greendrake's user avatar

Only top scored, non community-wiki answers of a minimum length are eligible