Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Thanks FedEx, This Is Why We Keep Getting Phished (2024)

troyhunt.com

Post reply on HN
Print view View original

11–20 of 86 posts

Re: Thanks FedEx, This Is Why We Keep Getting Phished (2024)

#11

Post by cosmic_cheese »

walrus01 wrote: post #4

I swear, the proliferation of random ".xyz" type gTLD is not making things any easier in stopping non tech people from clicking on phishing links. There's so damn many of them. Sure, if they didn't exist people would use phishing domains like "fedex-secure-delivery-approval.com" or something, I suppose... List of top level domains: https://data.iana.org/TLD/tlds-alpha-by-domain.txt

The menagerie of TLDs is somewhat a necessary evil in my view. Prior to them it was becoming nearly impossible to get a decent domain, with most of them already having been laid claim to by squatters, big companies, and startups with VC money to burn.

Re: Thanks FedEx, This Is Why We Keep Getting Phished (2024)

#12

Post by inigyou »

walrus01 wrote: post #4

I swear, the proliferation of random ".xyz" type gTLD is not making things any easier in stopping non tech people from clicking on phishing links. There's so damn many of them. Sure, if they didn't exist people would use phishing domains like "fedex-secure-delivery-approval.com" or something, I suppose... List of top level domains: https://data.iana.org/TLD/tlds-alpha-by-domain.txt

This was a calculated project by ICANN to 1. bring lots more money to ICANN and 2. prevent decentralisation of the DNS root away from the control of the USA.

Re: Thanks FedEx, This Is Why We Keep Getting Phished (2024)

#13

Post by jhbadger »

It reminds me how at work we had to take a course hosted on our domain about how to recognize phishing and a few days later we got an e-mail from outside our domain saying we had to take a course about a different subject on their domain. We got an email from management a week or so later that complained that so few people had completed the new training -- because we all assumed it was a phishing attempt because it was exactly the sort of thing the phishing course talked about!

Re: Thanks FedEx, This Is Why We Keep Getting Phished (2024)

#14

Post by lemursage »

This is so weird, seeing this. Two years ago, I got a customs notice from FedEx asking to fill in my details. That was just a plain email from __some guy__ at FedEx with a PDF file attached. I wasn't expecting any package.

I wrote to their chatbot (of course, no human assistance) and after some time of "prompt engineering," or what one might call coercing, it finally directed me to a human consultant who confirmed it was indeed not a scam, and that it was indeed their messaging.

I opened the PDF, and it was pre-filled with someone else's data, with blank rectangles placed over fields in a bad attempt at redacting them (you could just move those rectangles around to reveal the underlying data).

The package later turned out to be a surprise from collaborators abroad. Years later, I still feel that scam aftertaste whenever I see the FedEx logo.

Re: Thanks FedEx, This Is Why We Keep Getting Phished (2024)

#15

Post by eventualcomp »

If I had a nickel for every post I saw on HN front page involving companies confusing people on phishing-like patterns today, I would have two nickels. Which is not a lot but still weird that it happened twice.

https://news.ycombinator.com/item?id=49172834

Re: Thanks FedEx, This Is Why We Keep Getting Phished (2024)

#16

Post by starky »

jhbadger wrote: post #13

It reminds me how at work we had to take a course hosted on our domain about how to recognize phishing and a few days later we got an e-mail from outside our domain saying we had to take a course about a different subject on their domain. We got an email from management a week or so later that complained that so few people had completed the new training -- because we all assumed it was a phishing attempt because it w…

We have a training thing at work that sends out phishing emails and you are supposed to report them using a handy button in the email app. If they are training emails you get a good job website that pops up. I greatly enjoy reporting every single genuine email that reads anything like a potential phishing email as there is someone in IT that reviews them and probably gets annoyed at the various groups sending sketchy emails for official business.

Re: Thanks FedEx, This Is Why We Keep Getting Phished (2024)

#17

Post by ddtaylor »

walrus01 wrote: post #4

I swear, the proliferation of random ".xyz" type gTLD is not making things any easier in stopping non tech people from clicking on phishing links. There's so damn many of them. Sure, if they didn't exist people would use phishing domains like "fedex-secure-delivery-approval.com" or something, I suppose... List of top level domains: https://data.iana.org/TLD/tlds-alpha-by-domain.txt

I'm not convinced that would help.

The problem is that large companies and government agencies are both misusing and NOT using the appropriate trust anchor - their fucking domain.

Its just attempting to work around incompetence, which always just shows up again somewhere else.

Re: Thanks FedEx, This Is Why We Keep Getting Phished (2024)

#18

Post by dqv »

walrus01 wrote: post #4

I swear, the proliferation of random ".xyz" type gTLD is not making things any easier in stopping non tech people from clicking on phishing links. There's so damn many of them. Sure, if they didn't exist people would use phishing domains like "fedex-secure-delivery-approval.com" or something, I suppose... List of top level domains: https://data.iana.org/TLD/tlds-alpha-by-domain.txt

For the past 2 years I've gotten backscatter from a phishing campaign that uses a domain I own in the from address. Every single domain they try to get the victims to click on is a .com

The most recent one is detention-unit.com, which probably does trick a lot of the people getting these phishing emails since the targets don't seem to speak English as a first language.

As an aside, an alarming number of server admins don't check SPF so these emails are actually getting into people's inboxes.

Re: Thanks FedEx, This Is Why We Keep Getting Phished (2024)

#20

Post by b112 »

inigyou wrote: post #10
kencausey wrote: post #6

In a recent example my step-mother, who is constantly getting cloud storage full scam emails, received an email from Google about 75% full storage that appears to be fully valid. However all the links use a domain c.gle and whois c.gle errors with "getaddrinfo(whois.nic.gle): Name or service not known". whois gle however does work. I was not sure of the validity of c.gle myself, my step-mother would have no idea.

Whois has been replaced by RDAP.

There are whois servers, and the whois command, so no, it has not.

I agree that this is the goal.

Post reply on HN