11–20 of 44 posts
The trick here is the "@" in the URL, which makes everything before it a user name. It is an old trick, and browsers tend to throw a fit before opening URLs with user names.
How is this different from paypal.com@notpaypal.com?
What you have in your comment is an email address, where anti-phishing training has hopefully helped users to identify non-authentic or at least suspicious domains. We (should) know to look at the part after the "@" in an email. This trick is a URL, not an email address. It looks like a valid URL, because we are accustomed to checking the hostname for authenticity. But the URL in the post is crafted to look like the…
Here's the original source by the author: https://scribe.rip/@bobbyrsec/the-dangers-of-googles-zip-tld... While I think that we really don't need a .zip domain, this trick falls apart when not shown as an image. Hovering over either URL should tip you off. Firefox shows the actual link in the bottom left.
Most people don't even know what a URL is, let alone how to discover this kind of deception by looking at the hover info.
Citation?
How is this different from paypal.com@notpaypal.com?
What you have in your comment is an email address, where anti-phishing training has hopefully helped users to identify non-authentic or at least suspicious domains. We (should) know to look at the part after the "@" in an email. This trick is a URL, not an email address. It looks like a valid URL, because we are accustomed to checking the hostname for authenticity. But the URL in the post is crafted to look like the…
How many regular users are going to know the real tdl of the below link? Two subdomains one containing many fake slashes.
paypal.com/long/path/to/my/account/.my-evil-invoices.com/transactions.csv
Earlier quoted context omitted.
There are lots of contexts where you can't use an href tag. Twitter maybe?
This may be a twitter problem, but it is not a web problem.
Pretty much any chat application
Pretty much any website that allows comments, like HN
I get a: "404: Not Found" from the site "codeload.github.com"
Cool trick - they're using HTTP auth URLs[1] so that the @ sign is doing a lot of the heavy lifting (plus some clever unicode slashes). It's an old school phishing trick, with the additional layer of looking like a genuine zip file. Not sure if this trick would be too effective in real life, Firefox and likely others will give you warnings when logging into a site like this, as this form of HTTP auth is way deprecate…