Deceptive example for malicious usage of .zip domain

Post by nullindividual » Fri, Jun 23, 2023, 4:48 AM UTC

fragmede wrote: post #27

yathern wrote: post #5

Cool trick - they're using HTTP auth URLs[1] so that the @ sign is doing a lot of the heavy lifting (plus some clever unicode slashes). It's an old school phishing trick, with the additional layer of looking like a genuine zip file. Not sure if this trick would be too effective in real life, Firefox and likely others will give you warnings when logging into a site like this, as this form of HTTP auth is way deprecate…

Side note: someone's using http://yourmom.zip for hilariously nerdy purpose

Post by gravypod » Fri, Jun 23, 2023, 5:43 AM UTC

yathern wrote: post #5

Cool trick - they're using HTTP auth URLs[1] so that the @ sign is doing a lot of the heavy lifting (plus some clever unicode slashes). It's an old school phishing trick, with the additional layer of looking like a genuine zip file. Not sure if this trick would be too effective in real life, Firefox and likely others will give you warnings when logging into a site like this, as this form of HTTP auth is way deprecate…