Security of Web Addresses

[ewmayer]

Originally Posted by retina

You could also combine all of the techniques mentioned above to make an URL using redirection via a legit site, with an obscuring authentication prefix, and a spoofed target domain, with a faked "from" field to make it really hard to know where it is really going. That is why the standard advice is to NEVER CLICK ON LINKS IN AN EMAIL.

Right - the hovertext trick should be used to screen which link-containing e-mails *might* be legit, in which case copy-link/paste-into-browser-url-field for closer examination. I've found most phish-mails which somehow make it past my upstream spam filters don't even bother to disguise the underlying url, and as noted, Mac Mail is nice because, at least in my older pre-iOS-dominating-osx-development version, it is geared toward the desktop rather than tiny-screened mobile devices and thus does not 'helpfully' shorten hovertext-displayed links.

And any e-mail claiming you need to do something with one of your online accounts, if legit, should be confirmed by logging in to said account and checking one's Messages Inbox.

[ewmayer]

Originally Posted by ewmayer

Right - the hovertext trick should be used to screen which link-containing e-mails *might* be legit, in which case copy-link/paste-into-browser-url-field for closer examination. I've found most phish-mails which somehow make it past my upstream spam filters don't even bother to disguise the underlying url, and as noted, Mac Mail is nice because, at least in my older pre-iOS-dominating-osx-development version, it is geared toward the desktop rather than tiny-screened mobile devices and thus does not 'helpfully' shorten hovertext-displayed links.

Spoke too soon - just got a "has your private information been sold on the dark web?" e-mail purporting to be from my e-mail provider, with text and embedded link as shown in the attachment. This one superficially looks legit, no obvious url-redirect in the long url string. But I am 99.9% sure it's a phish, based on the following:

1. url domain is aol.net, not aol.com;

2. There is not "...or, log in to your AOL account..." instruction by way of for-those-wary-of-clicking-links-in-e-mails.

In any event, I'm not interested in the purported service, thus saving me the trouble of logging in to my aol.COM webmail account to check the messages-from-team-AOL there.

[sdbardwick]

aol.net has the same registry information as aol.com

Might actually be legit, albeit stupid to use .net instead of .com.

[retina]

Originally Posted by sdbardwick

aol.net has the same registry information as aol.com

Might actually be legit, albeit stupid to use .net instead of .com.

If might not be aol.net either. Check for Unicode characters, perhaps the o is a Cyrillic o, or some other spoof domain.

Haven't you guys been reading anything in this thread!

[retina]

Try these links, if you dare:

http://aoI.net
http://aoI.com
http://rnicrosoft.com
http://wikipеdia.com
http://googlе.com

Moderator's note: Please examine them, but do not click on them. They are being left clickable so that the user may hover over them and see what happens.

[sdbardwick]

None look legit on my hover equivalent (popup bar at bottom of window), although "microsoft" comes close.

[ewmayer]

Originally Posted by retina

If might not be aol.net either. Check for Unicode characters, perhaps the o is a Cyrillic o, or some other spoof domain.

Haven't you guys been reading anything in this thread!

Here is the actual url in question - examine via copy/paste or left-click, but click at your own risk:

https://email.aol.net/T/v41000001710...vSuucQg6-5-uNY

[sdbardwick]

It goes to https://productcentral.aol.com/produ...on-by-aol-dark

I truncated the above url after the ? for posting here. It set a member number something called ncid

But now AOL thinks Ernst is interested in their product

[retina]

Originally Posted by Uncwilly

Please examine them, but do not click on them. They are being left clickable so that the user may hover over them and see what happens.

Also email them to yourself and see how your client handles them.

Would they easily fool you or your friends? What about when you are tired, drunk or distracted, then could they fool you?

[ewmayer]

Originally Posted by sdbardwick

It goes to https://productcentral.aol.com/produ...on-by-aol-dark

I truncated the above url after the ? for posting here. It set a member number something called ncid

But now AOL thinks Ernst is interested in their product

That's alright - it's for science!