Phishing emails

By joining our community you will have the ability to post topics and access other forums reserved for members. Registration is quick, simple and absolutely free. Join our community today by clicking here.

Posted: Tue Mar 29, 2016 7:08 am

What's the policy on baiting hacking attempts? I'm getting more than ever in my catcher account.

We could have a short, sharp laugh if they are still on the menu.

Posted: Tue Mar 29, 2016 8:14 am

We'r avoiding them for now. There really isn't a satisfactory way to bait them. They want a phone call after you click the malware link.

Posted: Tue Mar 29, 2016 10:07 am

Thanks Capone.

Pity, because they could do with a bit of a kicking.

Posted: Sun Apr 03, 2016 7:05 pm

I am new here, but I joined match.com a month ago and have been Phished a few times. I created a multitude of email accounts, and I assign one to anyone who wants "my email"
A few days later, an unsolicited email arrives.

*******
Hi Again,

Remember me?I know it's been a while. We met on match a week ago. I was suppose to write to your email but i have been a little bit busy with work . But been able to get my work done so i am free for now and will be able to talk more. that is if you still want to. Just in case you are not sure of who i am. You can check my match profile . Just click on the link to my profile below and it will be redirected to my profile if you are signed in.I will be looking forward to your reply..

http://www.match.com/checkonlineprofile/singlesno73

*******

I now know their Match profile, their gmail account, and a link to their credential harvesting website.
I then take a few minutes to report the Phishing emails/site to Match (with the actual profile of the sender), Gmail security team has a hard on for anyone using a gmail account for Phishing, and then to netcraft.com and a few others...

I am amazed how fast it all comes down for them ! Within a few hours, browsers are warning people of the "content ahead" Email accounts are dead. The sites are often hidden on legitimate sites, and when the Webmaster gets his "hi, it's google... we are now listing you as a..."
they tend to shut down these sites pretty quick.

Like I said, I am new here, but at least that's a kick ?

You can actually get swag if you find enough of them...
http://news.netcraft.com/phishing-report-competition/

I use an Ipad to follow the links, because it's bullet proof, and will just crash the browser if there is any malicious code. The first time it happened, I repeatedly returned to the link, and entered about 150 usernames, and extremely long passwords.... I don't think they can paste into the actual sign in.... So.. they might have found that annoying ?

Any suggestions would be enjoyed !

PS This is the funniest forum I have ever wandered through ! Absolutely brilliant stuff.

Posted: Sun Apr 03, 2016 8:34 pm

^ Thank you, we aim to please. Have you considered blowing up bank accounts and fake bank websites? It sounds like you'd enjoy that.

Posted: Sun Apr 03, 2016 8:42 pm

I read somewhere in here that someone wrote some code to "solve a problem"

It occurs to me that it would be really handy if we had a "lure" for these
credential harvesting sites. Instead of my clumsy manual attempts to flood
their fields with garbage, what if we had a tool ?

The idea would be something like a DOS, but in this case.. "denial of scam"
A simple bit of script that would flood the site with random bogus long winded usernames and passwords. Maybe a few thousand in the few days it takes to get the site flagged or shut down. obfuscation of any real data ?

Is there anyone that could write such a thing ?

Posted: Sun Apr 03, 2016 8:49 pm

Sounds a bit like a flooding attack to me, which we don't do.
Do take a moment to look through the house rules. We don't allow hacking, phishing, DOS/DDOS attacks, malware payloads or anything similar. It's very important that we stay upright and legal, otherwise our credibility with banks and LE would suffer.

Plus, bandwidth is so cheap that you'd need an actual botnet to cause any kind of problem, and that's properly black-hat. Don't go there.

Bank accounts and fake bank site killing require none of these, it's all human intelligence work so it's all very straightforward.

Posted: Sun Apr 03, 2016 9:21 pm

Nailgunner wrote:

It's very important that we stay upright and legal, otherwise our credibility with banks and LE would suffer.

You make an excellent point !

My fighting fire with fire instincts must come from gaming forums Smile