Gone (Almost) Phishin'

(ma.tt)

44 points | by luu 2 days ago

11 comments

  • JumpCrisscross 1 hour ago
    > Apple Support lives on apple.com and getsupport.apple.com, nowhere else.

    Meanwhile: “Microsoft support uses the following domains to send emails:

    microsoft.com

    microsoftsupport.com

    mail.support.microsoft.com

    office365support.com

    techsupport.microsoft.com” [1]

    [1] https://learn.microsoft.com/en-us/troubleshoot/azure/general...

    • throwaway290 41 minutes ago
      That's just for support. Legit password resets for example come from more random top level domains with "microsoft" in it, like microsoftonline.com

      Another fun one is facebook, they use facebookmail.com or whatever else for serious security stuff

      • CraigRood 24 minutes ago
        Is this because at one point <username>@facebook.com was a valid communication method? Great concept to be fair, but once you pull back the first layer you can immediately see its problems.
      • e40 27 minutes ago
        The number of redirects while using ms properties is just insane. It makes white listing them in uBO impossible because they redirect so fast, through multiple domains. The White listing is needed to sometimes make them work.
        • throwaway290 14 minutes ago
          It's a thing with google and facebook too. If you login to youtube or go to facebook account settings, at least 3 redirects through very random places. I guess 3 is not a lot compared to microsoft's 15.
  • olmo23 1 hour ago
    I told my parents: if they are ever called by anyone, to tell them "now is not a good time, please give me a case number and I'll call back when I do have the time."

    And then, this is important, look up the number for the customer service hotline online.

    I feel like this is a simple solution that works 100% of the time.

    • e40 30 minutes ago
      My dad googled “amex phone number” and called the first result. I spent most of a Saturday cleaning up after the scammers.

      I told him, next time call the number on the back of your card.

    • argee 34 minutes ago
      Mike Tyson once said "Everyone has a plan until they get punched in the mouth". I think you are underestimating the underhanded tactics and emotional tools available to scammers to keep you on the line.
  • ChrisMarshallNY 44 minutes ago
    Phishing has gotten really good, lately. As he noted, they will often re-use legit templates from the actual corporation. The email will be 99.9% legit, with maybe only one link being dodgy.

    I don’t think they can pass DMARC, though.

    My wife was almost scammed, a few years ago. What tipped her off, was how extremely good the “tech support” was. Real tech support is generally someone on a scratchy line, with a heavy accent, following an inappropriate script.

    Even after she backed away, they sent a few followup snail mails, looking somewhat legit (cheap printer).

  • metalman 2 minutes ago
    Currently my device has no passwords, and the only apps that lead to anything personal are browsers, and then sign into my website/email. I have eliminated online banking, except for allowing people to pay me through direct deposit, which I confirm on my once a week trip to an actual bank. Very occasional online purchases use a dedicated credit card. The above, I believe makes me a smol, challenging target, and I use the many many attempts to fish through, text, email, and voice, as practice sessions to refine my customer faceing presence, and answer all calls, and chearfully deflect anything or anyone that is not a legitimate human and/or customer, in under 10 seconds. Going forward I would train any office helpers to use the same methods on any work devices.
  • hk__2 1 hour ago
  • maplethorpe 1 hour ago
    The scammer sounds Australian, but he pronounces mobile as "mobil", like an American. I wonder if he's doing that intentionally to provide cover, or if he's worked with Americans so much in the past that it's changed his pronunciation.
  • xnx 24 minutes ago
    audit-apple.com is offline now. Is that something ICANN does, and if so, can they fix zombo.com?
  • tom-blk 31 minutes ago
    This is actually quite impressive and concerning
  • voidUpdate 1 hour ago
    Whats at the bottom of the page? It looks like it's meant to be brushstrokes or something?
    • ErneX 1 hour ago
      Yes, same as the logo / header.
  • firstrulephish 1 hour ago
    For the record, Apple will never call you first, but other services might. The REAL first rule of not being scammed should be stated

    "Thanks for the concern, I will call you right back"

    If your bank calls you, you turn off the call and call them. Don't take suggestions for contact address. You look them up, and you call them. Don't elaborate. The scammer is either and idiot and will try to call you telling to stop, or smart and fuck off. And if it was the bank, they'll at best, pick right back from where you left it, and at worst, learn better from the event.

  • mentalgear 1 hour ago
    This scam is scarily well made and what terrifies me is how easily scalable it is across sectors (e.g. your bank) and with AI voice clones (like in the attached video they mentioned the new 11lab generation).