A real example of phishing

We have already discussed how phising can damage your website, blog or e-commerce and your online reputation. We also gave you some tips as a user. But this time we go one step further. We teach you and help you detect step by step a real example of phising.

Having a security maintenance in your site is the basics, but not the only thing. Additionally it is necessary to continually review new vulnerabilities and deception attempts that could steal data, infect your pc or laptop and in the end, infect your site, WordPress, Joomla or Prestashop. Steal data, you? Yes, it is becoming more common, not only direct attacks on your website, but also online scams.

We all take very seriously mails from any of our suppliers, especially those of payment gateways. And precisely those domains, those of banks and anyone who provides account data related to money, are the most used to do phising.

Let’s see a real example and explain the keys to detecting the scam.

What should make you suspect phising?

Recently a member of the WeSecur team received an email from “Paypal”:

Phising Signal 1: the domain of the one who sends the mail is not paypal. It is an email sent from surveymonkey.

Ok, maybe you have not noticed. Let’s go to the next step. If we click on the link to solve the alleged ‘problem’ it opens a screen like the one shown below. We show you the view in Chrome and Firefox.

Chrome 

Firefox

Phising signal 2: In both cases the NON-SAFE SITE alert is displayed. What’s more, you specify the web domain and as you can see in the firefox view clearly, it has nothing to do with Paypal.

It is time to access the actual Paypal page. This way we will see if the page is legal and we can compare the content. Note that:

• It is specified that the site is not secure
• The domain, as it can not be otherwise, is paypal.com

Phising signal 3: if you check the domain opened after clicking on the link of the email received with the real domain (paypal.com in our case) and are not equal, it is probably a scam. Be aware that if your computer (or mobile) has been infected you may be ‘seeing’ the real domain and you are actually accessing a false site.

As we commented, in this case, in addition, the fake site is very similar to the original. The logo, the fields to be filled and the actions. Even the message ‘Having trouble logging in?‘. Although on the phising page is in italics. But this detail may go unnoticed. So it is very likely that most users in that case enter the data become a victim of the attack.

Conclusions to avoid becoming a victim of phishing

In this case, in which you receive an email from a suspect sender, the three ways to account for the phishing attempt are:

• Always check the origin of the mail
• When you access a link, verify that it is a secure site
• Always compare it with the real domain of the alleged sender

Remember that any vulnerability, theft of data or deception that can be made to you, arrive sooner or later to your website. Maybe because you use the same password, because they infect the laptop from which you access or because it is your site that they are using to do phising.