www.phishing.com
Open in
urlscan Pro
141.193.213.10
Public Scan
Submitted URL: http://www.phishing.com/
Effective URL: https://www.phishing.com/
Submission: On November 14 via api from JP — Scanned from JP
Effective URL: https://www.phishing.com/
Submission: On November 14 via api from JP — Scanned from JP
Form analysis 1 forms found in the DOM
Name: url_form — POST #
<form id="url_form" style="width: 49%; margin-left: 26%;" action="#" method="post" name="url_form">
<h1><label style="font-size: 18px;" for="domaininput"><b>Check a URL, IP or Domain for fraudulent activity:</b></label></h1>
<div style="display: flex;">
<div class="input-group input-group-lg" style="width: 100%; display: inline;"><input id="domaininput" class="form-control ng-pristine ng-valid ng-touched" style="border-bottom-left-radius: 5px; border-top-left-radius: 5px; height: 1px;"
type="text" placeholder="Insert URL, IP address or domain name here" aria-label="Recipient's username" aria-describedby="button-addon2"></div>
<div id="submit_button" class="input-group-append" style="margin-left: -7%; display: inline;"><button id="button-addon2" class="btn btn-outline-secondary" style="margin-left: 35%; height: 42px; padding-top: 11px;" type="button">Submit</button>
</div>
</div>
<div id="response" class="alert alert-success" style="padding: 1%; border-radius: 5px; font-size: 1.15rem; font-weight: 400; line-height: 1.5; color: #212529; text-align: left; margin-top: 7px; width: 107%;"> </div>
<p></p>
<div id="loader" class="loader" style="display: none; margin-left: 40%; margin-top: -7%;"> </div>
<div id="myOverlay"> </div>
<p>
<script>
var inputDomain = document.getElementById("domaininput");
jQuery('#domaininput').keypress(function(event) {
var keycode = (event.keyCode ? event.keyCode : event.which);
if (keycode == '13') {
submitUrl();
return false;
}
});
function submitUrl() {
jQuery('#response').css("display", "block");
var domaininput = document.getElementById('domaininput').value;
if (/(http(s)?:\\)?([\w-]+\.)+[\w-]+[.com|.in|.org]+(\[\?%&=]*)?/.test(domaininput)) {
jQuery('#response').css("display", "none");
jQuery('#myOverlay').show();
jQuery("#loader").css("display", "block");
var sendInfo = {
url: domaininput
};
jQuery.ajax({
type: "POST",
accept: "text/plain; charset=utf-8",
contentType: "application/json",
url: "https://phishing-com-api.bp.opsecsecurity.com/url",
data: JSON.stringify(sendInfo),
success: function(data) {
jQuery('#response').css("display", "block");
jQuery('#myOverlay').hide();
if (data.status == "red") {
jQuery("#response").text(data.message);
jQuery("#response").css("background-color", "#f8d7da");
jQuery("#response").css("color", "#73242b");
}
if (data.status == "yellow") {
jQuery("#response").text(data.message);
jQuery("#response").css("background-color", "#fff3cd");
jQuery("#response").css("color", "#926904");
}
if (data.status == "green") {
jQuery("#response").text(data.message);
jQuery("#response").css("background-color", "#d4edda");
jQuery("#response").css("color", "#2e7251");
}
jQuery("#loader").css("display", "none");
},
dataType: "json"
});
} else {
jQuery("#response").text("Please enter a valid URL, IP or domain");
jQuery("#response").css("background-color", "#d6d8d9");
jQuery("#response").css("color", "#000000");
setTimeout(function() {
jQuery('#response').text("");
jQuery('#response').css("display", "none");
}, 2000);
clearTimeout();
}
}
</script>
</p>
</form>Text Content
* Skip to main content Phishing.com powered by OpSec Security Menu * FAQs * Glossary * Blog * Contact This website is brought to you by OpSec Security as a resource to build awareness about phishing threats. CHECK A URL, IP OR DOMAIN FOR FRAUDULENT ACTIVITY: Submit WHAT IS PHISHING? Phishing is a form of social engineering, which involves gaining the trust of a victim and then tricking them into divulging personal information or performing an action that would normally raise a red flag. Most commonly, phishers will communicate trust to the targeted victim by piggybacking on the good reputation of other organizations or groups. Communications often include well known logos or text that encourage the user to: * trust the source of the communication * believe the intentions of the communication are genuine and legitimate (ex. an email stating that the victim’s account is locked and to click a special link to unlock it) The social engineering aspect of phishing presents itself in scenarios where phishers appeal directly to a victim’s sympathy or desire to help others. This type of “lure” is demonstrated in emails where the sender explains his/her dire situation and needs assistance. Most phish rely on creating a sense of urgency or strong emotional reaction to trick victims into forgoing the typical due diligence that would otherwise prevent them from clicking on a suspicious link. Language such as “you must act now” or “click here to prevent child abuse” are tempting to click on. However, those are merely distractors, so the victim doesn’t notice obvious phishing signs, such as misspellings in the email or suspicious domains in the link URL. Fake receipts and invoices are an increasingly effective way to surprise the victim and trigger a knee-jerk reaction of clicking a link before checking its validity. COMMON TYPES & TECHNIQUES Phishing comes in many forms. The most common type comes in the form of email phishing, when attackers send emails to potential victims. These emails can be anywhere from generic in nature (i.e. Click here to login to your webmail) to highly customized and directly targeting an organization (i.e. Click here to view your receipt for your recent purchase from a company’s website). Additionally, other forms of phishing, such as spear phishing and whaling, represent specialized forms phishing – either targeting a small number of people or a single high value target. Not all phishing is done via email. With the increasing popularity of mobile phones and SMS/text messaging, three new forms of phishing have emerged – voice-based phishing (vishing), SMS-based phishing (smishing), and QR code phishing (quishing). As their names imply, vishing and smishing are similar to normal phishing, except done via phone – these attacks may leave a message requesting a call back or ask the victim to click a URL. They can also involve a call center full of attackers hoping the victim answers the phone. Quishing involves sending the victim a benign looking QR code in hopes they will go to the malicious URL it represents. As with typical phishing, all three of these methods share a common goal – to convince the victim to divulge personal information or perform an action that could be detrimental to them. Due to the reduced screen size and lack of cursors, mobile devices often truncate or hide parts of the URL, which can make identifying a phishing link more difficult or impossible – especially when trying to hover over a “login here” button to determine the destination. A phishing message typically contains a link that takes the victim to a phishing website. To reduce suspicion, phishers often employ the following techniques: Obfuscate links using look-alike domains banknamee.com or c0mpany.com Add a brand name into the URL or domain bankname.mydomain.com mydomain.com/BankName-login-here/ Attempt to confuse the user by using very long links and/or legitimate keywords mydomain.com/secure/login/account/unlock/crypto/ Use legitimate redirectors to redirect the victim to the website bit.ly/123456 which redirects to mydomain.com/BankName-login-here/ Hide the destination of the link through html Legitimate “login here” link takes the victim to mydomain.com/BankName-login-here/ Make use of domain homoglyphs, which are characters that look alike but are part of two different character sets bankname.com (legitimate) versus bänkname.com or bånkname.com (both are fake, but visually look very similar) THE RISE OF PHISHING Originating in the late 1980’s, phishing has continued to grow as new technologies become available to bad actors. A new study shows that phishing attacks rose 61% in 2022. Phishing consistently remains the most prevalent cause of breaches and unauthorized access to controlled systems. As more companies and individuals move toward centralized computer systems, those systems become more attractive to attackers. Since 2000, the number of phishing cases has steadily risen, resulting in increased payouts, larger organizations being targeted, and derivations of phishing becoming more popular. The most popular derivations of classical phishing emails, vishing and smishing, have seen a drastic increases in popularity since 2019. They are extremely effective social engineering-based methods that take advantage of mobile phone users through direct calls or SMS messages. Typical phishing bait, which is communicated via email, is under increased pressure as spam filters and secure email gateways become more intelligent and filter out emails prior to them reaching the end user. However, since vishing and smishing are communicated via mobile phone, they sidestep the typical filtering systems. PROTECTION AGAINST PHISHING There are many methods that can be utilized to decrease the impact of phishing attacks. Education * Because social engineering is at the heart of phishing, vishing, and smishing, educating users on how to recognize fraud is an important method of prevention. * Companies may utilize phishing training simulations, which include bait emails sent to entice employees to click a URL. This tests the employees to verify if training is working or if additional training is required. * Teaching users better email protocol helps them identify bad inbound emails and avoid creating emails with a potentially suspicious link. Email filtering Many organizations leverage machine learning and intelligence to pre-filter incoming email. This greatly reduces the number of suspicious emails presented to users. Emails that fall into the gray area between good and bad can be quarantined or displayed differently to the user to indicate that extra care should be exercised. Multi-factor authentication Since a typical phishing site gathers static information such as a username and password, many organizations add a dynamic form of authentication called multi-factor authentication. The user must present two or more credentials to verify their identity before they can login. However, phishing has become more intelligent and can simulate the workflow of the multi-factor token generation. Blocking and shutting down fraudulent sites and phone numbers * Since typical phishing messages contain a link to a phishing website, the threat can be eliminated by shutting down the website. An individual or company can report a phishing site to a domain registrar or network provider, who can perform the shutdown. * Similarly, a vishing or smishing threat can be eliminated by an individual or company reporting a phone number to a telephone company, who can perform the shutdown. * Browser operators can block links to phishing sites or warn visitors that the site may be dangerous. * In rare cases legal action is leveraged against responsible entities to force fraudulent content to be taken down. LATEST BLOG POSTS OPSEC® EARLY WARNING SYSTEM IDENTIFIES EMAIL SCAM THREATS opsecsecurity May 11, 2021 OpSec Security provides world-class threat intelligence and reduces risks from fraudulent business email scams. London, UK, & Philadelphia, US, May 12, 2021 – OpSec Security, the leading provider of a complete solution to combat online brand-related threats, is announcing the advanced OpSec® Early Warning System reporting and OpSec® AntiFraud Monitoring service, part of the OpSec® AntiPhishing… Continue Reading OpSec® Early Warning System Identifies Email Scam Threats WHY SSL CERTIFICATES HAVE BECOME THE NEW FRONTIER OF PHISHING opsecsecurity August 18, 2020 In 2020 so far, over half of all phishing sites the OpSec Online AntiFraud Security Operations Center have detected have an SSL certificate associated with the site. How much value do consumers place on the presence of a security certificate on a website? From my very scientific Facebook poll of non-industry friends and family, the average user… Continue Reading Why SSL Certificates Have Become the New Frontier of Phishing PREPARE TO BE SCAMMED: HOW PEOPLE CAN MAKE THE DIFFERENCE opsecsecurity March 25, 2020 The year 2020 came in with a bang and it hasn’t let up yet. From the UK’s Brexit initiative, the US Presidential election primaries, a multitude of other celebrity or sports-related shocking news, and then culminating in the COVID-19 pandemic, collectively consumers have been facing a multitude of external uncertainties affecting their daily lives. Unfortunately,… Continue Reading Prepare to be Scammed: How People Can Make the Difference Copyright © 2022 OpSec Security, All Rights Reserved | Modern Slavery Statement | Privacy Policy | Terms of Use | Contact Us