5 ms·

>if i receive a (usually HMRC related) phishing email from a .gov domain https://www.ncsc.gov.uk/blog-post/active-cyber-defence-tackling-cyber-attacks-uk https

by lol768 9y ago

>if i receive a (usually HMRC related) phishing email from a .gov domain https://www.ncsc.gov.uk/blog-post/active-cyber-defence-tackling-cyber-attacks-uk https://www.ncsc.gov.uk/blog-post/active-cyber-defence-tackl... >We've already started some experiments in this area with pioneering UK SME Netcraft. They're off looking for phishing hosted in the UK, webinject malware hosted in the UK and phishing anywhere in the world that targets a UK government brand. When they find it, they ask the hosting provider to take down the offending site. It's surprisingly effective and again generates data we can use. We'll definitely do more in this space. I suspect you can forward these to scam@netcraft.com to get the upstream providers automatically notified and the site monitored until it's down.

morrbo 9y ago
It's not so much malware, it's mainly open relays which are being used to bypass spam filters on hotmail et al. due to coming from a "legit" .gov or .edu domain. It has been a while since i've received one though in all fairness. *edit - sorry just read it properly, both malware and generic phishing. Sorry! Even so though it would be really nice to have a streamlined process to go "hey, <shitty local council> has an open relay" whereby someone from within the UK gov could just forward on the email to the IT guy up there to at least make them aware of the issue.
- gm3dmo 9y ago
  The IT guy is attending DefCon on the council budget.
jstanley 9y ago
> I suspect you can forward these to scam@netcraft.com to get the upstream providers automatically notified and the site monitored until it's down. This is accurate. Source: worked at Netcraft until recently. Also, if the automated system rejects your report (Netcraft handles an awful lot of reports, false positives are unavoidable), reply to the rejection message explaining that you think it shouldn't be rejected and your message will be read and handled by a technical human.

by lol768 9y ago

morrbo 9y ago

It's not so much malware, it's mainly open relays which are being used to bypass spam filters on hotmail et al. due to coming from a "legit" .gov or .edu domain. It has been a while since i've received one though in all fairness. *edit - sorry just read it properly, both malware and generic phishing. Sorry! Even so though it would be really nice to have a streamlined process to go "hey, <shitty local council> has an open relay" whereby someone from within the UK gov could just forward on the email to the IT guy up there to at least make them aware of the issue.

gm3dmo 9y ago
The IT guy is attending DefCon on the council budget.

jstanley 9y ago

> I suspect you can forward these to scam@netcraft.com to get the upstream providers automatically notified and the site monitored until it's down. This is accurate. Source: worked at Netcraft until recently. Also, if the automated system rejects your report (Netcraft handles an awful lot of reports, false positives are unavoidable), reply to the rejection message explaining that you think it shouldn't be rejected and your message will be read and handled by a technical human.