3 ms·
This was a domain that didn't previously exist, right? Hence this falls just into the general category of phishing domains, rather than anything malicious happe
by gsnedders 8y ago
This was a domain that didn't previously exist, right? Hence this falls just into the general category of phishing domains, rather than anything malicious happening to get a cert issued.
- tialaramex 8y agoYes, the crooks probably "legitimately" owned this name (given that their line of work is stealing credit card details it seems plausible they'd have used stolen cards to buy the domain, but maybe not) It probably wouldn't have tripped as "phishing" unless the crooks were dumb enough to host false BA branding on it, rather than just an API to accept the stolen credentials. Because "BA" is so short and non-specific I'm doubtful that tools like Facebook's Certificate Transparency based "phishing warning" would have been useful here. And if you were an over-worked BA employee given 500 CT "phishing" warnings a day, what would you do? Visit the site in Chrome maybe? Then you see it has a generic holding page, no sign of phishing, you file it as a false positive, move on? How are you supposed to know it's being used by crooks?