3 ms·

What I do in my emails is tell them the exact URL of the bad page. All they need to do is look at the file with a text editor (they are admins, after all). Once

What I do in my emails is tell them the exact URL of the bad page. All they need to do is look at the file with a text editor (they are admins, after all). Once they have done this, they will see strange Javascript. They will know it has nothing to do with their own (or their clients) web pages. There are no links per se in my email (except the URL, but I leave off the http:).

robocat 8y ago
Don't you worry that if you email spammy/virus-laden links then your email address could get flagged?
- Zach_the_Lizard 8y ago
  Perhaps using a dedicated email for these sorts of reports could limit the damage if that were to happen. It would probably increase the chance of being flagged, though.
- tonyztan 8y ago
  I've worked as a security analyst at a company and sometimes I would report phishing pages to the webhost. After a while, I realized that half of my emails were being silently quarantined by the company's outbound spam filters due to the included URLs. I was able to manually release them, but I wonder how many emails will then be flagged on the receiving end.
  - sohex 8y ago
    Typically when sending an email with content like that for a notification you'll "defang" the URL by rendering it like "hXXp:// foo (dot) bar (dot) com" or something along those lines to ensure that it isn't automatically flagged and filtered, though it's also common on the receiving end to apply no spam filters to their abuse@ email as well. You'll usually have better luck sending this information to the abuse email listed in the IP whois than to any contact information at the domain itself.
    - knodi123 8y ago
      > you'll "defang" the URL Wow, that's a phrase I haven't heard in ages.
      - gerdesj 8y ago
        This is the business: https://en.wikipedia.org/wiki/MIMEDefang https://en.wikipedia.org/wiki/MIMEDefang
buahahaha 8y ago
Most site admins aren't really aware/in-charge of the javascript on their pages. Most webmaster@ or admin@ e-mails aren't monitored at all, or so flooded with spam that it's easy for things to get lost.

robocat 8y ago

Don't you worry that if you email spammy/virus-laden links then your email address could get flagged?

Zach_the_Lizard 8y ago
Perhaps using a dedicated email for these sorts of reports could limit the damage if that were to happen. It would probably increase the chance of being flagged, though.
tonyztan 8y ago
I've worked as a security analyst at a company and sometimes I would report phishing pages to the webhost. After a while, I realized that half of my emails were being silently quarantined by the company's outbound spam filters due to the included URLs. I was able to manually release them, but I wonder how many emails will then be flagged on the receiving end.
- sohex 8y ago
  Typically when sending an email with content like that for a notification you'll "defang" the URL by rendering it like "hXXp:// foo (dot) bar (dot) com" or something along those lines to ensure that it isn't automatically flagged and filtered, though it's also common on the receiving end to apply no spam filters to their abuse@ email as well. You'll usually have better luck sending this information to the abuse email listed in the IP whois than to any contact information at the domain itself.
  - knodi123 8y ago
    > you'll "defang" the URL Wow, that's a phrase I haven't heard in ages.
    - gerdesj 8y ago
      This is the business: https://en.wikipedia.org/wiki/MIMEDefang https://en.wikipedia.org/wiki/MIMEDefang

buahahaha 8y ago

Most site admins aren't really aware/in-charge of the javascript on their pages. Most webmaster@ or admin@ e-mails aren't monitored at all, or so flooded with spam that it's easy for things to get lost.