4 ms·
I'm not a huge fan of these phishing-test exercises. I run the service at https://urlscan.io https://urlscan.io which a lot of folks use regularly to check out
by heipei 6y ago
I'm not a huge fan of these phishing-test exercises. I run the service at https://urlscan.io https://urlscan.io which a lot of folks use regularly to check out suspicious links in mails / chat messages. I've been approached by some of these phishing-test companies asking me to prevent scanning their domains/IPs. They flat-out told me that they weren't happy about users using my service to check the link, which I always found odd, and I never got an explanation for it. Probably less spectacular findings for these companies if users can figure out a phishing test by themselves...
- WrtCdEvrydy 6y ago> Probably less spectacular findings for these companies if users can figure out a phishing test by themselves... It's the same issue as "ad companies"... if you don't cook the numbers that show your expensive service is worth it, then people will switch to the service that looks worse (this one has 7% fail rate but this one has 50% fail rate)
- tikkabhuna 6y agoPerhaps they should look at doing integration that shows how much urlscan.io is blocking the phishing test companies?
- duckmysick 6y agoWhat are the legitimate cases for excluding the domains from your scanning service?
- heipei 6y agoNot many, I usually only do it when the domain or URL pattern in question is almost exclusively used for sessions/invites/sharing-links and basically every URL submitted leaks either a customer name and/or invite-token and/or PII. zoom.us is a good example, certain DocuSign URL patterns, the sort of thing where knowing the URL gets you a sensitive document, etc.