3 ms·

+many Very sad that legitimate emails are often so bad that even after researching for 10-15 minutes I cannot be sure if a message is legitimate or not. And I'

+many Very sad that legitimate emails are often so bad that even after researching for 10-15 minutes I cannot be sure if a message is legitimate or not. And I'm working with email professionally (as sysadmin/SRE) for more than 10 years. Regular email users who are not email expects can either trust all emails or delete most of them. Security trainings which tell don't open suspicious emails are useless because most emails are suspicious. PayPal, many utility providers even some big banks send very suspicious emails. A typical example of fishy but legitimate emails is when company with the main domain example.com send emails from a different but similarly looking domain e. g. example-invoices.com and: whois is hidden using whois privacy, there is no website on this domain (even if there is - why should I trust it?), infrastructure is completely different from the main domain. In other words example-invoices.com have nothing in common with example.com the only way I can think example-invoices.com is legit - they know some personal data of a recipient but if you're paranoid you can expect this to come from a breach which nowadays are common.

quitit 5y ago
When businesses out source part of their operations to a 3rd party it's often challenging and slow to get a proper system in place. Instead the 3rd party and company will agree to register a similar looking domain, and thus the problems begin. This is incredibly common with short-lived projects such as a promotional website, or after downsizing with expert services such as legal/financial/support being awarded on contract. It's also very common with local subsidiaries of larger companies. Where the website is run from HQ, and the local regions have no ability whatsoever to plug into that system.
a3n 5y ago
> Regular email users who are not email experts can either trust all emails or delete most of them. I do the latter. Default practice these days should be do not respond to any phone call, text, email etc. if you don't recognize it, and if you have a non-personal relationship to what appears to be the sender, don't answer it unless it's a response to your initial communication. Communications these days are mostly vans with candy and missing puppies. Based on my spam folder and incoming call records anyway.
- jimmygrapes 5y ago
  Your candy van's extended warranty is about to expire!

quitit 5y ago

When businesses out source part of their operations to a 3rd party it's often challenging and slow to get a proper system in place. Instead the 3rd party and company will agree to register a similar looking domain, and thus the problems begin. This is incredibly common with short-lived projects such as a promotional website, or after downsizing with expert services such as legal/financial/support being awarded on contract. It's also very common with local subsidiaries of larger companies. Where the website is run from HQ, and the local regions have no ability whatsoever to plug into that system.

a3n 5y ago

> Regular email users who are not email experts can either trust all emails or delete most of them. I do the latter. Default practice these days should be do not respond to any phone call, text, email etc. if you don't recognize it, and if you have a non-personal relationship to what appears to be the sender, don't answer it unless it's a response to your initial communication. Communications these days are mostly vans with candy and missing puppies. Based on my spam folder and incoming call records anyway.

jimmygrapes 5y ago
Your candy van's extended warranty is about to expire!