3 ms·
Actually, we'd just see the web part of an attack on a hacked webserver, often with an wildcard EV cert. something.majorcorp.com/some/backwater/director/index.h
by indymike 3y ago
Actually, we'd just see the web part of an attack on a hacked webserver, often with an wildcard EV cert. something.majorcorp.com/some/backwater/director/index.htm. The funny part is the phish would look like something at UPS and be hosted on some airline site, so the advice to check the link was the best defense.
- fullspectrumdev 3y agoI still see this pretty much daily. Usually you find the mailer script (for spamming), a web shell, and a few different phish kits all under some directory. Also usually the captured credentials, etc. Sloppy work from the crooks, but it works.