3 ms·

Another entry in "Marketing department starts a promotion campaign for the new product that's indistinguishable from a phishing attack" list. Starting with not

Another entry in "Marketing department starts a promotion campaign for the new product that's indistinguishable from a phishing attack" list. Starting with not using a subdomain on your own, very well-known domain but instead using a completely different one, then not having it shown with the rest of your services on your main web site, et cetera.

make3 3mo ago
this is the correct take
derektank 3mo ago
You really would think that at least in theory a company like Cloudflare would make it very easy for internal teams to automatically request new subdomains
- nerdsniper 3mo ago
  Running marketing off a separate domain is often a conscious decision because if they start getting blocked for spam, then critical service/operational emails from your actual domain might also get blocked.
  - saghm 3mo ago
    Oh good, I'm glad that Cloudflare, proud defender of internet security, is properly focused on the important goal of optimizing for their ability to send promotional emails to my inbox rather than silly things like helping prevent phishing attacks.
raesene9 3mo ago
Same Story as it ever was. The first time I encountered what I thought was a phishing attack at the bank I worked at 25 years ago, it turned out to be a marketing campaign, with URLs that put our company name as a user before the domain name (back in the day when creds could go in the URL).
- ericlaw 3mo ago
  Fun fact: still can in Chromium-based browsers. https://textslashplain.com/2023/03/22/attack-techniques-spoofing-via-userinfo/ https://textslashplain.com/2023/03/22/attack-techniques-spoo...
spc476 3mo ago
It's probably easier for the marketing department to get a new domain up and running that it is for a new subdomain within their own company. Battling Business Units and all that.
- saghm 3mo ago
  That's a problem that should be solved then, because literally everyone loses when it's done this way

make3 3mo ago

this is the correct take

derektank 3mo ago

You really would think that at least in theory a company like Cloudflare would make it very easy for internal teams to automatically request new subdomains

nerdsniper 3mo ago
Running marketing off a separate domain is often a conscious decision because if they start getting blocked for spam, then critical service/operational emails from your actual domain might also get blocked.
- saghm 3mo ago
  Oh good, I'm glad that Cloudflare, proud defender of internet security, is properly focused on the important goal of optimizing for their ability to send promotional emails to my inbox rather than silly things like helping prevent phishing attacks.

raesene9 3mo ago

Same Story as it ever was. The first time I encountered what I thought was a phishing attack at the bank I worked at 25 years ago, it turned out to be a marketing campaign, with URLs that put our company name as a user before the domain name (back in the day when creds could go in the URL).

ericlaw 3mo ago
Fun fact: still can in Chromium-based browsers. https://textslashplain.com/2023/03/22/attack-techniques-spoofing-via-userinfo/ https://textslashplain.com/2023/03/22/attack-techniques-spoo...

spc476 3mo ago

It's probably easier for the marketing department to get a new domain up and running that it is for a new subdomain within their own company. Battling Business Units and all that.

saghm 3mo ago
That's a problem that should be solved then, because literally everyone loses when it's done this way