{"id":55,"date":"2022-11-21T21:58:38","date_gmt":"2022-11-21T21:58:38","guid":{"rendered":"https:\/\/freshphish.info\/?p=55"},"modified":"2024-02-11T20:07:06","modified_gmt":"2024-02-12T01:07:06","slug":"phish-uses-redirects-on-legitimate-web-sites","status":"publish","type":"post","link":"https:\/\/freshphish.info\/?p=55","title":{"rendered":"Phish Uses Redirects on Legitimate Web Sites"},"content":{"rendered":"\n

Here are two examples from the same phishing campaign. One links to the legitimate Booking.com web site and one links to the legitimate JudicialWatch.org web site. I believe these subdomains normally contain some sort of user profiles, which means the hacker would create or gain control of existing user profiles on these web sites, create the redirector, making them public, then creating the phishing emails linking to them. I could be wrong on how this is done but this is what I believe.<\/p>\n\n\n\n

\"\"
Booking.com hosted phish redirect. Note the domain [in brackets] the email security
system adds to the rewritten link showing where it actually leads to.<\/figcaption><\/figure>\n\n\n\n
\"\"
Judicialwatch.org hosted redirect phish. Note the domain shown [in brackets] the email security
system adds showing where the link leads to. Note the subdomain of myjw.pr.judicialwatch.org.
I would think “myjw” stands for “My JudicialWatch”.<\/figcaption><\/figure>\n\n\n\n

I have informed Judicial Watch of this phishing redirect on their web site. I do not see an option at Booking.com to contact them.<\/p>\n\n\n\n

–Matt<\/p>\n","protected":false},"excerpt":{"rendered":"

Here are two examples from the same phishing campaign. One links to the legitimate Booking.com web site and one links<\/p>\n

Continue readingPhish Uses Redirects on Legitimate Web Sites<\/span><\/a><\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"_monsterinsights_skip_tracking":false,"_monsterinsights_sitenote_active":false,"_monsterinsights_sitenote_note":"","_monsterinsights_sitenote_category":0,"footnotes":""},"categories":[12],"tags":[21,20,4],"class_list":["post-55","post","type-post","status-publish","format-standard","hentry","category-phish","tag-booking-com","tag-judicialwatch-org","tag-phish"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t