07/12/2025
Here are some common tricks that are often used in phishing emails and URLs:
Substitution of Letters: Scammers often replace letters in the URL or email address with numbers or other characters that look similar. For example, replacing "a" with "4" or "l" with "1".
Additional Subdomains: Legitimate-looking subdomains can be added to make the URL seem genuine, like www.amazon.scamwebsite.com.
Misspellings: Minor misspellings that are easy to overlook, such as "Amaz0n" instead of "Amazon".
Different Alphabet: Characters from other alphabets, like Cyrillic, can be used to mimic English letters. For instance, the Cyrillic "а" can replace the Latin "a".
Homoglyph Attacks: Utilizing characters that look similar but are technically different to create a domain that visually appears to be a known domain name.
URL Shorteners: These can disguise the final destination, making it difficult to determine whether a link is safe just by looking at it.
IDN Spoofing/Punycode: Using international domain names to represent domain names with foreign characters, which then get translated to familiar-looking ASCII characters.
HTTPS Spoofing: Even if a site has an SSL certificate (indicated by HTTPS in the URL), it's not necessarily safe. Certificates can be obtained for fraudulent websites too.
JavaScript Obfuscation: Some phishing sites use JavaScript to dynamically create a misleading URL in the address bar.
Data URLs: Using data URLs to include a complete, but deceptive, HTML page in a URL itself, often making the user believe they are on a different page than they actually are.
HTML Display Name Tricks: The text part of a clickable hyperlink can be manipulated to look like a legitimate URL, even though the actual link points somewhere else.
It's crucial to exercise extreme caution when clicking on any links or opening any attachments, especially from unknown or untrusted sources. Always verify the URL and sender's email manually if there's any doubt. Many modern email clients and web browsers have built-in phishing filters, but these are not foolproof. Human vigilance is a crucial component in detecting phishing attempts.
Give ViljieCo a call to discuss the right solution for your business. We have world-class software and training available!
www.ViljieCo.co.za
