Hello, welcome to the Tuesday, February 8, 2020 edition of the Sands and the Storms and Stormcast. My name is Johannes Ulrich, and today I'm recording from Jacksonville, Florida.

Look at the slightly more interesting fishing email. Today, the email itself was relatively straightforward. It was one of those

D-HL. We need more details to ship your package phishing emails, but the fishing site was

hosted on what's sometimes called a distributed web platform or, well, not a hundred and sure if it's really Web 3, maybe it's

sort of more Web 2.5. The idea is that you have these distributed platforms hosting your content

to make it more difficult to take down. Since uploading files, like in this case an HTML file with JavaScript, is free,

this of course makes it an even more attractive target for fishing sites. The particular

service being used here is known as Skynet or SIA sky.net and the fishing site itself is, well, all HTML and JavaScript.

One way how they're trying to make things a little bit more plausible is by actually

including rendering of the company's website.

So at the end of the URL, you'll find your email address and then it takes

the main part of the email address, sends that off to a free service that creates an image of

the website and it then displaced that image as a background, making it a little bit look like

you actually are visiting your

homepage, and then there is this login page pop up on top of it.

Similar with the company logo, it's also being included.

Now, I have seen that many times before, and there are, again, services that this JavaScript connects to in order to

pull in the correct logo based on the email domain. Now as far as a takedown notices go with

these distributed web platforms, they should still work and via Discord I found an email address to report this to Skynet.

At this point, nothing has happened yet about 12 hour after reporting it.

I hope my email reporting it went through.

We had some issues where, well, it may have been flagged as a phishing email because of course it mentions the URL that was being used here.

...