Re: Smells like a phish, is a fish?

[Cory Foy <Cory.Foy () mobilehwy com>]

Andrew van der Stock wrote:
> I confirmed with the registrar that indeed they did send this phishy  
> e-mail. How do we get through to large organizations - who really  
> should know better - that they most of all shouldn't smell like a  phish 
> market?

When I see emails like the one you received it almost always is because 
they are trying to make it easier on the semi-technical users who are 
going to receive it. In the balance to make it dead easy to accomplish 
the task they propogate the format of phishing emails - /especially/ 
when they get redirected to some domain that has nothing to do with the 
company.

One answer, I would think, would be to have all transactions take place 
through the same login page the user always goes to. For example, with 
GoDaddy, they should have had you log into your account through the 
normal login page, and then presented you with the information.

I would think consistancy from an organization, especially in relation 
to login pages and account information, would be one important way to 
battle phishing scenarios.

Cory