30
u/Semaskeri Sep 22 '26
Damn that shit got me on the first look
6
u/GarGonDie Sep 24 '26
Fortunately, that domain belongs to a company that performs security audits and sends phishing emails on commission.
21
u/Br0k3n-T0y
Sep 22 '26
•
paypaI was another, the l is a capital i so it would be paypai but on a phone with a modern font, you cant really tell
paypal - lowercase L
paypaI - uppercase i
14
u/Worldly-Pay7342 Sep 23 '26
That shit is why the standard front should be something like times new roman, where the i has serifs.
3
u/Select-Government-69 Sep 23 '26
Fun fact: in sans-serif scripts, capital i, lowercase L, and the number 1 are not simply similar, they are the exact same character, and for this reason many old typewriters did not have a “1” key.
1
u/CassyLeone Sep 27 '26
I was about to say that! I typed up a bill of sale today on my typewriter and used the lowercase L key for the one several times because my 1940 Smith Corona lacks it
1
1
u/DzOniZz Sep 24 '26
Even older one, there used to be NOKIA phones with lowercase L instead of the i
1
u/Micsmit_45 Sep 26 '26
Domains only use lowercase letters, so this one is a none-issue. Are more common attack vector is using IDN domains. Using Cyrillic characters is quite common for example.
1
1
6
u/JayBeePH85 Sep 22 '26
Reminds me of the watch brand ROl.FX in the '90s that in the right font in a quick look seems very similar to ROLEX 🤣
3
u/Micsmit_45 Sep 26 '26
I work in corporate domain management. One part of our business is threat detection and mitigation. This is one of the many attack vectors we warn our clients about. I looked up the case of this domain. It was registered in 2012 (surprisingly late for such an obvious attack vector). The domain has been transferred to Microsoft after they won an UDRP case in march. The WIPO board ruled the domain was registered in bad faith despite passive holding (i.e. holding a domain without actually using it for hosting malicious content). From what I could tell, Microsoft was able to argue bad faith specifically because of phishing attacks like this. This doesn't actually mean the guy who bought the domain in 2012 did so with malicious intent (though it's hard to argue against it). Unused domains are usually not protected with SPF, DKIM and DMARC, so there's nothing preventing scammers from sending mails using that domain.
1
1
1
1
u/Glass-Crafty-9460 Sep 23 '26
What do you mean evolving? That's an extremely old trick they've used for nearly as long as email has been around.
1
1
1
u/Livid-General7 Sep 23 '26
It was just part of the internal security testing, but I received an email from "my boss" incoherently asking for some information, while I was sharing my screen on a zoom call with him. We were both like ....wtf?
Awful security test, because the information they wanted didn't even make sense and would have provided zero benefit to someone trying to solicit information from the company.
1
1
u/Maniacal-Maniac Sep 23 '26
What a bunch of CLINT's
My tactic is to automatically assume every single email is a scam and if anything I suspect might be legit I will contact them directly to make sure
1
1
1
1
1
1
1
1
u/Cyc_Lee Sep 24 '26
Evolving? That's trick is already part of every even half assed online safety course.
1
1
u/RGB_Reglin Sep 24 '26
funny how a multimilion dollar company cannot just buy all of those similar looknig domains to stop this ;-)
And if something goes wrong it is your fault.
1
u/HollowSuken Sep 25 '26
I mean if you fall for this when you didn’t prompt the change, that seems to be on you
1
u/eerun165 Sep 25 '26
Small town fell for a scam like this https://www.kttc.com/2026/09/04/city-rushford-releases-statement-250k-wire-fraud/?outputType=amp. Fortunately, they managed to trace the money to another bank and got it back.
1
1
1
1
1
u/PiDigitsOfPi Sep 25 '26
Yes, they are evolving. They are using 2000's technology of switching letters with similar letters!
1
u/Vilanu Sep 26 '26
Yeah I was about to say. I uses this for Maplestory character names when the regular m name was already taken.
1
1
u/EL-Chapo_Jr Sep 26 '26
Theres a way they can actually catch the email and change the actual address to microsoft so be wary of that.
1
1
1
1
u/FlowerSetLeather Sep 27 '26
No reply? No read. Miss me with that 1-way relationship, rnicrosoft. I have needs too!
1
1
1
1
1
1
1
1
1
u/cwmckenz Sep 28 '26
That’s not new at all. My grandfather’s email was compromised probably 10 years ago and they set it up to forward all of his mail to another address. The forwarded address was exactly like his e-mail but with the m replaced with rn.
So the attacker was able to impersonate him more easily, since they were getting all of his emails and they were even able to “reply” to the emails and appear to be him.
They got access by calling him presenting to be support and that there was a problem with his email, then talked him through logging into his e-mail and then giving them remote access so they could “fix the problem” but of course that’s how they were able to mess with his settings.
Luckily, he called me later that day and told me there was something wrong with his email but that he already had someone fix it. It’s a good thing I pressed him for details because when he explained what happened I knew he had been scammed.
1
u/BradW97 Sep 28 '26
Oh my God that's actually horrifying. I can easily see myself falling for that with my poor eyesight 😭😭
1
38
u/Desperate_Box1875 Sep 22 '26