Re:PayPal phishing scam uses invoices sent via PayPal
by rtkwe on Friday August 19, 2022 @09:51AM
(#32520933)
> Have you ever seen anyone do that though?
I don't know I haven't really probed random contact forms to see if they block this kind of thing.
There's a lot more to do to block this kind of proxy spam entirely for sure I was just talking about the particular problem of using the contact for to send to an mailing list.
Re:PayPal phishing scam uses invoices sent via PayPal
by jrumbut on Friday August 19, 2022 @12:16PM
(#32522913)
It's definitely evil genius stuff.
I'm sure enough organizations have a mailing list called "customers@company" or "clients@company" to make it worth a shot. Colleges probably have "students@school" or "faculty@school" list.
Might be enough names you can profitably do it by hand.
The only real solution is not allowing contact form emails to be customized with free text input.
I guess you could have a manual approval loop for "weird" names (more than 30 characters, has a dot in it, etc) or other signs of spam. It would still leave some space for spamming though (I can't imaging a rule that stops "Buy More ETH" but doesn't stop any unusual real name).