I get phish messages reported by my users. There are generally several different ones a day that have links to a password collection web form at a host at webs[.]com. I submit
a complaint about the URL to the webs[.]com report page and they generally remove the page within a day. But phishers probably get most of their passwords within the first day anyhow.
Six months ago, we were being phished with google spreadsheet form pages, but since the Oxford fiasco, Google has placed "do not enter your password on Google Forms" right above the submit button. We hardly see Google forms linked in phish messages anymore.
Like Google, the Webs service is used for many non-hazardous purposes, too. A brief attempt here to blacklist all of webs[.]com resulted in some complaints from people who actually use that service to host their personal/professional home page. And I've seen other benign links to webs[.]com in...
Six months ago, we were being phished with google spreadsheet form pages, but since the Oxford fiasco, Google has placed "do not enter your password on Google Forms" right above the submit button. We hardly see Google forms linked in phish messages anymore.
Like Google, the Webs service is used for many non-hazardous purposes, too. A brief attempt here to blacklist all of webs[.]com resulted in some complaints from people who actually use that service to host their personal/professional home page. And I've seen other benign links to webs[.]com in...
