frontpage.
newsnewestaskshowjobs

Open Source @Github

fp.

Open in hackernews

Thanks FedEx, This Is Why We Keep Getting Phished (2024)

https://www.troyhunt.com/thanks-fedex-this-is-why-we-keep-getting-phished/
141•stymaar•1h ago

Comments

darth_avocado•1h ago
Do they build their own software or contract it to the consultants?
Doohickey-d•1h ago
Discussed previously, 2024, 564 comments: https://news.ycombinator.com/item?id=39479001
walrus01•59m ago
I swear, the proliferation of random ".xyz" type gTLD is not making things any easier in stopping non tech people from clicking on phishing links. There's so damn many of them. Sure, if they didn't exist people would use phishing domains like "fedex-secure-delivery-approval.com" or something, I suppose...

List of top level domains: https://data.iana.org/TLD/tlds-alpha-by-domain.txt

cosmic_cheese•41m ago
The menagerie of TLDs is somewhat a necessary evil in my view. Prior to them it was becoming nearly impossible to get a decent domain, with most of them already having been laid claim to by squatters, big companies, and startups with VC money to burn.
inigyou•40m ago
This was a calculated project by ICANN to 1. bring lots more money to ICANN and 2. prevent decentralisation of the DNS root away from the control of the USA.
ddtaylor•28m ago
I'm not convinced that would help.

The problem is that large companies and government agencies are both misusing and NOT using the appropriate trust anchor - their fucking domain.

Its just attempting to work around incompetence, which always just shows up again somewhere else.

dqv•26m ago
For the past 2 years I've gotten backscatter from a phishing campaign that uses a domain I own in the from address. Every single domain they try to get the victims to click on is a .com

The most recent one is detention-unit.com, which probably does trick a lot of the people getting these phishing emails since the targets don't seem to speak English as a first language.

As an aside, an alarming number of server admins don't check SPF so these emails are actually getting into people's inboxes.

chuckadams•56m ago
I remember receiving a genuine "verify your account" email from PayPal way back. The phishers didn't make it up, they were just copying actual emails PayPal sent their own users.
kencausey•52m ago
In a recent example my step-mother, who is constantly getting cloud storage full scam emails, received an email from Google about 75% full storage that appears to be fully valid. However all the links use a domain c.gle and whois c.gle errors with "getaddrinfo(whois.nic.gle): Name or service not known". whois gle however does work. I was not sure of the validity of c.gle myself, my step-mother would have no idea.
inigyou•41m ago
Whois has been replaced by RDAP.
b112•24m ago
There are whois servers, and the whois command, so no, it has not.

I agree that this is the goal.

inigyou•9m ago
Clearly there is not a whois server here
mixdup•49m ago
There is a similar issue with the IRS. If you call the IRS they use a text-to-speech system to generate the voice for their call tree IVR. The problem is, it's a commercially available system that fake call center scammers also use, so they sound identical. It also doesn't help that it sounds fake and scammy, so you can't use that as a signal to avoid the number you're calling, either
grishka•18m ago
With calls, it's easier: if you get an incoming call with someone is asking you for money, you hang up and call back using the number for that organization that you've found yourself from official sources. Never trust incoming calls when it comes to money.
mixdup•7m ago
I know that, does my grandmother? In the heat of the moment, will she remember that I told her 2 years ago when they call her?
agency•46m ago
This shit drives me insane. Last year I had my home insurer send me a link in an SMS pointing me to allstate.yem.bo to collect some information. Stop training your users to get phished!!
jhbadger•39m ago
It reminds me how at work we had to take a course hosted on our domain about how to recognize phishing and a few days later we got an e-mail from outside our domain saying we had to take a course about a different subject on their domain. We got an email from management a week or so later that complained that so few people had completed the new training -- because we all assumed it was a phishing attempt because it was exactly the sort of thing the phishing course talked about!
starky•30m ago
We have a training thing at work that sends out phishing emails and you are supposed to report them using a handy button in the email app. If they are training emails you get a good job website that pops up. I greatly enjoy reporting every single genuine email that reads anything like a potential phishing email as there is someone in IT that reviews them and probably gets annoyed at the various groups sending sketchy emails for official business.
lemursage•36m ago
This is so weird, seeing this. Two years ago, I got a customs notice from FedEx asking to fill in my details. That was just a plain email from __some guy__ at FedEx with a PDF file attached. I wasn't expecting any package.

I wrote to their chatbot (of course, no human assistance) and after some time of "prompt engineering," or what one might call coercing, it finally directed me to a human consultant who confirmed it was indeed not a scam, and that it was indeed their messaging.

I opened the PDF, and it was pre-filled with someone else's data, with blank rectangles placed over fields in a bad attempt at redacting them (you could just move those rectangles around to reveal the underlying data).

The package later turned out to be a surprise from collaborators abroad. Years later, I still feel that scam aftertaste whenever I see the FedEx logo.

eventualcomp•31m ago
If I had a nickel for every post I saw on HN front page involving companies confusing people on phishing-like patterns today, I would have two nickels. Which is not a lot but still weird that it happened twice.

https://news.ycombinator.com/item?id=49172834

antonvs•25m ago
> Why are the "D" and the "T" capitalised? Dodgy AF!

You should be more respectful, you’ve clearly received a Message direct from President Trump!

Cider9986•20m ago
>Our Australian Communications and Media Authority body (ACMA) recently reported 336M blocked scam SMSs

Australia has mandatory identity verification for getting a SIM card.

The FCC is now proposing [1] to add a rule to require government ID, physical address, and alternative phone number for every phone line in the US.

KYC for phone lines would cause more IDs to be leaked, and more American dollars lost to scammers and fraudsters.

[1] https://www.404media.co/fcc-wants-to-kill-burner-phones-by-f...

Discussion:

https://news.ycombinator.com/item?id=48462308

ern•1m ago
The phishing in Australia came from uncontrolled SMS gateways which allowed for sender impersonation, not physical phones with SIM cards. They've recently partly closed the loophole by requiring providers to register sender names.
antonvs•11m ago
I wouldn’t assume that email is genuine. “Hi,” and “…the B-point link that I’ve sent”? Dodgy AF.

My first suspicion would be that they’re getting hold of the Fedex invoice data, via a software compromise or an insider.

If it really is real, then wow, FedEx Australia sounds like it’s one guy operating out of a shipping container down at the docks.

Mistral's Shieldstral: 3B open-weights model for multimodal moderation

https://mistral.ai/news/shieldstral/
247•riadsila•5h ago•62 comments

AI fuels more than half of cybercrime in Africa as digital scams surge: INTERPOL

https://www.africanews.com/2026/08/04/ai-fuels-more-than-half-of-cybercrime-in-africa-as-digital-...
16•bookofjoe•32m ago•5 comments

Show HN: Simple algorithm and color space to generate diverse skin tones

https://toneyalexander.github.io/inclusive-color-space/
427•automatoney•7h ago•85 comments

Security Incident INC-2026-07-28-01 – UK AI Security Institute [pdf]

https://cdn.prod.website-files.com/663bd486c5e4c81588db7a1d/6a724858f7db25c81487016d_Security%20I...
30•_pdp_•41m ago•12 comments

In Memory of My Wife, Elise Cawley, with Thanks for 36 Wonderful Years

https://writings.stephenwolfram.com/2026/08/in-memory-of-my-wife-elise-cawley-1961-2026-with-than...
631•jdcampolargo•3h ago•35 comments

Waymo in Dallas

https://waymo.com/blog/shorts/dallas-open-to-all/
193•xnx•4h ago•219 comments

Third-party cyber evaluations involving OpenAI models

https://openai.com/index/third-party-cyber-evaluations-involving-openai-models/
17•glub•1h ago•0 comments

Thanks FedEx, This Is Why We Keep Getting Phished (2024)

https://www.troyhunt.com/thanks-fedex-this-is-why-we-keep-getting-phished/
142•stymaar•1h ago•24 comments

Oxide Computer raises $445M (SEC Form D)

https://www.sec.gov/Archives/edgar/data/1795071/000179507126000002/xslFormDX01/primary_doc.xml
121•depr•2h ago•42 comments

DeepSeek V4 Flash on a Single AMD MI300X

https://github.com/ryanzhou/deepseek-v4-flash-mi300x
349•zhoutong•12h ago•87 comments

Don't stop early: Case-folding source code at memory speed

https://github.blog/engineering/architecture-optimization/dont-stop-early-case-folding-source-cod...
34•sbulaev•4d ago•6 comments

Hop.earth – OpenStreetMap based car racing game

https://hop.earth/?server=lkhr7&route=fQ5nuu9R
71•faebi•4h ago•37 comments

Video2NAND – Abusing video codecs for great computational power

https://sharedobject.blog/posts/vp8-combinatorial-logic/
8•firer•2d ago•0 comments

When AI Benchmarks Plateau: A Systematic Study of Benchmark Saturation

https://arxiv.org/abs/2602.16763
66•doppp•6h ago•73 comments

Keyv and friends compromised in active Shai-Hulud supply chain attack

https://www.aikido.dev/blog/keyv-and-friends-compromised-in-npm-supply-chain-attack
223•cimi_•11h ago•110 comments

The Sound of Inevitability

https://www.panoptica.com/the-sound-of-inevitability/
4•WaitWaitWha•4h ago•1 comments

Truemetrics (YC S23) Is Hiring in Berlin – GTM Lead

https://www.ycombinator.com/companies/truemetrics/jobs/bIQQ7tP-founding-gtm-lead
1•truemetricsIngo•5h ago

Launch HN: EdotEnv (YC S26) – Quant Trading RL Envs to Teach LLMs Research

https://edotenv.com/
24•Mzzzzz•3h ago•18 comments

Why some people mow a lawn better than others

https://pudding.cool/2026/06/mow/
149•carlos-menezes•4h ago•134 comments

Most tech revolutions made work worse for employees

https://www.thisandthat.chat/blog/most-tech-revolutions-made-work-worse-for-employees/
61•jreynar•7h ago•24 comments

The Warp Agent CLI

https://www.warp.dev/blog/introducing-the-warp-agent-cli-coding-agent
88•emschwartz•5h ago•52 comments

Xbox goes down. You can't play games you own on disc

https://birchtree.me/blog/xbox-goes-down-you-cant-play-games-you-own-on-disc/
544•surprisetalk•10h ago•591 comments

Apple says more ex-employees may have taken confidential data to OpenAI

https://techcrunch.com/2026/08/04/apple-says-more-ex-employees-may-have-taken-confidential-data-t...
305•thewebguyd•6h ago•234 comments

Blackmail Fail (2013)

https://gwern.net/blackmail
27•simonebrunozzi•4h ago•2 comments

There Will Come Soft Rains (1950) [pdf]

https://users.wpi.edu/~zrbutzke/Docs/BradburyStories(1).pdf
336•pmg101•23h ago•370 comments

Harness engineering for self-improvement

https://lilianweng.github.io/posts/2026-07-04-harness/
289•tosh•16h ago•63 comments

Perspec 1.0

https://adriansieber.com/announcing-perspec-1-0/
47•surprisetalk•6h ago•12 comments

Vlt 1.0 and Hosted Package Registries

https://www.vlt.io/blog/1-0
48•patrikcsak•4h ago•14 comments

Everything I Know (1975)

https://www.bfi.org/about-fuller/everything-i-know/
123•simonebrunozzi•11h ago•31 comments

Dates That Don't Exist (2015)

https://blog.yossarian.net/2015/06/09/Dates-That-Dont-Exist
108•EndXA•3d ago•75 comments