Fran’s Gone Phishing – Entry 3 – Renew or Delete

Send me your phish fransphish@feedbackfans.com

Did you know that the main reason Feedback Fans was created was due to businesses and business people being so frustrated and driven to despair by unhelpful web hosting and internet companies.

Enough people who knew my work came to me and said ‘I wish we could just give this all to you to deal with’, for it to become a business on that basis.

Our first campaign was called, ‘You deserve better’ and I still look on it nostalgically and fondly today. I passionately believed that web development and IT infrastructure companies didn’t have to be this way, and that a digitally aware business and end consumer deserved better. I still fight for this to this day, in every corner I can.

Since those days (early 2010s), quite a few web companies have improved, some have stagnated and fallen by the wayside and some continue to be an absolute horror story.

Why am I telling you all this, dear reader, oh you guessed it, it’s a FRIDAY, it’s a segue into …

FRAN’S GONE PHISHING
In the digital world, he took a stroll,
This Bear was on a mission, heart and soul.
With cunning skills, he scoured the net,
Hunting for scams, the biggest you bet.

For a Phish, I’d hesitate to call it sophisticated, but this one will have certainly got some people. It’s the best we’ve analysed yet as part of Fran’s Gone Phishing – let’s give it a 7.5/10

Some important context on this Phish, is that if you are a small business or working IT in a company who receives this e-mail, you do not necessarily know who your hosting is with. To complicate matters further, you may have some legacy IT scatterings that mean you have multiple hosting with multiple companies and varying renewal dates.

It’ll also prey on your psycho-state. By that, I mean if you are tired, overworked or stressed you may not be able to fully compute all of the signs that indicate that this is actually a phishing attempt.

The first thing to do when you receive this e-mail, or something similar, is to contact your web hosting provider (hopefully me) and ask about your domain renewal date. DO NOT ASK YOUR WEB HOSTING PROVIDER THROUGH ANY DETAILS OR LINKS ON THIS PHISH. Make sure you go to their official website/support/chat channels.

If you can’t get through to them on their endlessly backed up ‘experiencing high volumes caller’ phone lines, then just drop me a line, I’ll check for you.

How can we determine this is a Phish:

• E-mail address is some honky @livemail.co.uk. Eww no. What do we always say, friends don’t let friends send business emails through gmail or free e-mail addresses. They buy them a £5 e-mail address from Feedback Fans.
• Broken personalisation on salutations field – Now, this is a tongue-in-cheek one as many legit brands mess up their personalisation right, so it’s not necessarily a phishing attempt just because of that, but it’s another good sign along with others.
• Hurrying you up – In general, hosting and domain companies worth their salt do not try to alarm and make you act on the spot like this. They don’t do it because they know Phishing attacks do it, so whilst I appreciate you have to have some knowledge of phishing and domains to spot that one, that is indeed a sign.
• Uniformity – The phone number on this Phish is for one brand, the control panel another and the linked brand name at the bottom is yet again another different brand. This combined with the email shows four signs that this isn’t a legitimate e-mail.