Hacker News Reader

Comment by mutagen | Hacker News Reader

I find the use of Google's AMP cache notable to avoid having to use a spoofed domain, you can use it to have Google serve up your content themselves, rendering the advice to 'look at the domain name of the link before clicking' even more useless than it was before

Compare:

http://myaccount.google.com-securitysettingpage.ml/security/...

in the first screenshot to the screenshot from a Bellingcat journalist:

https://www.google.com/amp/tiny.cc/...

View on HN

Both links are broken.

Sorry, in hindsight my comment is rather opaque. Those links are incomplete links of the phishing links contained in the emails. I wanted to highlight the difference in the screenshots in the vice.com article between seeing a clear www.google.com (due to the AMP cache) and a google.com-user-security.tk or whatever spoofed domain that got used. Point being Google is making it easy for phishers to spoof links with the AMP cache.

I'm guessing Google is relying on their existing malware detection and site reporting process to weed out pages that take advantage of this. This approach mostly works for mass spammed links and sites trying to pass on malware but won't work for targetted phishing attacks against all but the savviest of security conscious users.

Is it possible the article writer got served the AMP page and the redirect was to the .com-* subdomain?

Are the bit.ly targets known?

Reply on news.ycombinator.com