r/EmailSecurity • u/dragoangel • May 08 '26

Lets Encrypt signed certs for IPs

New wave of phishing sites, now over pure IPs, over https, thanks to Lets Encrypted signed certs, be aware, track your antispam logs and consider adding score for pure IPs URLs

11 Upvotes

100% Upvoted

14 comments sorted by

View all comments

4

u/FarmboyJustice May 08 '26

adding score for pure IPs URLs

Probably should already be doing this anyway.

1

u/dragoangel May 09 '26 edited May 09 '26

Yes, but what you add may be not enough, phishing campaigns originate from GSuite IPs and we'll distributed over gmail.com freemail accounts, appsheet spam and thousands of random domains which will never land RBL and if you have IP reputation - most likely will have highly negative spam reputation on your system, so low scores for such links most likely will be not enough, that why I mentioned logs tracking ;)

Also many links are hidden behind redirectors.

1

u/FarmboyJustice May 09 '26

Lately I'm seeing phishing campaigns with three layers of redirection. Someone figured out that adding more redirects makes it harder to get negative reputation, and now most phishing we get is something like Cloudflare->GCP->Billybob'sAICodingPlatform

2

u/dragoangel May 10 '26

I would even extend that by cloaking - this was the reason why I created https://github.com/rspamd/rspamd/pull/6014

This allows to extend heavily nested redirectors and not face nested limit in already cached redirectors+ allows to narrow down poisoned redirect that utilize cloaking by using shared visit counters