Re: Targeted Spearphish attacks impersonating dept heads, directors

[Joseph Tam <tam () MATH UBC CA>]

On Sat, 15 Sep 2018, Bryce Porter wrote:

> It appeared in both cases that emails were scraped from public websites
> listing departmental contacts.

I liberally sprinkle bait addresses into our public web pages.  Any
attempt to deliver to these addresses will poison future mail deliveries
from the "same" sender ("same" is sometimes hard to figure out if rotating
spoofed or bounce-tag sender addresses are used).

Two benefits: it detects/kills mail that would evade other techniques,
and you get immediate phish samples.

Joseph Tam <tam () math ubc ca>