{"id":1799,"date":"2024-01-12T13:17:17","date_gmt":"2024-01-12T19:17:17","guid":{"rendered":"https:\/\/wp.uthscsa.edu\/phishbowl\/?p=1799"},"modified":"2024-01-12T13:49:18","modified_gmt":"2024-01-12T19:49:18","slug":"ndcourts-gov","status":"publish","type":"post","link":"https:\/\/wp.uthscsa.edu\/phishbowl\/uncategorized\/1799\/","title":{"rendered":"ndcourts.gov"},"content":{"rendered":"<p>This email serves as a perfect example of the use of compromised or spoofed domains. The email appears to come from a legitimate .gov domain (ndcourts.gov). Government domains, such as .gov, inherently carry a sense of authority and trustworthiness. Users are more likely to believe the authenticity of an email sent from a .gov address, lowering their guard and making them more susceptible to phishing scams. The exploitation of legitimate domains for phishing represents a significant security challenge. By understanding how attackers can compromise these domains, users can better prepare and protect themselves against such insidious attacks. Always approach unsolicited emails with skepticism, even if they originate from reputable domains, and verify through official channels whenever possible.<\/p>\n<p>In the ndcourts.gov phishing example, several elements highlight the nature of the attack:<\/p>\n<ul>\n<li>Compromised Sender: The email originates from a seemingly legitimate .gov email address, which may indicate the domain has been compromised or spoofed.<\/li>\n<li>Generic Greeting: The email uses a generic &#8220;Dear Staff&#8221; greeting, which is impersonal and often used in mass phishing campaigns.<\/li>\n<li>Urgent Call to Action: The email prompts an urgent action \u2014 clicking on a link for payroll adjustment \u2014 a common tactic to prompt a quick, unthinking response.<\/li>\n<li>Misleading Branding: The email imitates the branding of HR departments, with terms like &#8220;i-Payroll Connect &amp; Benefits Enrollment&#8221; to seem legitimate.<\/li>\n<li>External Link: Despite the email&#8217;s appearance, it includes a link that redirects to an external domain, which is a classic red flag for phishing.<\/li>\n<\/ul>\n<p><img loading=\"lazy\" decoding=\"async\" class=\"aligncenter size-full wp-image-1800\" src=\"https:\/\/wp.uthscsa.edu\/phishbowl\/wp-content\/uploads\/sites\/90\/2024\/01\/2024-01-12_12-33-15_ndcourts_gov.png\" alt=\"\" width=\"946\" height=\"882\" srcset=\"https:\/\/wp.uthscsa.edu\/phishbowl\/wp-content\/uploads\/sites\/90\/2024\/01\/2024-01-12_12-33-15_ndcourts_gov.png 946w, https:\/\/wp.uthscsa.edu\/phishbowl\/wp-content\/uploads\/sites\/90\/2024\/01\/2024-01-12_12-33-15_ndcourts_gov-429x400.png 429w, https:\/\/wp.uthscsa.edu\/phishbowl\/wp-content\/uploads\/sites\/90\/2024\/01\/2024-01-12_12-33-15_ndcourts_gov-590x550.png 590w, https:\/\/wp.uthscsa.edu\/phishbowl\/wp-content\/uploads\/sites\/90\/2024\/01\/2024-01-12_12-33-15_ndcourts_gov-768x716.png 768w\" sizes=\"auto, (max-width: 946px) 100vw, 946px\" \/><\/p>\n","protected":false},"excerpt":{"rendered":"<p>This email serves as a perfect example of the use of compromised or spoofed domains. The email appears to come from a legitimate .gov domain (ndcourts.gov). Government domains, such as .gov, inherently carry a sense of authority and trustworthiness. Users are more likely to believe the authenticity of an email sent from a .gov address, [&hellip;]<\/p>\n","protected":false},"author":664,"featured_media":0,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[1],"tags":[],"class_list":["post-1799","post","type-post","status-publish","format-standard","hentry","category-uncategorized"],"yoast_head":"<!-- This site is optimized with the Yoast SEO plugin v27.8 - https:\/\/yoast.com\/product\/yoast-seo-wordpress\/ -->\n<title>ndcourts.gov - Phish Bowl<\/title>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/wp.uthscsa.edu\/phishbowl\/uncategorized\/1799\/\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"ndcourts.gov - Phish Bowl\" \/>\n<meta property=\"og:description\" content=\"This email serves as a perfect example of the use of compromised or spoofed domains. The email appears to come from a legitimate .gov domain (ndcourts.gov). Government domains, such as .gov, inherently carry a sense of authority and trustworthiness. Users are more likely to believe the authenticity of an email sent from a .gov address, [&hellip;]\" \/>\n<meta property=\"og:url\" content=\"https:\/\/wp.uthscsa.edu\/phishbowl\/uncategorized\/1799\/\" \/>\n<meta property=\"og:site_name\" content=\"Phish Bowl\" \/>\n<meta property=\"article:published_time\" content=\"2024-01-12T19:17:17+00:00\" \/>\n<meta property=\"article:modified_time\" content=\"2024-01-12T19:49:18+00:00\" \/>\n<meta property=\"og:image\" content=\"https:\/\/wp.uthscsa.edu\/phishbowl\/wp-content\/uploads\/sites\/90\/2024\/01\/2024-01-12_12-33-15_ndcourts_gov.png\" \/>\n<meta name=\"author\" content=\"soukupg\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:label1\" content=\"Written by\" \/>\n\t<meta name=\"twitter:data1\" content=\"soukupg\" \/>\n\t<meta name=\"twitter:label2\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data2\" content=\"2 minutes\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\\\/\\\/schema.org\",\"@graph\":[{\"@type\":\"Article\",\"@id\":\"https:\\\/\\\/wp.uthscsa.edu\\\/phishbowl\\\/uncategorized\\\/1799\\\/#article\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/wp.uthscsa.edu\\\/phishbowl\\\/uncategorized\\\/1799\\\/\"},\"author\":{\"name\":\"soukupg\",\"@id\":\"https:\\\/\\\/wp.uthscsa.edu\\\/phishbowl\\\/#\\\/schema\\\/person\\\/8cca61e5184a4f0de0cf9b1f40cb8e4c\"},\"headline\":\"ndcourts.gov\",\"datePublished\":\"2024-01-12T19:17:17+00:00\",\"dateModified\":\"2024-01-12T19:49:18+00:00\",\"mainEntityOfPage\":{\"@id\":\"https:\\\/\\\/wp.uthscsa.edu\\\/phishbowl\\\/uncategorized\\\/1799\\\/\"},\"wordCount\":248,\"image\":{\"@id\":\"https:\\\/\\\/wp.uthscsa.edu\\\/phishbowl\\\/uncategorized\\\/1799\\\/#primaryimage\"},\"thumbnailUrl\":\"https:\\\/\\\/wp.uthscsa.edu\\\/phishbowl\\\/wp-content\\\/uploads\\\/sites\\\/90\\\/2024\\\/01\\\/2024-01-12_12-33-15_ndcourts_gov.png\",\"inLanguage\":\"en-US\"},{\"@type\":\"WebPage\",\"@id\":\"https:\\\/\\\/wp.uthscsa.edu\\\/phishbowl\\\/uncategorized\\\/1799\\\/\",\"url\":\"https:\\\/\\\/wp.uthscsa.edu\\\/phishbowl\\\/uncategorized\\\/1799\\\/\",\"name\":\"ndcourts.gov - Phish Bowl\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/wp.uthscsa.edu\\\/phishbowl\\\/#website\"},\"primaryImageOfPage\":{\"@id\":\"https:\\\/\\\/wp.uthscsa.edu\\\/phishbowl\\\/uncategorized\\\/1799\\\/#primaryimage\"},\"image\":{\"@id\":\"https:\\\/\\\/wp.uthscsa.edu\\\/phishbowl\\\/uncategorized\\\/1799\\\/#primaryimage\"},\"thumbnailUrl\":\"https:\\\/\\\/wp.uthscsa.edu\\\/phishbowl\\\/wp-content\\\/uploads\\\/sites\\\/90\\\/2024\\\/01\\\/2024-01-12_12-33-15_ndcourts_gov.png\",\"datePublished\":\"2024-01-12T19:17:17+00:00\",\"dateModified\":\"2024-01-12T19:49:18+00:00\",\"author\":{\"@id\":\"https:\\\/\\\/wp.uthscsa.edu\\\/phishbowl\\\/#\\\/schema\\\/person\\\/8cca61e5184a4f0de0cf9b1f40cb8e4c\"},\"breadcrumb\":{\"@id\":\"https:\\\/\\\/wp.uthscsa.edu\\\/phishbowl\\\/uncategorized\\\/1799\\\/#breadcrumb\"},\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\\\/\\\/wp.uthscsa.edu\\\/phishbowl\\\/uncategorized\\\/1799\\\/\"]}]},{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/wp.uthscsa.edu\\\/phishbowl\\\/uncategorized\\\/1799\\\/#primaryimage\",\"url\":\"https:\\\/\\\/wp.uthscsa.edu\\\/phishbowl\\\/wp-content\\\/uploads\\\/sites\\\/90\\\/2024\\\/01\\\/2024-01-12_12-33-15_ndcourts_gov.png\",\"contentUrl\":\"https:\\\/\\\/wp.uthscsa.edu\\\/phishbowl\\\/wp-content\\\/uploads\\\/sites\\\/90\\\/2024\\\/01\\\/2024-01-12_12-33-15_ndcourts_gov.png\",\"width\":946,\"height\":882},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\\\/\\\/wp.uthscsa.edu\\\/phishbowl\\\/uncategorized\\\/1799\\\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\\\/\\\/wp.uthscsa.edu\\\/phishbowl\\\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"ndcourts.gov\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\\\/\\\/wp.uthscsa.edu\\\/phishbowl\\\/#website\",\"url\":\"https:\\\/\\\/wp.uthscsa.edu\\\/phishbowl\\\/\",\"name\":\"Phish Bowl\",\"description\":\"Phish Bowl\",\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\\\/\\\/wp.uthscsa.edu\\\/phishbowl\\\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"en-US\"},{\"@type\":\"Person\",\"@id\":\"https:\\\/\\\/wp.uthscsa.edu\\\/phishbowl\\\/#\\\/schema\\\/person\\\/8cca61e5184a4f0de0cf9b1f40cb8e4c\",\"name\":\"soukupg\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/22905797bcf9afeddba904c5b64ac87ac2df7f868684a121a4807e74b9c93167?s=96&d=mm&r=g\",\"url\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/22905797bcf9afeddba904c5b64ac87ac2df7f868684a121a4807e74b9c93167?s=96&d=mm&r=g\",\"contentUrl\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/22905797bcf9afeddba904c5b64ac87ac2df7f868684a121a4807e74b9c93167?s=96&d=mm&r=g\",\"caption\":\"soukupg\"},\"url\":\"https:\\\/\\\/wp.uthscsa.edu\\\/phishbowl\\\/author\\\/soukupg\\\/\"}]}<\/script>\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"title":"ndcourts.gov - Phish Bowl","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/wp.uthscsa.edu\/phishbowl\/uncategorized\/1799\/","og_locale":"en_US","og_type":"article","og_title":"ndcourts.gov - Phish Bowl","og_description":"This email serves as a perfect example of the use of compromised or spoofed domains. The email appears to come from a legitimate .gov domain (ndcourts.gov). Government domains, such as .gov, inherently carry a sense of authority and trustworthiness. Users are more likely to believe the authenticity of an email sent from a .gov address, [&hellip;]","og_url":"https:\/\/wp.uthscsa.edu\/phishbowl\/uncategorized\/1799\/","og_site_name":"Phish Bowl","article_published_time":"2024-01-12T19:17:17+00:00","article_modified_time":"2024-01-12T19:49:18+00:00","og_image":[{"url":"https:\/\/wp.uthscsa.edu\/phishbowl\/wp-content\/uploads\/sites\/90\/2024\/01\/2024-01-12_12-33-15_ndcourts_gov.png","type":"","width":"","height":""}],"author":"soukupg","twitter_card":"summary_large_image","twitter_misc":{"Written by":"soukupg","Est. reading time":"2 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"Article","@id":"https:\/\/wp.uthscsa.edu\/phishbowl\/uncategorized\/1799\/#article","isPartOf":{"@id":"https:\/\/wp.uthscsa.edu\/phishbowl\/uncategorized\/1799\/"},"author":{"name":"soukupg","@id":"https:\/\/wp.uthscsa.edu\/phishbowl\/#\/schema\/person\/8cca61e5184a4f0de0cf9b1f40cb8e4c"},"headline":"ndcourts.gov","datePublished":"2024-01-12T19:17:17+00:00","dateModified":"2024-01-12T19:49:18+00:00","mainEntityOfPage":{"@id":"https:\/\/wp.uthscsa.edu\/phishbowl\/uncategorized\/1799\/"},"wordCount":248,"image":{"@id":"https:\/\/wp.uthscsa.edu\/phishbowl\/uncategorized\/1799\/#primaryimage"},"thumbnailUrl":"https:\/\/wp.uthscsa.edu\/phishbowl\/wp-content\/uploads\/sites\/90\/2024\/01\/2024-01-12_12-33-15_ndcourts_gov.png","inLanguage":"en-US"},{"@type":"WebPage","@id":"https:\/\/wp.uthscsa.edu\/phishbowl\/uncategorized\/1799\/","url":"https:\/\/wp.uthscsa.edu\/phishbowl\/uncategorized\/1799\/","name":"ndcourts.gov - Phish Bowl","isPartOf":{"@id":"https:\/\/wp.uthscsa.edu\/phishbowl\/#website"},"primaryImageOfPage":{"@id":"https:\/\/wp.uthscsa.edu\/phishbowl\/uncategorized\/1799\/#primaryimage"},"image":{"@id":"https:\/\/wp.uthscsa.edu\/phishbowl\/uncategorized\/1799\/#primaryimage"},"thumbnailUrl":"https:\/\/wp.uthscsa.edu\/phishbowl\/wp-content\/uploads\/sites\/90\/2024\/01\/2024-01-12_12-33-15_ndcourts_gov.png","datePublished":"2024-01-12T19:17:17+00:00","dateModified":"2024-01-12T19:49:18+00:00","author":{"@id":"https:\/\/wp.uthscsa.edu\/phishbowl\/#\/schema\/person\/8cca61e5184a4f0de0cf9b1f40cb8e4c"},"breadcrumb":{"@id":"https:\/\/wp.uthscsa.edu\/phishbowl\/uncategorized\/1799\/#breadcrumb"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/wp.uthscsa.edu\/phishbowl\/uncategorized\/1799\/"]}]},{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/wp.uthscsa.edu\/phishbowl\/uncategorized\/1799\/#primaryimage","url":"https:\/\/wp.uthscsa.edu\/phishbowl\/wp-content\/uploads\/sites\/90\/2024\/01\/2024-01-12_12-33-15_ndcourts_gov.png","contentUrl":"https:\/\/wp.uthscsa.edu\/phishbowl\/wp-content\/uploads\/sites\/90\/2024\/01\/2024-01-12_12-33-15_ndcourts_gov.png","width":946,"height":882},{"@type":"BreadcrumbList","@id":"https:\/\/wp.uthscsa.edu\/phishbowl\/uncategorized\/1799\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/wp.uthscsa.edu\/phishbowl\/"},{"@type":"ListItem","position":2,"name":"ndcourts.gov"}]},{"@type":"WebSite","@id":"https:\/\/wp.uthscsa.edu\/phishbowl\/#website","url":"https:\/\/wp.uthscsa.edu\/phishbowl\/","name":"Phish Bowl","description":"Phish Bowl","potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/wp.uthscsa.edu\/phishbowl\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"en-US"},{"@type":"Person","@id":"https:\/\/wp.uthscsa.edu\/phishbowl\/#\/schema\/person\/8cca61e5184a4f0de0cf9b1f40cb8e4c","name":"soukupg","image":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/secure.gravatar.com\/avatar\/22905797bcf9afeddba904c5b64ac87ac2df7f868684a121a4807e74b9c93167?s=96&d=mm&r=g","url":"https:\/\/secure.gravatar.com\/avatar\/22905797bcf9afeddba904c5b64ac87ac2df7f868684a121a4807e74b9c93167?s=96&d=mm&r=g","contentUrl":"https:\/\/secure.gravatar.com\/avatar\/22905797bcf9afeddba904c5b64ac87ac2df7f868684a121a4807e74b9c93167?s=96&d=mm&r=g","caption":"soukupg"},"url":"https:\/\/wp.uthscsa.edu\/phishbowl\/author\/soukupg\/"}]}},"_links":{"self":[{"href":"https:\/\/wp.uthscsa.edu\/phishbowl\/wp-json\/wp\/v2\/posts\/1799","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/wp.uthscsa.edu\/phishbowl\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/wp.uthscsa.edu\/phishbowl\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/wp.uthscsa.edu\/phishbowl\/wp-json\/wp\/v2\/users\/664"}],"replies":[{"embeddable":true,"href":"https:\/\/wp.uthscsa.edu\/phishbowl\/wp-json\/wp\/v2\/comments?post=1799"}],"version-history":[{"count":0,"href":"https:\/\/wp.uthscsa.edu\/phishbowl\/wp-json\/wp\/v2\/posts\/1799\/revisions"}],"wp:attachment":[{"href":"https:\/\/wp.uthscsa.edu\/phishbowl\/wp-json\/wp\/v2\/media?parent=1799"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/wp.uthscsa.edu\/phishbowl\/wp-json\/wp\/v2\/categories?post=1799"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/wp.uthscsa.edu\/phishbowl\/wp-json\/wp\/v2\/tags?post=1799"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}