this post was submitted on 27 Oct 2026
1469 points (98.7% liked)
Programmer Humor
33844 readers
1253 users here now
Welcome to Programmer Humor!
This is a place where you can post jokes, memes, humor, etc. related to programming!
For sharing awful code theres also Programming Horror.
Rules
- Keep content in english
- No advertisements
- Posts must be related to programming or programmer topics
- If the mod doesn't find it funny, you're banned. Ha-ha!... For real: do not use the community for "statements". There are other places for such content. Keep it chill and funny.
founded 3 years ago
MODERATORS
you are viewing a single comment's thread
view the rest of the comments
view the rest of the comments
My current company makes it real easy. All their simulated phishing addresses use the fictitious TLD of ".corn" so I just setup an email rule to filter them.
Oh man y'all remember the actual phishing campaign of messages from customer-service@bankofarnerica. com?
So what do you do when you get an actual phishing mail that doesn't use that TLD?
I know this is a leap, but for some reason reading this made me want to buy a domain like virus.porn and make it the most wholesome, lemmy community on the planet.
Oh, you mean like penisland.net?
"Handling The Big Jobs, Too"
Lolol
Or girlsof in stagam, which apparently has disappeared but used to be the story of the adventures of a person called Girlsof in the magical realm of Stagram.
I remember that one too, but think it was actually called Slütsof In Stagrâm
I'm unsure if this is satire and that link should stay blue. 😅
ass.golf
Just leaving their bare ass out there with no ssl, smh
It's only one ssl. How much could it possibly cost? 4 dollars?!
I the worst part is deciding which flavor to get
I like that the most expensive one is called "wildcard".
Sounds like it's gonna perform AMAZING feats of security some of the time and just not work at all at other times.
Kinda like the wild mage of encryption 😁
WILDCARD SECURITY
It blasts the hackers off the face of the earth with orbital lasers! killer robots sever their network connection! It's twirling a revolver on its finger while smoking three cigarettes!
And sometimes, that revolver goes off in your face, and it posts your private key on 4Chan.
Jesus... TIL
They can also be gotten for free through many providers, the biggest one in self-hosting is LetsEncrypt
Be the change you want to see! I'll sign up straight away.
P1nkman, please report to the training room.
An actual email sent by my company. (not representative of their usual)
I delight in reporting genuine emails from my company that look like sophisticated phishing attempts, bonus points if they send a follow-up assuring us that the previous sketchy email was in fact genuine.
That’s a crack it open with a hex editor, find who sent it, delete then return a note to the sender letting them know you’ve removed the problematic communication, thankyouverymuch.. signed ABiggerCuntThanYou@WhyIsMyCompanyWastingMoneyOnThisShit.org
That's how you get assigned to IT overflow tickets, NGL. 😅
Yeah if anyone falls for this lock them out of their computer immediately.
Clearly he's trying to trick you into pressing the "Report Phishing" button, which must be some sort of a trap. I'd check the attached document for further clues, especially since he's telling me not to. Must be something interesting there
That's pretty cool. Gets the point across - and the reason and results of why it matters to report instead of ignore. Kudos to your team.
A company I was in a few jobs back had several layers of IT department, there was the local studio department that handled our everyday stuff and a "head office" somewhere far away that set policy and handed out budget and whatnot.
One day "head office" IT decided it was a good idea to send out some fake phishing emails to "test" us. They didn't tell the local IT department about it, I guess they were also being "tested". My manager received one and only recognized it as a phishing attempt after he'd clicked just one too many things for it to feel safe to ignore. So he yanked the power on his computer and contacted the local IT department, as is protocol when something potentially dangerous just happened.
The local network went into lockdown while local IT tried to figure out if something actually dangerous had happened. It cost the studio as a whole several hours of work time, which for a studio our size translated to an obscene dollar cost. Nobody on our side of things did anything wrong, even that one extra "dangerous" click my manager did wasn't something he could be blamed for - head office had crafted the fake phishing attempt well and his reaction to it would have prevented damage had it been real.
Head office never tried a stunt like that again.
All I could think as I read this was Dwight's fire drill from the office
I've also never fallen for any of the phising emails the IT department sends to test me, my secret is almost never checking my email
My company sends at least one fake phishing email a week. They track stats for them on a security page and I wear it as a badge of honor that my report says 100% viewed and 0% reported.
My company makes you take a course of you fail one or if you ignore 4 or 5 so I have the highest reporting record of the company just because of how much I hate that course
I think they do that at my company too but in addition to not reporting phishing emails I have a personal rule that I don't do any "mandatory" training unless someone in my management chain specifically asks me to. My boss probably gets annoyed by that occasionally but you'd be surprised how much of that stuff I never get asked about.
Kemming is 100 level preparedness.
They need to up their game to cover internationalized homograph vulnerabilities, using roughly similar characters from different international alphabets to create totally different domain names:
example.com
exаmple.com
They look identical but are entirely different.
https://en.wikipedia.org/wiki/IDN_homograph_attack
They "a"s don't look identical at all with a good font like Atkinson Hyperlegible Next, which also very clearly differentiates between
etc..
My company is using phishing simulations from a company that puts their company name in the x headers or every email, so that's also easy filter.
As a bonus, that filter also throws all the full security training courses to junk
If we don't report the emails as phishing it is considered a fail.
lucky you. they fail us if we don't right click report phishing.
Mine includes a header so their mail filter knows to ignore it.
At this point, I'm pretty sure that every employee who has been there for more than a month has written or at least copied a filter to delete any email with that header.
I've never been comfortable with that kind of mass deletion and we have, AFAIK, unlimited mailbox storage, so I just set my version to mark those emails as read.
edit: Mail, not mark.
If your company contracts with phish.me then that URL is actually in the email header metadata.
Just set up a rule for the word phish to a special folder, and then you can use the "report" button on everything in that folder to get the credit.
So what do you do when you get an actual phishing mail that doesn't use that word?