Don’t click on that! Kevin Hill

 Spam: Unwanted commercial ◦ Advertising ◦ Comes from people wanting to sell you stuff. ◦ Headers may be forged to hide actual accounts sending the .  Phishing: pretending to be from someone else you trust ◦ Deceptive ◦ Designed to look like legitimate from a trusted source. ◦ Banks, ISPs, corporate IT departments.

 We use block lists to block s from known spam sending servers.  Many sites now using Sender Reputation systems.  Spam reports from Fermilab = bad reputation scores.

 Look at the “Full Headers”  Why “Full Headers”? ◦ has envelope From and To addresses, just like old timey postal mail. ◦ The headers your mail client shows are equivalent to addresses at the top of a physical letter. ◦ All servers add a “Received:” header. Only headers added by local or trusted upstream servers are trustworthy. ◦ Don’t trust those either.

 Never, ever send usernames and passwords via .  Don’t enter your username and passwords into a web form/application you don’t recognize/expect to use.  Don’t forward your fnal.gov to another site and then report messages from it as spam.

 HTML links have two parts: a display part and a URL  “click here” =>  Don’t assume a link that looks like a URL actually links to that URL  “ => me.php “ me.php

 URLs can be prefixed with a username/password.  example.com/hackme.html is a valid URL, but doesn’t go where you might think at first glance. example.com/hackme.html  Read s in plain text instead of html when you can.

 Holding the pointer over a URL should show where its actually linking in the status line.  Latest versions of browser more clearly show if an SSL link is really registered to that domain.  Beware of fake SSL certs! Hard to be 100% sure. Use good judgment.

 Look at mouse-over’s in your mail client to see where a link is really pointing.  Better to type in URLs then to click on untrustworthy links, but don’t mistype!  Save bookmarks to important pages.  Use bookmarks when you get an requesting you do something at a particular site.

 s about Fermilab systems will not come from non-fnal.gov addresses.  Real Fermilab web forms/apps will not be hosted on non-fnal.gov websites.  Outsourcing/Cloud based hosting makes things complicated.

 Messages available at