We see some of this with just normal spear phishing against companies. The "single click" thing is reasonably common, it makes things a bit harder to catch as often the clickthrough will change to whatever is being spoofed in the first place. A homophone ycornbinator.com would serve the malware first time, then next time it would send a permanent redirect. Unique IDs you'll see in things like spam SMS, both to work around automated blacklisting, but also to work out who clicked through and who might be a potential mark the next time even if they didn't completely fall for the scam.
Most of what we got was recycled RAT malware with various packers though, it didn't trend towards being particularly interesting because you usually don't need to be to catch people, at least that's my impression. Maybe it's bad toupee fallacy.
Hearing Americans regularly complain about SMS and robocall spam still blows my European mind. I haven't received a single spam call or SMS in my life, ever.
Back in the 90s and early 2000s the worst that could happen was, say, texting a commercial number to get a polyphone ringtone, and that actually being a subscription. But obviously that is something you have to initiate first, not something passive.
I live in Germany and I get a lot of spam calls and spam SMS. It's always in waves. Some days I stop answering calls if I don't recognise the number, because its one of these days where Interpol has informwd me already three times that my identity was stolen and I have to give them all my details to fix this ..... They're very patient at Interpol, I keep hanging up on them and they never give up.
When I have a spammer/scammer on the phone (and I actually picked up), I usually just put my phone on mute and stop talking to them. They waste a bit more time that way before they hang up (without more effort from me).
I, in Australia, had never received a spam call or SMS, until two years ago. I now receive several per day. All automatically blocked, but still.
My number was leaked in a particular data breach that actually had nothing to do with me, but a different family member who had all of their contacts vacuumed up before the breach. So from my perspective it was passive.
in india its pretty common for businesses/ orgs to sell number data in bulk which is bought by advetisers.
you can be sure to be bombarded with calls and sms if a students applies for a notify thing or gives their number somewhere outside exam halls or on student help websites.
same for shops asking for mobile numbers.
then there are marketers who randomly call each number, send sms to see what sticks.
the situation is pretty bad i would say because for every careful person who sees through the ruse, there are hundreds who fall for million dollar prizes and kyc scams and all.
people call you and say "we are form bank. main branch. you need to verify your debit card or your account will close". no name of bank, no place of branch, just "from bank. main branch".
If you have your number up on the net somewhere, you will recieve calls. For example that domain registration you did 30 years ago that required a phone number... I got myself a smartphone for the reason I could easily block out of country phonecalls. I haven't had any recent spam calls though, was many years since the last one.
Here in Singapore SMS and phone spam comes and goes.
At the moment it's pretty bad with lots of calls from overseas. (People with hilariously un-local accents trying to tell you they are calling from the Ministry of Health of Ministry of Manpower...)
Those overseas callers are faking caller id to look like local numbers.
I read about it on HN some months ago. I don’t recall if it was in comments or an article. But I read the info and sources and was convinced enough at the time. I’m sorry I didn’t save the original info. I’ll try some googling “geolocation from SMS” and see what I can find.
That’s not what I’m talking about. And since number portability and mobile devices became possible, area codes are mostly irrelevant. For example, I’ve lived 2000 miles from the area code of my phone number for probably 10 years now.
Greek here, mobile phones are non-geographic but used to be service provider specific, but even this practice isn't applicable due to number portability.
Landlines used to be geographic but this isn't relevant any more again new to number portability.
I read about it on HN some months ago. I don’t recall if it was in comments or an article. But I read the info and sources and was convinced enough at the time. I’m sorry I didn’t save the original info. I’ll try some googling “geolocation from SMS” and see what I can find.
Thanks for the input. A nit, sorry, but maybe relevant to readers learning a little about anti-phishing: homophones sound the same ('-phone' refers to sound, like telephone) but differ in meaning, such as 'write' and 'right'. I don't know the term for ycombinator.com / ycornbinator.com, which is a real problem, of course.
That's fair I'm not really one for jargon and whatnot (I think it can actually become less useful if the goal is just to communicate something to a person), but the first line in wiki says:
> a homoglyph is one of two or more graphemes, characters, or glyphs with shapes that appear identical or very similar.
"Very similar" and "two or more" being the key words.
As for homograph I found homoglyph by reading the wiki and it saying homoglyph is more appropriate.
(Insert obligatory "wiki it's not always accurate etc etc"). Overall I'd take either one and personally don't care. Just trying to match what you're saying with what I'm reading and make sense of where the truth is.
> (Insert obligatory "wiki it's not always accurate etc etc"). Overall I'd take either one and personally don't care. Just trying to match what you're saying with what I'm reading and make sense of where the truth is.
Diving in (even if the parent doesn't care :) ):
The last sentence is the real challenge: Meanings depend 100% on writer and reader understandings. If two agree that 'homograph' means 'chicken poop', as long as they're the only ones communicating then 'chicken poop' it is; but if someone else reads it, our language subsystem fails.
Some dictionaries influence meaning by being prescriptive (e.g., American Heritage, IIRC); others report what has been understood by being descriptive (e.g., Oxford). The problem is, Wikipedia is neither: It represents the understandings of a few editors of unknown knowledge; it is neither descriptive nor prescriptive and we quickly get into chicken poop scenarios.
* Homograph, report Merriam-Webster and Oxford, means words with the same spelling but different meanings (or origin or pronunciation), e.g., the bow of a ship and a bow and arrow.
* Homoglyph doesn't appear in Oxford, Merriam-Webster, American Heritage, or any others (per Wordnik and OneLook), except Wiktionary. Wiktionary descriptively traces the word back to 1938 (though maybe with a different meaning in that case) and says it means a glyph with the same or similar appearance but different meaning. That still doesn't define a term for the entire string "ycornbinator.com", only the "rn", but close enough!
> Some dictionaries influence meaning by being prescriptive (e.g., American Heritage, IIRC); others report what has been understood by being descriptive (e.g., Oxford). The problem is, Wikipedia is neither: It represents the understandings of a few editors of unknown knowledge; it is neither descriptive nor prescriptive and we quickly get into chicken poop scenarios.
To be clear: reporting what has been understood still influences meaning. Choice of inclusion moderates spread; definitions are inherently lossy and cannot capture the whole range of nuance; the compiler's understanding can be inaccurate. Lexicography is not a neutral art, no matter your choice of biases. And OED no less "represents the understandings of a few editors of unknown knowledge" than Wikipedia does. With different goals, and to different standards, to be sure, but Gell-Mann amnesia goes hard until you get into the weeds.
> reporting what has been understood still influences meaning. Choice of inclusion moderates spread; definitions are inherently lossy and cannot capture the whole range of nuance; the compiler's understanding can be inaccurate.
I agree and actually had a sentence in the GP that said it, but removed it because it was getting too long. An important point. Also, the Oxford English Dictionary intends to be descriptive and says so, but many readers won't understand that and take it as prescriptive.
> OED no less "represents the understandings of a few editors of unknown knowledge" than Wikipedia does.
The knowledge of OED editors is not unknown but well known and exceptional - the world's leading lexicographers, with the best training and decades of experience. The resources are exceptional: top-notch professional lexicographers, domain experts, databases, teams of volunteers reading and contributing, etc. The definitions are not based on the contemporary understanding of a few people but on over a century of accumulated research, back to the beginning of English, and the understandings of those people, plus it depends on the input of domain experts, editors, etc.
I'm not knocking Wikipedia, which has its value, and the OED is, like every human institution, limited. But beyond that general statement, the quoted sentence doesn't describe the OED at all.
Most of what we got was recycled RAT malware with various packers though, it didn't trend towards being particularly interesting because you usually don't need to be to catch people, at least that's my impression. Maybe it's bad toupee fallacy.