Post #1186464

This is the link wrapped around a fake Docusign button in a #phish I just received: httpx://longrangehunter.ca/Home/ChangePreference?lang=en&returnUrl=http%3A%2F%2Fwww.faisalaluminium.com/assets/eactive What our pet grifter is doing here is using *two* servers and *two* domains, in the hope that you won't notice the proxy going from the original domain to the second. That's because it's a lot easier to replace a reverse proxy than an entire website.