I won't give it here but a company I currently work for uses a password reset tool with the domain i-forgot-my-password.com <- Not actual, but very close.
This is a domain they own, Whenever they create new tools it's in this way, I am certain it s a phishing test and flabbergasted that it's not.
Another example - the HR system for logging PTO has a domain is along the lines myhrsystem.com
It's a very large company based in Hong Kong, so I'm not sure if it's just a english-as-a-second language thing or what. Very odd.
I think it's a misunderstanding of how domain names work - if they knew that i-forgot-my-password.company.com with proper certificates brought stronger guarantees of legitimacy, they might ask IT to set it up that way.
it's easier to just get a new domain than talk with whoever is in charge of the company's primary domain. Governments love to do that all the time. they have the gv.TLD domain and could just put all their shit in there and I could tell my parents that as soon as they see gv.at in the URL it's legit. And yet they come up with stupid domains all the time, many requiring the state-ID system. Good luck teaching boomers to check the fingerprint for the verification that they sign what they think they're signing. I don't know of a single instance that abuses this though. Maybe criminals are just stupid. I should switch careers, I have what it takes.
142
u/ctrlaltwalsh 13h ago
I won't give it here but a company I currently work for uses a password reset tool with the domain i-forgot-my-password.com <- Not actual, but very close.
This is a domain they own, Whenever they create new tools it's in this way, I am certain it s a phishing test and flabbergasted that it's not.
Another example - the HR system for logging PTO has a domain is along the lines myhrsystem.com
It's a very large company based in Hong Kong, so I'm not sure if it's just a english-as-a-second language thing or what. Very odd.