A rant about phishing: It's not the user's fault (and not DNS either)

A rant about phishing: It’s not the user’s fault (and not DNS either)

关于网络钓鱼的吐槽：这既不是用户的错，也不是 DNS 的锅

2026-09-09 — 2026-09-10 2026年9月9日 — 2026年9月10日

“For safety, don’t click suspicious links” “为了安全，请勿点击可疑链接。”

Meanwhile, most organization’s login flow redirects through: 与此同时，大多数组织的登录流程却会重定向经过以下地址：

This is a real example, but I’ve changed the names to avoid pointing fingers

这是一个真实的案例，但我修改了名称以避免指名道姓

https://www.[name of company].com/squawk/ https://login.[name of company].com/ https://login.smallcrow.com/324aa78a-03a6-66fc-23e1-4124fdsa213 https://experience.crow-cloud.com/[name of company]/auth https://flock.auth.bird-security.com/authorization https://api-deadbeef.bird-security.com/oauth/v1/authorize?token=DeAdBeEf https://api2.bird-security.com/2fa https://www.[name of company].com/cool/bird/ https://experience.crow-cloud.com/[name of company]/ https://www.[name of company].com/squawk/

Neither the username, password nor 2FA prompts are hosted on the company’s own domain. Combine that with token expiration triggering random authentication pop-ups, it becomes nearly impossible to notice phishing… because the real thing looks identical to a scam: 用户名、密码和双重验证（2FA）提示都不在公司自己的域名下托管。再加上令牌过期触发的随机身份验证弹窗，用户几乎不可能识别出网络钓鱼……因为正规流程看起来和诈骗手段一模一样。

All an attacker has to do is write a website with a password box and the company logo. The URL doesn’t matter because users have learned to ignore it. 攻击者只需制作一个带有密码框和公司 Logo 的网站即可。URL 根本不重要，因为用户已经学会了忽略它。

I’ll admit that URLs aren’t the most intuitive things, because the reading direction alternates. Hostname and scheme start specific and become more general, while the path is the other way around: 我承认 URL 并不是最直观的东西，因为它们的阅读方向是交替的。主机名和协议从具体开始，变得越来越笼统，而路径的逻辑则恰恰相反：

https://funnies.maurycyz.com/memes/crow_hobbies.jpg | | | | | | | | | | | | (most significant) | | | +------------ 1. Top level domain | +------------------ 2. Operator +--------------------------- 3. Server name +------------------------------------ 4. Protocol | | +-----|- 5. Directory +- 6. Filename (least significant)

This URL is for crow_hobbies.jpg, located in the memes folder of the HTTP daemon on the funnies server run by maurycyz.com 这个 URL 指向的是 crow_hobbies.jpg，它位于 maurycyz.com 运营的 funnies 服务器上的 HTTP 守护进程的 memes 文件夹中。

As a result, the important bit (the second level domain) is in the middle of the URL. This is something non-technical users must be taught: simply telling them to “avoid suspicious links” isn’t enough. 结果就是，最关键的部分（二级域名）位于 URL 的中间。这是必须教给非技术用户的东西：仅仅告诉他们“避免点击可疑链接”是远远不够的。

However, the whole exercise is pointless if hostname isn’t a reliable indicator. For users to have any chance of spotting a scam… 然而，如果主机名本身不再是一个可靠的指标，那么所有的防范工作都毫无意义。为了让用户有机会识别诈骗……

An organization MUST use a single, well recognized, root domain. Internal services MUST be on subdomains of the root and MUST NOT use URLs like: 组织必须使用单一且广受认可的根域名。内部服务必须位于该根域名的子域名下，且绝不能使用如下 URL：

All these look like scams. Don’t normalize scammyness!

这些看起来都像诈骗。不要让这种“诈骗感”常态化！

https://[name of company]-auth.com/ https://[name of company].someone-else.com/ https://someone-else.com/[name of company] https://auth.someone-else.com/[big UUID]

This is obviously important for login pages (since impersonating them would allow stealing credentials), but it SHOULD be applied everywhere to build good habits and prevent social engineering. 这对于登录页面显然至关重要（因为冒充登录页会导致凭据被盗），但它应该被应用到所有地方，以建立良好的习惯并防止社会工程学攻击。

Links sent by email or SMS MUST be under the recognizable domain. If it’s absolutely necessary to point users somewhere else, create a local redirect or link: 通过电子邮件或短信发送的链接必须位于可识别的域名下。如果确实需要将用户引导至其他地方，请创建一个本地重定向或链接： https://[name of company].com/survey -> https://crow-survey.com/[name of company].

This does not mean everything has to be hosted by the organization: many services allow bringing your own domain and links are free. This rule also applies to phone numbers: do not send an SMS or email telling users to “call 0491-570-006”, because there’s no way to know if it’s a scam. Contact details MUST be provided on a web page linked from the original message. 这并不意味着所有内容都必须由组织自行托管：许多服务允许使用自定义域名，且链接创建是免费的。这条规则同样适用于电话号码：不要发送短信或邮件告诉用户“拨打 0491-570-006”，因为用户无法判断这是否是诈骗。联系方式必须提供在原始消息所链接的网页上。

The key words “MUST”, “MUST NOT”, “REQUIRED”, “SHALL”, “SHALL NOT”, “SHOULD”, “SHOULD NOT”, “RECOMMENDED”, “MAY”, and “OPTIONAL” in this document are to be interpreted as described in RFC 2119… 本文档中的关键词“必须 (MUST)”、“不得 (MUST NOT)”、“要求 (REQUIRED)”、“应 (SHALL)”、“不应 (SHALL NOT)”、“应该 (SHOULD)”、“不应该 (SHOULD NOT)”、“推荐 (RECOMMENDED)”、“可以 (MAY)”和“可选 (OPTIONAL)”应按照 RFC 2119 中的描述进行解释……

The hostname situation has gotten so bad that I’ve seen people arguing that it’s a problem that subdomains exist, because it allows criminals to impersonate anyone they want with no oversight. 主机名的情况已经糟糕到我看到有人争论说子域名的存在本身就是一个问题，因为它允许犯罪分子在没有任何监管的情况下冒充任何人。

DNS is a hierarchical system who’s structure hasn’t changed in 40+ years: There should absolutely no confusion over who runs any given website… except that it’s standard practice to put great effort into making legitimate sites indistinguishable from scams. (not even governments consistently use their assigned TLDs) DNS 是一个分层系统，其结构在过去 40 多年里从未改变：对于谁在运营某个特定网站，本不应有任何混淆……但现实是，人们已经习惯于投入巨大精力，让正规网站变得与诈骗网站无法区分。（甚至连政府机构都没有始终如一地使用其分配的顶级域名）