28

Stackexchange started to use URLs in E-Mails, that look like phishing and have nothing to do with the real stackexchange domains.

Example:

<a href="http://sg-links.stackoverflow.email/wf/click?upn=pDzA4vSaPmKy14REDACTEDREDACTEDREDACTEDREDACTEDREDACTEDREDACTEDREDACTEDREDACTEDREDACTEDREDACTEDREDACTEDREDACTEDREDACTEDREDACTEDREDACTEDREDACTEDREDACTEDREDACTEDREDACTEDREDACTEDREDACTEDREDACTEDREDACTEDREDACTEDREDACTEDREDACTEDREDACTEDREDACTEDREDACTEDREDACTEDREDACTEDREDACTEDREDACTEDREDACTEDREDACTEDREDACTEDREDACTEDREDACTEDREDACTEDREDACTEDREDACTEDREDACTEDREDACTEDREDACTEDREDACTEDREDACTEDREDACTEDREDACTEDREDACTEDREDACTEDREDACTEDREDACTEDREDACTEDREDACTEDREDACTEDREDACTEDREDACTEDREDACTEDREDACTEDREDACTEDREDACTEDREDACTEDREDACTEDREDACTEDREDACTEDPyU-3D">https://stackexchange.com/users/REDACTED?tab=inbox</a>

So the text looks like this:

https://stackexchange.com/users/REDACTED?tab=inbox

And the actual link is:

http://sg-links.stackoverflow.email/wf/click?upn=pDzA4vSaPmKy14REDACTEDREDACTEDREDACTEDREDACTEDREDACTEDREDACTEDREDACTEDREDACTEDREDACTEDREDACTEDREDACTEDREDACTEDREDACTEDREDACTEDREDACTEDREDACTEDREDACTEDREDACTEDREDACTEDREDACTEDREDACTEDREDACTEDREDACTEDREDACTEDREDACTEDREDACTEDREDACTEDREDACTEDREDACTEDREDACTEDREDACTEDREDACTEDREDACTEDREDACTEDREDACTEDREDACTEDREDACTEDREDACTEDREDACTEDREDACTEDREDACTEDREDACTEDREDACTEDREDACTEDREDACTEDREDACTEDREDACTEDREDACTEDREDACTEDREDACTEDREDACTEDREDACTEDREDACTEDREDACTEDREDACTEDREDACTEDREDACTEDREDACTEDREDACTEDREDACTEDREDACTEDREDACTEDREDACTEDREDACTEDREDACTEDPyU-3D

So it has many signs of a phishing mail:

  • Redirect URLs instead of real URLs
  • Different link text and links
  • Link to a totally different domain
  • Link to a new TLD (.email) with a similar name than the real site
  • Very long URL
  • Tracking parameters in the URL

(The e-mail is probably real and the domain seems to belong to Stack Exchange. But I cannot know this without quite a bit of additional research. This is very bad. Especially when someone starts using another look-alike domain and I am already used to strange links in Stack Exchange E-Mails)

PLEASE STOP DOING THIS!

When you send me a link, please just use a plain link. This does not only apply for links, that have URLs as their link text like the input link, but to the linked question and the links like "Edit email settings" as well.

Regarding the argument that using another domain protects cookies, I would suggest just not to use a redirect URL at all. Sending E-Mails using a third-party service is okay. But you do not need to use the tracking URLs of the third-party service. When it is mandatory for this service, use another provider where it is not mandatory.

A Spam-Filter report summing up to 5.12 (marked as Spam):

  • HTML_SHORT_LINK_IMG_1 (2)
  • PHISHING (1.669287) [stackexchange.com->stackoverflow.email]
  • URI_COUNT_ODD (1) [9]
  • DMARC_POLICY_ALLOW (-0.5) [stackoverflow.email,reject]
  • MID_RHS_NOT_FQDN (0.5)
  • MV_CASE (0.5)
  • FORGED_SENDER (0.3) [[email protected],[email protected]]
  • R_SPF_ALLOW (-0.2) [+ip4:168.245.32.199:c]
  • R_DKIM_ALLOW (-0.2) [stackoverflow.email:s=s1]
  • ZERO_FONT (0.1) [1]
  • MIME_GOOD (-0.1) [multipart/alternative,text/plain]
  • MANY_INVISIBLE_PARTS (0.05) [1]

Explanation of the non-obvious filter Tags:

  • URI_COUNT_ODD: A odd number of URIs in multipart/alternative message
  • MID_RHS_NOT_FQDN: The message ID does not contain a FQDN
  • MV_CASE: Mime-Version vs. MIME-Version
  • ZERO_FONT: A zero-sized font was used
  • MANY_INVISIBLE_PARTS: Many parts are visually hidden
Improve this question
13
  • 1
    your network profile is not a secret as it is 480116 so there was no need to have that part redacted ...
    – rene
    Apr 27, 2019 at 12:27
  • 2
    fwiw, stackoverflow.email is a domain owned by Stack Exchange.
    – rene
    Apr 27, 2019 at 12:28
  • 3
    @rene Better one thing too many redacted than one to little. I suspect that the domain belongs to Stack Exchange, but how do I know without quite a bit of research? Stack Exchange is not the only company doing this, but they are a company, that should know better. If you send me a e-mail for something on stackexchange, use the same domain.
    – allo
    Apr 27, 2019 at 12:29
  • 2
    Yeah, the need from marketeers to collect information about where, when and if we click on things gets a bit of out of hand. You're not the first one to raise this concern. I'm personally indifferent about it but it is fair to raise this issue. I also recall a discussion from one of the SE devs that using a different domain improved security for some scenario's but that wasn't about the newsletter / notification emals f memory serves me right.
    – rene
    Apr 27, 2019 at 12:35
  • 7
    It'd probably be better if they used the actual SO domain. While SO.email may be owned by SE, it's not really a known domain, and <famous-website>.<different-TLD> is a pretty common way for people to fake affiliation.
    – TheWanderer
    Apr 27, 2019 at 13:20
  • 3
    @TheWanderer Using stackexchange.com or maybe stackoverflow.com without any subdomains would be a good start. Personally I would keep the links as plain as possible to avoid any confusion. And especially links with a different URL in the link text are a sign of phishing and even earn spam points in some spam filters. For tracking a small &from=email URL parameter would be okay and not looking like phishing. Be careful with using abbreviations, the domain so.email in your comment does not seem to be the same as stackoverflow.email.
    – allo
    Apr 27, 2019 at 14:31
  • Related on MSO: Gmail blocks links in "Reset Stack Overflow password" email
    – rene
    Apr 27, 2019 at 17:19
  • 3
    I think the explanation here on MSO is still correct: Is email from [email protected] legit?
    – Catija
    Apr 27, 2019 at 18:46
  • 2
    Regardless of the domain used, the text should either be the exact URL or something descriptive, but never a different link.
    – isanae
    Apr 28, 2019 at 6:27
  • I don't see any problem here. Google also do it, Twitter also do it, it's a standard. And it's not third party email, it's 100% created by Stack Exchange developers.
    – Shadow Wizard Is Sad And Angry
    Apr 28, 2019 at 7:06
  • 2
    @ShadowWizard Why does being standard or common make something acceptable?
    – forest distrusts StackExchange
    Apr 28, 2019 at 8:35
  • 1
    not an expert, but (or perhaps therefore) i wouldn't click it. additionally, given a link text with a valid address, expect copying that text into a browser to provide the exact same function.
    – ocæon
    Apr 28, 2019 at 15:48
  • Just got one this morning and totally thought it was a rather clever fishing attack. When I tried to follow a link Safari gave me a "Connection not secure" error also. If I whois sg-links.stackoverflow.email, the dump doesn't look related to whois stackoverflow.com, and also looks blandly generic, as a fishing registration might well look. As a friend mentions, there's no way to know this isn't fishing so one should suspect it is.
    – Benjohn
    Sep 22 at 9:11

0

Reset to default

You must log in to answer this question.

Browse other questions tagged .