<story><title>Ubiquiti Networks Breach</title><url>https://mailchi.mp/ubnt/account-notification?e=30527b2904</url></story><parent_chain><item><author>nh2</author><text>Regarding authenticity, from the TechCrunch article about this:&lt;p&gt;&amp;gt; The networking company quickly followed its email with a post on its community pages confirming that the email was authentic, after several complained that the email sent to customers included typos.&lt;p&gt;Indeed: How am I supposed to know whether this email is really from Ubiquiti?&lt;p&gt;* There was apparently no official press release.&lt;p&gt;* All links in the email, including the &amp;quot;Change password&amp;quot; button, are to e.g. `&lt;a href=&quot;https:&amp;#x2F;&amp;#x2F;ui.us8.list-manage.com&amp;#x2F;track&amp;#x2F;click?u=somehexnumber&amp;amp;id=morehex&amp;amp;e=morehex&quot; rel=&quot;nofollow&quot;&gt;https:&amp;#x2F;&amp;#x2F;ui.us8.list-manage.com&amp;#x2F;track&amp;#x2F;click?u=somehexnumber&amp;amp;i...&lt;/a&gt;`.&lt;p&gt;* The delivering server is `mail42.atl11.rsgsv.net`, which the TLD of which doesn&amp;#x27;t seem to resolve in my browser to provide hints.&lt;p&gt;* Various news sites that reported this either just referred to &amp;quot;emails people got&amp;quot;, screenshots random people got via Twitter, or link to the Mailchimp site, for which I&amp;#x27;m not sure how to verify whether the &amp;quot;ubnt&amp;quot; account actually belongs to Ubiquiti.&lt;p&gt;Given this, how shall the normal affected user figure out that this isn&amp;#x27;t well-executed phishing?&lt;p&gt;It seems companies could do a much better job making it obvious that their emails are legit. Especially if they were just breached, and &amp;quot;Change password&amp;quot; buttons are involved.</text></item></parent_chain><comment><author>stronglikedan</author><text>I missed a mortgage payment, because my mortgage company launched their &amp;quot;new&amp;quot; website as a subdomain on a primary domain that wasn&amp;#x27;t registered to them. They sent an email from that same domain, directing people to the new site. I tried to verify the authenticity of the email with their customer service team, but, crickets. No one bothered contacting me until they wanted to chase me down for the payment, at which point, I told them what a horrible practice it was, and insisted they remove the late fee. They did remove the fee, but the site and all related emails &lt;i&gt;still&lt;/i&gt; look like phishing attempts. Not surprising really, given that the majority of companies double-down on stupid when called out for their blunders.</text></comment>
<story><title>Ubiquiti Networks Breach</title><url>https://mailchi.mp/ubnt/account-notification?e=30527b2904</url></story><parent_chain><item><author>nh2</author><text>Regarding authenticity, from the TechCrunch article about this:&lt;p&gt;&amp;gt; The networking company quickly followed its email with a post on its community pages confirming that the email was authentic, after several complained that the email sent to customers included typos.&lt;p&gt;Indeed: How am I supposed to know whether this email is really from Ubiquiti?&lt;p&gt;* There was apparently no official press release.&lt;p&gt;* All links in the email, including the &amp;quot;Change password&amp;quot; button, are to e.g. `&lt;a href=&quot;https:&amp;#x2F;&amp;#x2F;ui.us8.list-manage.com&amp;#x2F;track&amp;#x2F;click?u=somehexnumber&amp;amp;id=morehex&amp;amp;e=morehex&quot; rel=&quot;nofollow&quot;&gt;https:&amp;#x2F;&amp;#x2F;ui.us8.list-manage.com&amp;#x2F;track&amp;#x2F;click?u=somehexnumber&amp;amp;i...&lt;/a&gt;`.&lt;p&gt;* The delivering server is `mail42.atl11.rsgsv.net`, which the TLD of which doesn&amp;#x27;t seem to resolve in my browser to provide hints.&lt;p&gt;* Various news sites that reported this either just referred to &amp;quot;emails people got&amp;quot;, screenshots random people got via Twitter, or link to the Mailchimp site, for which I&amp;#x27;m not sure how to verify whether the &amp;quot;ubnt&amp;quot; account actually belongs to Ubiquiti.&lt;p&gt;Given this, how shall the normal affected user figure out that this isn&amp;#x27;t well-executed phishing?&lt;p&gt;It seems companies could do a much better job making it obvious that their emails are legit. Especially if they were just breached, and &amp;quot;Change password&amp;quot; buttons are involved.</text></item></parent_chain><comment><author>cutthegrass2</author><text>The best user behaviour on receiving a potentially &amp;#x27;fishy&amp;#x27; email is to not click any inks, but to go directly to the site in question and change your password, if you feel the email is genuine in anyway.</text></comment>