Hacker News Reader

Comment by herodotus | Hacker News Reader

What I do in my emails is tell them the exact URL of the bad page. All they need to do is look at the file with a text editor (they are admins, after all). Once they have done this, they will see strange Javascript. They will know it has nothing to do with their own (or their clients) web pages. There are no links per se in my email (except the URL, but I leave off the http:).

View on HN

Don't you worry that if you email spammy/virus-laden links then your email address could get flagged?

Perhaps using a dedicated email for these sorts of reports could limit the damage if that were to happen. It would probably increase the chance of being flagged, though.

I've worked as a security analyst at a company and sometimes I would report phishing pages to the webhost. After a while, I realized that half of my emails were being silently quarantined by the company's outbound spam filters due to the included URLs. I was able to manually release them, but I wonder how many emails will then be flagged on the receiving end.

Typically when sending an email with content like that for a notification you'll "defang" the URL by rendering it like "hXXp:// foo (dot) bar (dot) com" or something along those lines to ensure that it isn't automatically flagged and filtered, though it's also common on the receiving end to apply no spam filters to their abuse@ email as well. You'll usually have better luck sending this information to the abuse email listed in the IP whois than to any contact information at the domain itself.

> you'll "defang" the URL

Wow, that's a phrase I haven't heard in ages.

This is the business: https://en.wikipedia.org/wiki/MIMEDefang

Most site admins aren't really aware/in-charge of the javascript on their pages.

Most webmaster@ or admin@ e-mails aren't monitored at all, or so flooded with spam that it's easy for things to get lost.

Reply on news.ycombinator.com