In my older piece I argued that we should stop caring about phishing alerts. Of course, it was a bit of a parable…
Still, there is a lot of quick wins I described there that can be implemented/incorporated into phishing workflows easily – as long as you have some sort of automation/SOAR in place…
As I mentioned back then, any emails marked as phish that come from all these ‘noreply’, ‘no-reply’, ‘donotreply’ mailboxes coming from well known domains can be (most of the time) auto-closed w/o any investigation…
Easy to say, but what are these really…?
While I have personally collected a long list of these nothingburger email senders before, I got curious how many of these generic ‘do not reply’ type of email accounts are really out there, and not within a single company’s scope, but in general (that is, just email account names hosted on popular domains that belong to the ‘do nothing’ category).
If asked about listing these passive account names from the top of your head I bet you would start with ‘noreply’, ‘no-reply’, and all the variants of ‘donotreply’, then you would perhaps follow with ‘contact’, ‘info’, ‘abuse’, ‘webmaster’, and so on and so forth, but … this is just a guesswork. I thought this approach was too speculative and that we can build a more more comprehensive list of these w/o guessing. And mind you, this IS a very difficult request to fulfill. Unless you work for a company working in the mail security business, that is…
And since I don’t, let’s get creative…
I wrote a quick & dirty script that goes through a batch of files containing email addresses extracted from various public e-mail dumps. It reads them one by one and it tries to extract some basic stats about them. A lot of results are quite boring and non-actionable, many are discarded ‘on the fly’, but after running it for a few days, adjusting it here and there, my goal of building an _inaccurate_ histogram of the most commonly used do-not-reply account names started to bring fruits. And while I am writing this, my script is still running, but there are a lot of juicy results already, so I am going to share them below…
Before I do so, let me help you with an interpretation.
For every account name I am listing, try to find out if any of these come from the domains that are generally trustworthy. And the good news is — chances are, many of them contribute to your phishing alert volumes!
For example, a noreply@facebook.com is trustworthy, but noreply@skdjfhskdjfgj.com is not.
Now that we have all these pieces of information in place, let’s look at the actual list of email accounts of ‘no interest’:
- info@
- mail@
- admin@
- net@
- office@
- sales@
- contact@
- master@
- life@
- best@
- webmaster@
- email@
- home@
- support@
- purchase@
- myspace@
- boss@
- sample@
- style@
- smile@
- av@
- online@
- accounts@
- design@
- box@
- test@
- web@
- service@
- www@
- world@
- null@
- bill@
- live@
- no@
- post@
- game@
- hot@
- off@
- new@
- marketing@
- all@
- spam@
- shop@
- club@
- demon@
- sex@
- org@
- hi@
- team@
- kontakt@
- student@
- house@
- games@
- here@
- work@
- city@
- job@
- fly@
- free@
- hello@
- weber@
- top@
- fun@
- user@
- money@
- player@
- auto@
- personal@
- price@
- link@
- time@
- beauty@
- manager@
- geo@
- manu@
- seo@
- jenkins@
- project@
- dummy@
- photo@
- business@
- company@
- records@
- show@
- productions@
- foto@
- legend@
- dev@
- space@
- cash@
- miles@
- first@
- bot@
- help@
- core@
- facebook@
- beer@
- blog@
- unit@
- agent@
- song@
- flash@
- opt@
- list@
- noemail@
- gaming@
- secret@
- ads@
- travel@
- market@
- football@
- speed@
- trade@
- mini@
- freedom@
- services@
- postmaster@
- ebay@
- corp@
- staff@
- unknown@
- lost@
- bug@
- login@
- moto@
- editor@
- sound@
- force@
- vkontakte@
- wizard@
- english@
- people@
- party@
- abuse@
- dhl@
- fedex@
- ups@
- studio@
- play@
- submit@
- biuro@
- yahoo@
- soft@
- account@
- booking@
- kids@
- adidas@
- system@
- expert@
- freelife@
- forum@
- mailbox@
- photography@
- fantasy@
- production@
- administrator@
- designer@
- chef@
- inbox@
- official@
- social@
- minecraft@
- shopping@
- paypal@
- united@
- entertainment@
- customerservice@
- creative@
- consulting@
- reception@
- invitado@
- consult@
- vision@
- away@
- network@
- education@
- robot@
- nomail@
- nothing@
- digital@
- solutions@
- taxi@
- training@
- noreply@
- today@
- agency@
- purchasing@
- security@
- commerciale@
- community@
- studios@
- connect@
- newsletter@
- nobody@
- food@
- youth@
- oops@
- construction@
- society@
- registrar@
- transport@
- audio@
- nospam@
- member@
- junkmail@
- secretary@
- enquiry@
- surveys@
- articles@
- enterprise@
- bookings@
- segreteria@
- information@
- communication@
- commercial@
- event@
- photos@
- yourmail@
- central@
- inform@
- tours@
- operator@
- factory@
- direct@
- import@
- realtor@
- misc@
- xpress@
- virtual@
- premium@
- amazon@
- capital@
- research@
- exclusive@
- biznes@
- oracle@
- corporation@
- summit@
- inquiry@
- daemon@
- massage@
- officiel@
- associates@
- culture@
- cartoon@
- navigator@
- platinum@
- poczta@
- sazonova@
- redaktion@
- local@
- website@
- partners@
- johncena@
- realestate@
- firefox@
- resident@
- advertising@
- anonim@
- source@
- technik@
- response@
- mobility@
- traffic@
- custom@
There are many more and I recommend that you look at your phishing queue and analyze senders, and people who are too trigger-happy to submit phish reports to your SOC. Stats like this can give you plenty of opportunities to both automate auto-closures, and educate trigger-happy users.