{
  "timestamp": "2025-02-05T22:26:46.503160",
  "model": "deepseek/deepseek-r1-distill-llama-70b",
  "request": {
    "messages": [
      {
        "role": "system",
        "content": "You are a security advisor providing end-user guidance on data security and protection.\n            Focus on practical, easy-to-follow security recommendations."
      },
      {
        "role": "user",
        "content": "\n            Provide clear security guidance based on:\n            \n            Content to reference:\n            Search Free Trial Get Demo Phishers abusing Google App Engine October 12, 2020 Over the last few weeks Cyren has observed a massive spike in phishing sites hosted on the appspot.com domain that Google uses for its free Google App Engine. Taking advantage of soft routing on Google App Engine Google App Engine is a cloud-based development platform used to host and develop any kind of application. It supports almost any language, framework or library, making it easy to deploy the code to the Google Cloud Platform. When a web application is deployed to the Google App Engine platform, a URL is generated using the apps version, service name, project ID, and region ID fields and ending with appspot.com. However, when navigating to the website of the application a part of the subdomain, the version ID and service name dont matter as long as the project ID and region ID are correct. 12345 is the version id, test is the service name, office-offline365 is the project id and ew.r is the region id. Since the version and the service names in the URL dont matter you can basically put anything in front of the -dot-office-offline355.ew.r.appspot.com and it will be soft routed to the default hostname of the web application. Any random letters or numbers before -dot-office-offline355.ew.r.appspot.com will trigger a soft route to the default host name of the web application. Related How Scammers Leverage Email Delivery Services like SendGrid and MailChimp in Phishing Attacks Enter phishing actors Over the past month, Cyren has seen a 3x spike in phishing URLs on the Appspot.com domain. A number of different phishing projects are generating thousands of unique subdomains for their phishing site. One of those phishing sites has the project ID millinium and targets Microsoft 365 users. The attackers have generated and sent out tens of thousands of unique phishing URLs since September 12, 2020. Screenshot of the landing page Example of the random generated subdomains The biggest spike was from September 19-22. We observed over 70 thousand unique millinium URLs. Appspot phishing URLs since September 10 with the  millinium spike on the 21 st . Personalized to target large enterprises Following the large spike of Appspot.com phishing sites, were detecting the same phishing kit across multiple organizations. The phishing kit has different landing pages, but the most common one is a Microsoft Excel login page, Outlook Web App, and Office365 login page. Microsoft Excel phishing site The phishing emails are also changing, but the most popular one is a fake invoice email. It appears to contain a .pdf document but is, in fact, a link to the appspot.com phishing site. The email of the targeted user is used as a parameter in the URL. And its already written in the email field on the phishing site with the company name from the email domain in the title of the login form. Email example from Cyren Inbox Security Encoded JavaScript confuses crawlers and scrapers The substantial proportion of these attacks use encoded JavaScript in order to confuse the web crawlers and scrapers used by security vendors, especially those searching for specific keywords in the HTML code i.e. the title of the website. What the user sees. What the web crawler will see HTML source code. After the HTML code has been decoded. After breaking down and decoding one of those phishing kits, Cyren found the HTML code linked to a directory containing multiple JavaScripts. Theyre used to personalize the site to the visitor, capture the password, and more. Two of those are particularly interesting app.js and helper.js. App.js is the JavaScript that initiates the phishing page and changes the site title based on the domain in the users email address. The JavaScript is also responsible for displaying a message to the user that the password was typed incorrectly. Its so sophisticated, it does so two times, and after the third attempt the user is redirected to an official Microsoft Outlook support page thinking that there is something wrong with his credentials. This is done to ensure the attacker gets the correct password. App.js Helper.js is responsible for handling the form activity on the page. Function getHashParameters gets the current URL and looks for the anchor  to retrieve the users email address. If the email address is missing in the URL the phishing site will not render and the user will just see a white blank page. Helper.js handles the forms and looks for the anchor  to retrieve the users email. Function loginUser has the user enter his password multiple times After exploring different directories in the phishing kit, Cyren found a text file in the logs folder, emails.txt. This file contains the email addresses and passwords for the users or victims of this particular phishing site. From this single phishing site, attackers gathered 920 unique emails and passwords from 700 unique email domains. Emails.txt open plain text file containing over 900 email addresses and passwords Phishing hides behind legitimate services With all the new cloud hosting platforms like Microsoft Azure, Google App Engine, AWS, Heroku, Google Firebase and more, phishing is moving from newly registered domains, compromised sites and free hosting to these legitimate services. The phishing actors are now focusing more on large enterprises and gaining access to sensitive company accounts, causing massive damage and loss for companies. By hosting the phishing sites on these popular cloud platforms, attackers can bypass many security products since the domain is legitimate, secure, and has a valid certificate. Connection is secure Learn more about Cyren Inbox Security Cyren Inbox Security was built to safeguard each and every Microsoft 365 mailbox in your organization. It is a continuous and automated layer of security right in the user mailbox  Persistently rescans inbound, outbound and delivered emails in all folders  Reduces investigative overhead with automated incident and case management workflows  A seamless mailbox plugin lets users scan and report suspicious emails Our threat visibility is unsurpassed. Cyrens global security cloud processes 25 billion email and web security transactions every day identifies 9 new threats and blocks over 3,000 known threats each second. Ready to play with Cyren Inbox Security for Microsoft 365? Start a 30-day trial, no credit card needed  Try it for Free Instant Data Classification Cyren URL Category Chacker Prev Microsoft reports a leap in attack sophistication Email spoofing BEC attack targeting numerous employees at once Next Company Partners Resources Investor Relations Products Freeware Demo Solutions Contact Us Privacy Management Service by Data443\n            \n            Your guidance should include:\n            1. Easy-to-follow security best practices\n            2. Data protection recommendations\n            3. Safe usage guidelines\n            4. Common security risks and prevention\n            5. Privacy protection measures\n            6. When to seek additional security support\n            "
      }
    ],
    "model": "deepseek/deepseek-r1-distill-llama-70b"
  },
  "response": {
    "content": "**Security Guidance: Protecting Against Phishing Attacks on Google App Engine**\n\n**1. Security Best Practices**\n   - **Verify Links:** Always check the URL by hovering over links before clicking. Look for 'https' and legitimate domains.\n   - **Multi-Factor Authentication (MFA):** Enable MFA for an added security layer.\n   - **Educate Employees:** Regular security training can help recognize phishing attempts.\n   - **Keep Software Updated:** Regularly update software and browsers to protect against vulnerabilities.\n   - **Antivirus Use:** Install reputable antivirus software for malware detection.\n\n**2. Data Protection Recommendations**\n   - **Secure Storage:** Use encrypted solutions for sensitive data.\n   - **Encryption:** Encrypt data both at rest and in transit.\n   - **Backups:** Schedule regular backups and test them periodically.\n   - **Access Control:** Implement least privilege access to minimize data exposure.\n   - **Data Loss Prevention:** Use DLP tools to monitor and prevent unauthorized data transfers.\n   - **Monitoring:** Employ tools to detect unusual access patterns.\n\n**3. Safe Usage Guidelines**\n   - **Spot Phishing Attempts:** Be alert to generic greetings, grammatical errors, and urgent requests.\n   - **Avoid Credentials Entry:** Refrain from entering login details on unfamiliar sites.\n   - **Unique Passwords:** Use strong, unique passwords for each account; consider a password manager.\n   - **Payment Caution:** Never pay for services via links in unsolicited emails.\n   - **Link Caution:** Avoid clicking on links from unknown emails; verify legitimacy first.\n\n**4. Common Security Risks and Prevention**\n   - **Legitimate Services Misuse:** Phishers use trusted platforms like Google App Engine; be vigilant.\n   - **Soft Routing in App Engine:** Attackers exploit URL structures; ensure your organization monitors for such activities.\n   - **Sophisticated Attacks:** Multiple login attempts may redirect to legitimate support pages; educate users on this tactic.\n\n**5. Privacy Protection Measures**\n   - **Email Privacy:** Protect email addresses from public exposure.\n   - **PII Handling:** Use Privacy-Enhancing Techniques (PETs) and PIMs for sensitive processes.\n   - **Account Privacy:** Regularly review and adjust privacy settings on accounts.\n   - **Monitoring:** Keep an eye out for unauthorized account access or changes.\n\n**6. When to Seek Additional Security Support**\n   - **Incident Response:** If compromised, change passwords, report incidents, and notify IT.\n   - **Expert Engagement:** Consult security experts for risk assessments, incident response, and training.\n   - **Hosting Concerns:** Monitor for hosting on legitimate platforms (e.g., App Engine) and report suspicious activities promptly.\n\nThis guidance is designed to be applicable to both individuals and organizations, addressing specific tactics used by phishers, such as personalized emails and the use of appspot.com. Stay informed and proactive to enhance your security posture.",
    "usage": {
      "prompt_tokens": 1405,
      "completion_tokens": 1103,
      "total_tokens": 2508
    },
    "model": "deepseek/deepseek-r1-distill-llama-70b"
  }
}