Protecting Against Spam and Phishing Emails

Spam and phishing emails have become significant problems for every computer user. Beyond wasting users' time clearing out unsolicited messages, these suspicious and malicious emails may also expose them to inappropriate content, download and install malware onto their computers, or trick them into providing personal information that fraudsters may later take advantage of.

We have received reports of phishing emails that spoof CINNOX circulating in the wild. These emails attempt to trick unwitting users into clicking on a suspicious link. As a CINNOX user, you need to be aware of these types of attack attempts and be able to distinguish legitimate CINNOX emails from fraudulent ones.

 

Below are ways to determine if a CINNOX email message you receive is legitimate. You may also use these steps to check your other email messages.

Check the content

CINNOX will never ask you to share with us private or confidential information such as your passwords, credit card details, or social security number.

Cybercriminals also often use an alarmist tone in the spam or phishing emails they send because they want to pressure their potential victims to immediately open an attachment or click on a link. An example of such a tone is the threat of immediate account suspension if the victim does not provide their login credentials.

While CINNOX often sends system and account notifications such as reminders to change passwords, the tone of our messages is straightforward.

 

Check the sender

As a general rule, you should always check the From field of an email message. However, since cybercriminals can spoof this field in their attacks, you also need to check the sender domain and even the email headers to verify where an email is sent from.

CINNOX emails use the @cinnox.com domain.

Below is a sample valid no-reply CINNOX email to a customer.

Good 👍

Fake 👎

 

Check the hyperlinks

CINNOX emails may sometimes contain URLs, such as when a new service has been created. Unfortunately, cybercriminals also use fake URLs to hide the real hyperlinks that lead unsuspecting victims to phishing pages or malicious sites where they may automatically download malware into their computers.

If you have to click on a link in an email message, hover over it first to see if the URL shown on the message matches the actual hyperlink.

The links in our email messages all point to any of the domains mentioned earlier. Clicking on them will lead you to our websites that use a secure connection (HTTPS).

Good 👍

Fake 👎

If you have received a spam or phishing email purporting to be from us, contact our CINNOX Support Team at [email protected].

 

References

• https://www.infosec.gov.hk/en/best-practices/person/protecting-against-spam-emails
• https://blog.comodo.com/email-security/what-is-email-spam
• https://www.trendmicro.com/vinfo/hk/security/news/cybercrime-and-digital-threats/best-practices-identifying-and-mitigating-phishing-attacks