the email digitally signed by a legitimate domain? If the email is digitally signed, it will show “signed-by” some domain name.

If the email is digitally signed, we should verify the ownership information of the domain that signs the email. One can look for publicly available whois information of the domain and find out who actually owns the domain. We should be alert if a legitimate authority does not own the domain.

We should also look for the same information for “notice.gov.com” and find out the actual domain, the sub-domain, and who owns the domain.

If, for privacy reasons, the ownership information is not available, then we should find out the IP address from the DNS record and find out whether the IP address is blacklisted or involved in sending spam or other cybercrimes. Sometimes, doing simple searches on a search engine reveals lots of information.

In this example, the attackers have used a .gov subdomain of the domain notice.com. However, it appears to a victim that .notice is a subdomain of a legitimate government-owned domain.

We should also look at the email header to see if the reply-to address differs from the sending email address. Sometimes, attackers use various techniques to spoof a legitimate email address. However, in doing so, they cannot receive the responses sent by the recipient. If the recipient of the email sends any response, it will reach the legitimate email address instead. So, to circumvent the issue, they spoof a legitimate email address and use their own email address as a reply-to address.

If the reply-to address is different from the sending email address, the user should look for the domain information mentioned in the reply-to address.

The above detection technique may seem trivial, but if a user can follow the above steps for emails sent by unknown senders, he can significantly protect himself from phishing scams.

2. There is another small warning sign in the email. The email does not mention the name of the recipient. It is very unlikely. If an official email of such importance is sent to a user, it is very likely that at least the name of the recipient will be mentioned in the email.

Phishing emails often do not mention the name of the recipients because attackers manage to obtain or buy the email addresses of potential victims in bulk from a data breach or by other cybercrimes. But, they fail to collect the names of the victims. So, they compose phishing messages like this to circumvent the issue.

3. Also, one can notice the social engineering techniques used in this phishing email. The attackers here impersonate a legitimate authority and ask the user to pay a fine for which very few details are given. Attackers here create a sense of urgency and curiosity to deceive a victim in opening the attachment. The attachment undoubtedly contains malware that can infect the victim’s system to steal sensitive data.

Phishing Prevention

1. If you are unsure of the email, please visit the legitimate government portal by typing the URL in the address bar of the browser and providing your vehicle’s registration number to find out if there are any traffic violations.

2. If you are still unsure about the email, you can create a virtual machine in an updated system and isolate the virtual machine from the rest of the devices of your local network. You can also create a sandbox and open the attachment to see if it is legitimate. After that, you should delete the virtual machine.

In fact, using a virtual machine to browse the Internet is always a good practice. You can always delete a virtual machine or revert it to a previously taken snapshot if some malware infects the machine.

3. It is also important to update the browser, operating system, and other commonly used software to the latest patches. The more updated software is, the fewer its known security vulnerabilities. Attackers often use these security vulnerabilities to infect a system.

4. Use good anti-malware programs from trusted sources and update them regularly. It is always good to turn on real-time protection so that even if you accidentally click on a malicious link, you stay protected. You can also use a good anti-phishing software.

5. Configure firewall on your system properly and restrict unauthorized programs from accessing the Internet. In fact, it is …