DMARC Record Missing Alerts

Have you heard of DMARC?  It is the newest way to protect your email delivery and online reputation from delivery failures, misconfigurations and fraud and phishing attempts.  If you aren’t using DMARC, you are at risk from email delivery failures.  Learn more about DMARC, DMARC Compliance and Email Delivery.

Since DMARC is such a pivotal technology, we have decided that our customers need to be alerted when it is not configured.   Therefore all MX record lookups will show a critical warning when a DMARC record is not found (see below).  Paid users with MX monitors will receive critical alerts that a DMARC record is missing or misconfigured for their domain.

DMARC record missing.png

MxToolbox experts feel that DMARC is critical to your business success.  Our team is ready to help you with your DMARC configuration and transition to a focus on proactive email delivery management.  Our most recent products MxToolbox Delivery Center and MxToolbox Fraud Center leverage DMARC to improve your email delivery and protect your brand from email fraud.

Source: MXtoolbox

SQLi Vulnerability in YITH WooCommerce Wishlist

SQLi Vulnerability in YITH WooCommerce WishlistAs part of our regular research audits for our Sucuri Firewall, we discovered an SQL Injection vulnerability affecting the YITH WooCommerce Wishlist plugin for WordPress. This plugin allows visitors and potential customers to make wish lists containing products in the WooCommerce store, and is currently installed on 500,000+ websites.

Are You at Risk?

This vulnerability is caused by the lack of sanitization of user provided data in versions below 2.2.0.

Continue reading SQLi Vulnerability in YITH WooCommerce Wishlist at Sucuri Blog.

Source: Scuri check

What is Email Phishing?

There has been a lot of discussion about Email Fraud and Phishing lately.  Email is still the largest threat vector for hacking and information theft.  Email phishing is one of the best way to obtain access to accounts, but what is email phishing really?

Phishing is when a 3rd party, typically a hacker or malicious website, uses the brand identity of a company to lull a user into exposing private information.  Phishing emails target email address with an email that looks just like a legitimate service provider to implant malware in a download or obtain login credentials for that domain.  For example, you might receive an email that looks like it comes from a financial institution like Paypal (see mine below) asking you to download a document or go to a link to stop or start a transaction, or change your password.

phishing example

Example Phishing Email

Identifying Phishing Emails

Phishing groups and hackers are constantly changing their patterns to improve both their targeting and the effectiveness of their emails in order to exploit users, but there are a few characteristics in common for every phishing email.

Phishing emails leverage a strong brand

In my example, the “From” email address used Paypal’s, but I have seen it with many big brands, especially in credit cards, financial, banking and insurance industries.  Ask yourself:  Do you really have an account? Is this the email address for that account? Have you done anything with the account lately?

There is a sense of urgency

The email will require you to “act soon” or it will cost you money.  This sense of urgency makes you react before you think.  Take a breath before acting on any email that looks really important.  

Quality Varies

Some phishing emails, like the one above, look good on the surface.  For example, the logos look correct, the fonts and color scheme are appropriate and some of the language is even straight from legitimate emails.  However, when you read deeper you can see spelling mistakes, grammatical errors or other areas where it is clear the writer was not a native English speaker.  Notice above that “DeLL” is not written correctly nor is the phrase “This not you?” proper English.  Take a moment to read the information presented in the email and check grammar and spelling.

“From” domain and Return Path Domain will not match

It is relatively easy to spoof a “From” address.  Email Standards allow 3rd party emailers to send email on behalf of another domain, otherwise inbox providers like Google and Outlook.com or bulk email providers could not send email for the business or personal domains they host.  If “From” and Return Path do not match and the Return Path looks random or shady, it’s a good chance you have a phishing email.  Further, most companies will not use a 3rd party to send important account information emails like the one above, but their own internal servers.  Check the Return Path email address in the header to see if it looks legitimate.

There is an attachment

If you are required to download anything that you did not ask the company for, then it is probably a phishing email and may contain malware.  Even PDFs or DOCs can contain malware payloads.  At minimum, they are trying to lull you into thinking that their fake document is valid so that they can get personal, private or financial data from you.  Do not download attachments you did not ask for.

Links on the page go to a different domain

Often a phishing email will include a link to a 3rd or 4th domain or just to an IP address.  The goal here is to get you to click unsuspectedly on any link so they can further the con and grab your information when you attempt to login to their fake website.  Sometimes the domains even look like subdomains or related domains.  Always check links before clicking on them.  If in doubt of any link, open a clean window and navigate to the company’s website and login to your account from there to check on the issue.  

About MxToolbox

MxToolbox is the expert in email delivery, including the prevention of fraud and phishing.  Our focus is to help companies reduce the threat to their brand so that their customers, users and employees can trust that emails “From” their domain are legitimate.  Our Fraud Center product leverages international standards DMARC, DKIM and SPF combined with cutting edge algorithms to help small-enterprise companies halt phishing emails from their domain.  Learn More


Source: MXtoolbox

VirusTotal Graph

VirusTotal receives a large number of files and URLs every day, and each of them is analyzed by AVs and other tools and sandboxes to extract information about them. This information is critical for our ecosystem, as it connects the dots and makes clear the connections between entities.


It is common to pivot over many data points (files, URLs, domains and IP addresses) to get the full picture of your investigation, and this usually involves looking at multiple reports at the same time. We know this can be complicated when you have many open tabs, therefore, we’ve developed VirusTotal Graph.


It is a visualization tool built on top of VirusTotal’s data set. It understands the relationship between files, URLs, domains and IP addresses and it provides an easy interface to pivot and navigate over them.



By exploring and expanding each of the nodes in your graph, you can build the network and see the connections across the samples you are studying. By clicking on the nodes, you can see at a glance the most relevant information for each item. You can also add labels and see an in-depth report by going to VirusTotal Public or VirusTotal Intelligence report.


The tool is available in https://www.virustotal.com/graph/ or through a public report in the tool section (VirusTotal login is required):



You can save the graphs, so that you can go back to your investigation any time and share your findings with other users. By clicking in the bottom right corner we generate a permalink which loads the graph as you see it in your screen. All saved graphs are public and linked in VirusTotal public report when the file, URL, IP address or domain appear in the graph. We feel the community will benefit from this intelligence. We understand that there are scenarios where a higher degree of privacy is needed, and we are working on a solution — expect to see some news around it soon.
The documentation is available at


These are two YouTube videos explaining the main features:
Files Tutorial 1 – https://youtu.be/QEqHXU04IkI
Domain Tutorial 2 – https://youtu.be/xe2busIlkP4
Last but not least, we are still in an early stage of the tool and we’d be delighted to receive your feedback/comments here.

Source: VirusTotal

Malicious Website Cryptominers from GitHub. Part 2.

Malicious Website Cryptominers from GitHub. Part 2.Recently we wrote about how GitHub/GitHub.io was used in attacks that injected cryptocurrency miners into compromised websites. Around the same time, we noticed another attack that also used GitHub for serving malicious code.

Encrypted CoinHive Miner in Header.php

The following encrypted malware was found in the header.php file of the active WordPress theme:

There are four lines of code in total. Each, when decoded, plays a different role.

CoinHive Injections

When decoded, the last two lines inject typical CoinHive cryptocurrency miners:

The miner is only shown conditionally, so bots are excluded and only human visitors will receive it.

Continue reading Malicious Website Cryptominers from GitHub. Part 2. at Sucuri Blog.

Source: Scuri check