Phishing & Crypto Scam Glossary

Address poisoning: Address poisoning is a scam in which the attacker plants a look-alike wallet address in the victim's transaction history so the victim copies it for the next payment.
BIMI: BIMI (Brand Indicators for Message Identification) lets a domain with an enforcing DMARC policy publish a logo that supporting mail clients show next to authenticated messages.
Bulletproof hosting: Bulletproof hosting is a hosting or domain service that knowingly ignores abuse reports, so phishing and malware sites stay online after they are reported.
Business email compromise (BEC): Business email compromise (BEC) is fraud in which an attacker uses a hijacked or spoofed company mailbox to make staff pay fake invoices or change bank details.
Certificate Transparency: Certificate Transparency (CT) is the public, append-only logging of every TLS certificate a trusted authority issues, which lets defenders spot new phishing domains the moment they get a certificate.
ClickFix: ClickFix is a social-engineering technique in which a web page tells the visitor to fix a fake error by pasting a command (copied to the clipboard by the page) into the Run dialog or a terminal, which installs malware.
Cloaking: Cloaking is showing different content to different visitors, so a phishing site serves the real lure to targets and a harmless page to scanners, moderators and researchers.
Defanging: Defanging is rewriting a malicious URL, domain or email address (for example hxxps://evil[.]com) so it cannot be clicked or auto-linked while it is shared.
Device code phishing: Device code phishing abuses the OAuth device authorisation flow: the attacker sends the victim a real sign-in code page, and when the victim enters the code the attacker's session receives the tokens.
DKIM: DKIM (DomainKeys Identified Mail) adds a cryptographic signature to outgoing email so receivers can verify, with a public key in DNS, that the message came from the domain and was not altered.
DMARC: DMARC is a DNS-published email policy that tells receivers what to do with messages that fail SPF and DKIM alignment for a domain, and reports such failures back to the owner.
Domain generation algorithm (DGA): A domain generation algorithm (DGA) lets malware compute a new list of rendezvous domains every day, so defenders cannot block a fixed address.
Drainer-as-a-service: Drainer-as-a-service (DaaS) is a criminal business model in which a developer rents a wallet-drainer kit to affiliates and takes a percentage of every theft.
EPP status codes: EPP status codes are the flags a registry or registrar sets on a domain (such as clientHold, serverHold or clientTransferProhibited) that show whether it can resolve, be transferred or be changed.
Fake airdrop: A fake airdrop is a phishing page that announces free tokens or an eligibility check, so that visitors connect their wallet and sign a request that drains it.
Fake CAPTCHA: A fake CAPTCHA is a verification screen imitating Cloudflare or reCAPTCHA that hides a phishing page from scanners or tells the visitor to run a malicious command.
Fast flux: Fast flux is a DNS technique that rotates the IP addresses behind a domain every few minutes across many compromised hosts, so taking one server down does not take the site offline.
Favicon hash: A favicon hash is a fingerprint (usually MurmurHash3 of the base64 icon) of a site's favicon that lets investigators find other sites using the same icon, a common trait of phishing kits.
Homoglyph: A homoglyph is a character that looks like another one (Cyrillic а and Latin a, or rn and m), and phishing domains use homoglyphs to imitate a brand's real domain.
Ice phishing: Ice phishing is a crypto attack in which the victim is tricked into approving a malicious spender instead of sending funds, so the theft happens later through the approval.
Indicator of compromise (IOC): An indicator of compromise (IOC) is an observable artifact, such as a domain, URL, IP address, file hash or wallet address, that identifies malicious activity and can be blocked or searched for.
MTA-STS: MTA-STS (Mail Transfer Agent Strict Transport Security) is a policy that tells sending mail servers to deliver to a domain only over TLS with a valid certificate, preventing downgrade and interception.
OAuth consent phishing: OAuth consent phishing gets a user to grant a malicious third-party app access to their mailbox or files through a genuine Microsoft or Google consent screen, without stealing the password.
Permit phishing: Permit phishing tricks a wallet owner into signing an off-chain EIP-2612 permit message that authorises the attacker to spend the owner's tokens.
Permit2: Permit2 is Uniswap's shared token-approval contract, and in phishing it is abused to obtain one signature that lets the attacker move several tokens the victim has already approved to Permit2.
Phishing kit: A phishing kit is a ready-made package of pages and scripts that copies a brand's login or wallet flow and sends whatever the victim enters to the operator.
Pig butchering: Pig butchering is a long-con investment scam in which the fraudster builds a relationship with the victim, then steers them to a fake trading or investment platform that shows invented profits.
Punycode: Punycode is the ASCII encoding (starting with xn--) of an internationalised domain name, and phishing campaigns register punycode domains that display as look-alikes of real brands.
Quishing: Quishing is phishing through a QR code, so the malicious link is hidden in an image that email filters and users cannot read at a glance.
RDAP: RDAP (Registration Data Access Protocol) is the JSON successor of WHOIS that returns a domain's registrar, dates, status and abuse contact.
Recovery scam: A recovery scam targets people who already lost money, promising to get it back (as lawyers, hackers or "blockchain investigators") in exchange for upfront fees.
Safe Links: Safe Links is Microsoft Defender's URL rewriting in email, and phishing analysts need to decode such wrapped links to see the real destination.
Seed phrase phishing: Seed phrase phishing is a fake wallet, support or "recovery" page that asks the victim to type the 12- or 24-word recovery phrase, which gives the attacker the whole wallet.
setApprovalForAll: setApprovalForAll is the ERC-721/ERC-1155 call that gives another address control of every NFT in a collection, and phishing sites request it to steal whole NFT holdings at once.
Smishing: Smishing is phishing by SMS or chat message, typically a fake delivery notice, bank alert or toll fine with a link to a credential or card-theft page.
SPF: SPF (Sender Policy Framework) is a DNS TXT record listing the servers allowed to send mail for a domain, so receivers can reject mail from other sources.
STIX: STIX (Structured Threat Information Expression) is the OASIS JSON standard for sharing threat intelligence such as indicators, malware and campaigns between tools.
Telegram exfiltration: Telegram exfiltration is the practice of phishing kits sending stolen passwords, card numbers or seed phrases straight to the operator through a Telegram bot.
Traffic distribution system (TDS): A traffic distribution system (TDS) is a redirect server that decides, per visitor, whether to send them to a scam or malware page or to a harmless one.
Typosquatting: Typosquatting is the registration of domains that differ from a real domain by a typo, a swapped or extra letter, a hyphen or another TLD, to catch mistyped visits and to make phishing links look familiar.
Wallet drainer: A wallet drainer is a phishing kit that gets a crypto user to sign a transaction or message which lets the attacker move the victim's tokens and NFTs.

Phishing and crypto scam glossary