# Phishing and crypto scam glossary

41 terms used in phishing, crypto-drainer and abuse-reporting work, each with a one-sentence definition, how it works, a real example from the PhishDestroy database where one exists and how to protect yourself.
- [Address poisoning](https://phishdestroy.io/glossary/address-poisoning/): Address poisoning is a scam in which the attacker plants a look-alike wallet address in the victim's transaction history so the victim copies it for the next payment.
- [BIMI](https://phishdestroy.io/glossary/bimi/): BIMI (Brand Indicators for Message Identification) lets a domain with an enforcing DMARC policy publish a logo that supporting mail clients show next to authenticated messages.
- [Bulletproof hosting](https://phishdestroy.io/glossary/bulletproof-hosting/): Bulletproof hosting is a hosting or domain service that knowingly ignores abuse reports, so phishing and malware sites stay online after they are reported.
- [Business email compromise (BEC)](https://phishdestroy.io/glossary/bec/): Business email compromise (BEC) is fraud in which an attacker uses a hijacked or spoofed company mailbox to make staff pay fake invoices or change bank details.
- [Certificate Transparency](https://phishdestroy.io/glossary/certificate-transparency/): Certificate Transparency (CT) is the public, append-only logging of every TLS certificate a trusted authority issues, which lets defenders spot new phishing domains the moment they get a certificate.
- [ClickFix](https://phishdestroy.io/glossary/clickfix/): ClickFix is a social-engineering technique in which a web page tells the visitor to fix a fake error by pasting a command (copied to the clipboard by the page) into the Run dialog or a terminal, which installs malware.
- [Cloaking](https://phishdestroy.io/glossary/cloaking/): Cloaking is showing different content to different visitors, so a phishing site serves the real lure to targets and a harmless page to scanners, moderators and researchers.
- [Defanging](https://phishdestroy.io/glossary/defanging/): Defanging is rewriting a malicious URL, domain or email address (for example hxxps://evil[.]com) so it cannot be clicked or auto-linked while it is shared.
- [Device code phishing](https://phishdestroy.io/glossary/device-code-phishing/): Device code phishing abuses the OAuth device authorisation flow: the attacker sends the victim a real sign-in code page, and when the victim enters the code the attacker's session receives the tokens.
- [DKIM](https://phishdestroy.io/glossary/dkim/): DKIM (DomainKeys Identified Mail) adds a cryptographic signature to outgoing email so receivers can verify, with a public key in DNS, that the message came from the domain and was not altered.
- [DMARC](https://phishdestroy.io/glossary/dmarc/): DMARC is a DNS-published email policy that tells receivers what to do with messages that fail SPF and DKIM alignment for a domain, and reports such failures back to the owner.
- [Domain generation algorithm (DGA)](https://phishdestroy.io/glossary/dga/): A domain generation algorithm (DGA) lets malware compute a new list of rendezvous domains every day, so defenders cannot block a fixed address.
- [Drainer-as-a-service](https://phishdestroy.io/glossary/drainer-as-a-service/): Drainer-as-a-service (DaaS) is a criminal business model in which a developer rents a wallet-drainer kit to affiliates and takes a percentage of every theft.
- [EPP status codes](https://phishdestroy.io/glossary/epp-status/): EPP status codes are the flags a registry or registrar sets on a domain (such as clientHold, serverHold or clientTransferProhibited) that show whether it can resolve, be transferred or be changed.
- [Fake airdrop](https://phishdestroy.io/glossary/airdrop-scam/): A fake airdrop is a phishing page that announces free tokens or an eligibility check, so that visitors connect their wallet and sign a request that drains it.
- [Fake CAPTCHA](https://phishdestroy.io/glossary/fake-captcha/): A fake CAPTCHA is a verification screen imitating Cloudflare or reCAPTCHA that hides a phishing page from scanners or tells the visitor to run a malicious command.
- [Fast flux](https://phishdestroy.io/glossary/fast-flux/): Fast flux is a DNS technique that rotates the IP addresses behind a domain every few minutes across many compromised hosts, so taking one server down does not take the site offline.
- [Favicon hash](https://phishdestroy.io/glossary/favicon-hash/): A favicon hash is a fingerprint (usually MurmurHash3 of the base64 icon) of a site's favicon that lets investigators find other sites using the same icon, a common trait of phishing kits.
- [Homoglyph](https://phishdestroy.io/glossary/homoglyph/): A homoglyph is a character that looks like another one (Cyrillic а and Latin a, or rn and m), and phishing domains use homoglyphs to imitate a brand's real domain.
- [Ice phishing](https://phishdestroy.io/glossary/ice-phishing/): Ice phishing is a crypto attack in which the victim is tricked into approving a malicious spender instead of sending funds, so the theft happens later through the approval.
- [Indicator of compromise (IOC)](https://phishdestroy.io/glossary/ioc/): An indicator of compromise (IOC) is an observable artifact, such as a domain, URL, IP address, file hash or wallet address, that identifies malicious activity and can be blocked or searched for.
- [MTA-STS](https://phishdestroy.io/glossary/mta-sts/): MTA-STS (Mail Transfer Agent Strict Transport Security) is a policy that tells sending mail servers to deliver to a domain only over TLS with a valid certificate, preventing downgrade and interception.
- [OAuth consent phishing](https://phishdestroy.io/glossary/oauth-consent-phishing/): OAuth consent phishing gets a user to grant a malicious third-party app access to their mailbox or files through a genuine Microsoft or Google consent screen, without stealing the password.
- [Permit phishing](https://phishdestroy.io/glossary/permit-phishing/): Permit phishing tricks a wallet owner into signing an off-chain EIP-2612 permit message that authorises the attacker to spend the owner's tokens.
- [Permit2](https://phishdestroy.io/glossary/permit2/): Permit2 is Uniswap's shared token-approval contract, and in phishing it is abused to obtain one signature that lets the attacker move several tokens the victim has already approved to Permit2.
- [Phishing kit](https://phishdestroy.io/glossary/phishing-kit/): A phishing kit is a ready-made package of pages and scripts that copies a brand's login or wallet flow and sends whatever the victim enters to the operator.
- [Pig butchering](https://phishdestroy.io/glossary/pig-butchering/): Pig butchering is a long-con investment scam in which the fraudster builds a relationship with the victim, then steers them to a fake trading or investment platform that shows invented profits.
- [Punycode](https://phishdestroy.io/glossary/punycode/): Punycode is the ASCII encoding (starting with xn--) of an internationalised domain name, and phishing campaigns register punycode domains that display as look-alikes of real brands.
- [Quishing](https://phishdestroy.io/glossary/quishing/): Quishing is phishing through a QR code, so the malicious link is hidden in an image that email filters and users cannot read at a glance.
- [RDAP](https://phishdestroy.io/glossary/rdap/): RDAP (Registration Data Access Protocol) is the JSON successor of WHOIS that returns a domain's registrar, dates, status and abuse contact.
- [Recovery scam](https://phishdestroy.io/glossary/recovery-scam/): A recovery scam targets people who already lost money, promising to get it back (as lawyers, hackers or "blockchain investigators") in exchange for upfront fees.
- [Safe Links](https://phishdestroy.io/glossary/safe-links/): Safe Links is Microsoft Defender's URL rewriting in email, and phishing analysts need to decode such wrapped links to see the real destination.
- [Seed phrase phishing](https://phishdestroy.io/glossary/seed-phrase-phishing/): Seed phrase phishing is a fake wallet, support or "recovery" page that asks the victim to type the 12- or 24-word recovery phrase, which gives the attacker the whole wallet.
- [setApprovalForAll](https://phishdestroy.io/glossary/setapprovalforall/): setApprovalForAll is the ERC-721/ERC-1155 call that gives another address control of every NFT in a collection, and phishing sites request it to steal whole NFT holdings at once.
- [Smishing](https://phishdestroy.io/glossary/smishing/): Smishing is phishing by SMS or chat message, typically a fake delivery notice, bank alert or toll fine with a link to a credential or card-theft page.
- [SPF](https://phishdestroy.io/glossary/spf/): SPF (Sender Policy Framework) is a DNS TXT record listing the servers allowed to send mail for a domain, so receivers can reject mail from other sources.
- [STIX](https://phishdestroy.io/glossary/stix/): STIX (Structured Threat Information Expression) is the OASIS JSON standard for sharing threat intelligence such as indicators, malware and campaigns between tools.
- [Telegram exfiltration](https://phishdestroy.io/glossary/telegram-exfil/): Telegram exfiltration is the practice of phishing kits sending stolen passwords, card numbers or seed phrases straight to the operator through a Telegram bot.
- [Traffic distribution system (TDS)](https://phishdestroy.io/glossary/tds/): A traffic distribution system (TDS) is a redirect server that decides, per visitor, whether to send them to a scam or malware page or to a harmless one.
- [Typosquatting](https://phishdestroy.io/glossary/typosquatting/): Typosquatting is the registration of domains that differ from a real domain by a typo, a swapped or extra letter, a hyphen or another TLD, to catch mistyped visits and to make phishing links look familiar.
- [Wallet drainer](https://phishdestroy.io/glossary/wallet-drainer/): A wallet drainer is a phishing kit that gets a crypto user to sign a transaction or message which lets the attacker move the victim's tokens and NFTs.

Canonical: https://phishdestroy.io/glossary/