---
type: concept
title: Phishing Prevention
tags: [security, email, social-engineering, phishing]
related: [e-mail-sicherheit, phishing, universitatsrechenzentrum-urz, email-spam-virus-protection]
created: 2026-06-30
updated: 2026-06-30
sources: ["output/rz_uni_greifswald_de_dienste_allgemein_e_mail_e_mail_sicherheit_bedrohung_durch_.md", "output/rz_uni_greifswald_de_dienste_allgemein_e_mail_e_mail_sicherheit_phishingseiten_e.md", "output/rz_uni_greifswald_de_dienste_allgemein_e_mail_spam_virenschutz.md"]
---

# Phishing Prevention

Phishing is a social engineering technique where attackers create fraudulent emails and websites that mimic official services to steal sensitive information, such as login credentials. Prevention at the Universität Greifswald involves a combination of technical filtering, institutional safeguards, and user awareness.

## Phishing vs. Spam
A critical distinction is made between mass-spam and phishing:
- **Spam:** Large-scale, non-targeted distribution of unsolicited messages (characterized by global mass-mailings).
- **Phishing:** Targeted attacks on specific users designed to steal user credentials.

Because phishing emails are targeted and often personalized, they frequently avoid the patterns of mass-spam and bypass standard spam filters. Consequently, technical filters alone are insufficient for phishing prevention.

## Detection Red Flags
According to the [[universitatsrechenzentrum-urz]], malicious emails can often be identified by the following indicators:
- **Address Anomalies:** Cryptic character strings in the email address or a mismatch between the displayed sender name and the actual email address.
- **Content Quality:** Poor spelling, grammar, or unusual phrasing.
- **Communication Patterns:** Greetings or sign-offs that are inconsistent with the sender's usual style.
- **Technical Deception:** Attachments with double extensions (e.g., `document.pdf.exe`).
- **Call to Action:** Requests to enter credentials or sensitive data on external websites.

## URL Verification Rule
The most reliable way to identify a legitimate university-hosted page is to examine the browser's address bar. A legitimate URL must adhere to the following structural rule:

**The domain must be `uni-greifswald.de`, and the first single forward slash (`/`) must appear immediately after the `.de` suffix.**

- **Legitimate Example:** `https://groupware.uni-greifswald.de/`
- **Phishing Indicator:** Any URL where the first slash does not immediately follow the `.de` domain is fraudulent.

## Institutional Safeguards (Universität Greifswald)
The following rules and tools are used to prevent phishing:
- **Credential Policy:** The URZ and the university will never ask for login credentials via email.
- **Identity Verification:** The URZ uses [[smime]] and digital certificates to sign official emails. Unsigned emails from the URZ should be treated with skepticism.
- **URL Compliance:** Users are advised to avoid the entry of credentials on any page that does not meet the official URL criteria described above.

## Mitigation and Response Strategies

### User Actions
- **Immediate Deletion/Non-Reaction:** Suspicious emails should be deleted immediately without clicking links or opening attachments; users are urgently requested not to react to suspected phishing emails.
- **Out-of-Band Verification:** If an email from a known contact seems suspicious, the recipient should verify the request through a different communication channel (e.g., phone call).
- **Technical Isolation:** Opening Office documents in isolated viewers (like browser-based viewers) prevents the automatic execution of malicious macros.
- **Reporting:** If a phishing attempt is detected, users should report the suspicious activity to the [[universitatsrechenzentrum-urz]] via the [[groupware]] ticket system or the institutional hotline.

### Technical Response
- **Targeted Blocking:** When phishing is reported, the URZ attempts to implement individual filters as quickly as possible to block the specific attack.
- **Technical Redundancy:** While the central spam filter handles mass mailings, phishing requires a different response strategy based on reporting and targeted blocking.