by Charles Oropallo | May 17, 2025 | Internet, Security
Cybercriminals are getting smarter every day. They’re not just sending those obvious “Nigerian Prince” emails anymore. Today’s scammers use sophisticated tactics that can fool even tech-savvy people.
Let’s break down the three main types of social engineering attacks you need to know about. We’ll cover phishing, smishing, and vishing – plus some sneaky new tricks that emerged in 2025.
What’s the Difference Between Phishing, Smishing, and Vishing?
Think of these three methods as different doors criminals use to break into your digital life. Each one targets a different communication channel you use every day.
Phishing happens through email and fake websites. Scammers impersonate trusted companies like your bank or Amazon. They’ll send urgent messages claiming your account needs immediate attention. The goal? Get you to click malicious links or download infected attachments.
Smishing uses text messages and messaging apps like WhatsApp. These texts often claim your package is delayed or your account is compromised. They include suspicious links that steal your information when clicked.
Vishing involves phone calls or voicemails. Scammers pretend to be from your bank, tech support, or government agencies. They use high-pressure tactics to make you reveal passwords or account numbers over the phone.
How Phishing Really Works (It’s More Clever Than You Think)
Modern phishing emails look incredibly convincing. Scammers copy official logos, use proper grammar, and mirror legitimate company websites perfectly.
Here’s a real example: You receive an email from “PayPal” saying someone tried to access your account. The email looks authentic, complete with PayPal’s logo and formatting. It includes a link to “verify your identity.”
But when you click that link, you land on a fake PayPal login page. The moment you enter your credentials, criminals capture them. Within minutes, they’re accessing your real PayPal account.
The scary part? These fake websites often use HTTPS encryption, so you’ll see that “secure” lock icon in your browser. Don’t let that fool you – criminals can get SSL certificates too.
Smishing: Why Text Message Scams Work So Well
People trust text messages more than emails. We’re conditioned to respond quickly to texts, especially ones that seem urgent.
Smishing attacks often use shortened URLs like bit.ly links. These hide the real destination, making it impossible to see where you’re actually going. The messages create artificial urgency: “Your package will be returned if you don’t respond in 24 hours!”
Here’s what makes smishing particularly dangerous: Most people don’t have security software on their phones like they do on computers. This makes mobile devices easier targets for malicious websites and downloads.
Think about how many important accounts are linked to your phone number. Your bank, email, social media – they all send verification codes via text. Criminals know this and exploit it ruthlessly.
Vishing: The Human Touch That Breaks Down Your Defenses
Voice phishing feels the most personal and urgent. There’s something about hearing another person’s voice that makes threats feel real and immediate.
Skilled vishers study their targets beforehand. They might know your name, where you bank, or recent purchases you’ve made. This inside knowledge makes their calls incredibly convincing.
Caller ID spoofing makes these calls appear to come from legitimate numbers. Your phone might display your bank’s actual customer service line, even though the call is coming from a criminal’s burner phone.
The pressure tactics are intense. They’ll claim your account has been compromised and you need to verify information “right now” to prevent further damage. They might transfer you between different “departments” to make the scam feel more authentic.
The New Tricks Criminals Started Using in 2025
Artificial Intelligence changed the game completely. AI-powered phishing creates personalized messages that perfectly mimic your colleagues’ or friends’ writing styles. These aren’t generic scam emails – they’re tailored specifically for you.
Clone Phishing takes emails you’ve actually received before and creates malicious copies. Remember that legitimate email from your bank last month? Criminals recreate it exactly, but replace the links with dangerous ones. Since you recognize the format, you’re more likely to trust it.
Business Email Compromise (BEC) targets companies by impersonating executives. An employee receives an email that appears to come from their CEO, requesting an urgent wire transfer or asking for sensitive customer data. These attacks often don’t include any attachments – they rely purely on social manipulation.
Deepfake voice technology now lets criminals clone someone’s voice from just a few minutes of audio. They might call pretending to be your boss, using AI-generated speech that sounds exactly like them.
Red Flags That Scream “This Is a Scam”
Your gut instinct is often right. If something feels off, it probably is. Here are specific warning signs to watch for:
Urgent language designed to bypass your critical thinking. Phrases like “immediate action required,” “account will be closed,” or “respond within 24 hours” are huge red flags.
Requests for sensitive information through email or text. Legitimate companies never ask for passwords, Social Security numbers, or account details this way. They already have this information.
Generic greetings like “Dear Customer” instead of using your actual name. Real companies typically address you personally in important communications.
Shortened URLs or suspicious links. Hover over any link before clicking to see where it actually goes. Be especially wary of URLs with random characters or unfamiliar domains.
Grammar and spelling mistakes in messages from “professional” organizations. While scammers have gotten better at this, many still make obvious errors.
Your Defense Strategy: Simple Steps That Actually Work
For email phishing: Never click links in suspicious emails. Instead, go directly to the company’s website by typing their URL into your browser. If the issue is real, you’ll see it when you log into your account normally.
For smishing: Don’t click text message links from unknown numbers. If the message claims to be from a company you do business with, use their official app or website instead.
For vishing: Hang up and call back using the official number from the company’s website. Real representatives won’t mind you verifying their identity this way.
Enable two-factor authentication (2FA) on all important accounts. Even if criminals steal your password, they won’t be able to access your accounts without the second verification step.
Keep your software updated. This includes your operating system, web browser, and antivirus programs. Updates often fix security vulnerabilities that criminals exploit.
When in Doubt, Verify Through a Different Channel
Here’s the golden rule: If someone contacts you claiming there’s a problem, verify it independently. Don’t use the contact information they provide – look it up yourself.
Call your bank using the number on your debit card. Log into your accounts directly rather than clicking email links. Check with IT before responding to urgent requests from “executives.”
This simple habit will protect you from 99% of social engineering attacks. Criminals count on you responding immediately without thinking it through.
Protecting Your Business and Family
Share this information with your employees and family members. Cybercriminals often target less tech-savvy individuals to get access to business networks or family finances.
Create a family or workplace policy: Never give out sensitive information over the phone or via email without verification. Make it clear that taking time to verify suspicious requests is always acceptable.
Consider using a password manager and teaching others to do the same. This makes it much harder for criminals to access multiple accounts even if they steal one password.
Remember, you don’t have to become a cybersecurity expert to stay safe. Following these basic guidelines and trusting your instincts will keep you ahead of most scammers.
If you’re concerned about your business’s email security or need help implementing better protection policies, our email security consulting services can help you create a comprehensive defense strategy.
The key is staying informed and remaining skeptical of unsolicited contacts asking for information or immediate action. When criminals can’t pressure you into quick decisions, their tactics usually fail.
by Charles Oropallo | Jan 17, 2025 | Security, Technical Help
Recently, I encountered an issue while attempting to renew an SSL certificate for one of my domains, (let’s call it) testdomain.com, using Let’s Encrypt on a server running Virtualmin on Debian 12. The process was more complicated than I expected due to a small oversight that many others could easily make. This article details my experience, the errors I encountered due to Let’s Encrypt rate limits (which I didn’t know existed), and steps to avoid or resolve such issues.
The Problem: Let’s Encrypt Rate Limits for Failed Authorizations
A padlock that shows with an encrypted site using https in some browsers.Let’s Encrypt provides free SSL certificates for securing websites. However, it enforces rate limits to ensure fair usage and prevent abuse. While attempting to renew the SSL certificate for testdomain.com, I discovered that the DNS settings were not pointed to my server, causing repeated failed validation attempts. By the time I fixed the DNS settings, I had hit Let’s Encrypt’s rate limit for failed authorizations.
This limit restricts requests for the same domain to 5 failed attempts per hour. Once you hit this limit, you must wait for the cooldown period to expire before trying again.
How the Error Appeared in Virtualmin
In the Virtualmin interface, I attempted to renew the certificate by navigating to:
- Virtualmin > Server Configuration > SSL Certificate
- Clicking on the Let’s Encrypt tab
- Ensuring the domain and subdomain (e.g.,
testdomain.com and www.testdomain.com) were selected
- Clicking the Request Certificate button
The renewal process failed with an error that Virtualmin reported as “an unknown issue.” Upon further investigation, I found the detailed error logs in the Let’s Encrypt log file located at:
/var/log/letsencrypt/letsencrypt.log
From the log, I saw this message:
urn:ietf:params:acme:error:rateLimited :: There were too many requests of a given type :: too many failed authorizations (5) for "testdomain.com" in the last 1h0m0s, retry after [time].
Understanding Let’s Encrypt Rate Limits
Let’s Encrypt enforces several types of rate limits. Here are the key ones:
- Failed Validation Limit:
- 5 failed validations per domain per hour.
- This applies to any validation failure, such as DNS misconfigurations or inaccessible
.well-known/acme-challenge directories.
- Duplicate Certificate Limit:
- 5 identical certificates per week.
- If you request the same set of domains repeatedly, you’ll hit this limit.
- Certificates per Registered Domain:
- 50 certificates per registered domain per week.
- All subdomains count toward this limit.
- Account-Level Requests:
- 50 certificates per account per week.
These limits are described in detail at Let’s Encrypt’s rate limit documentation.
Diagnosing the Problem
If you encounter a similar issue, here are the steps to diagnose and resolve it:
1. Check DNS Settings
- Ensure the domain’s DNS A records correctly point to your server.
- Use tools like
dig or online DNS propagation checkers to verify.
2. Verify Webroot Accessibility
3. Examine Let’s Encrypt Logs
4. Check Cooldown Period
- If you’ve hit the rate limit, the log will indicate a
Retry-After time in UTC. Convert it to your local timezone to determine when you can retry.
5. Dry Run Your Request
Steps to Avoid Future Issues
1. Ensure DNS Settings Before Requesting Certificates
- Double-check that DNS records point to the correct server and have propagated globally before initiating an SSL request.
2. Test Webroot Configuration
- Verify that the
.well-known/acme-challenge/ directory is accessible for all domains you’re requesting.
3. Use the Dry-Run Option
- Always test with
--dry-run before making a live request to avoid hitting limits.
4. Automate Renewals
- Virtualmin and Certbot support automated renewals. Ensure the cron job is configured correctly and DNS remains stable.
5. Avoid Forcing Duplicate Requests
- Options like
--duplicate and --force-renewal can lead to unnecessary requests. Only use them when absolutely necessary.
Conclusion
Hitting Let’s Encrypt’s rate limits can be frustrating, but understanding the causes and solutions can save time and effort. By checking DNS settings, verifying webroot accessibility, and using dry runs, you can prevent failed authorizations and avoid cooldown periods.
If you’re using Virtualmin, remember to check the Let’s Encrypt logs for detailed error messages, and plan your certificate renewals carefully to stay within the rate limits. Hopefully, my experience with testdomain.com helps you navigate and prevent similar issues.
As always, proactive testing and attention to detail go a long way in maintaining a secure and smoothly running server.
by Charles Oropallo | Oct 18, 2024 | Do-It-Yourself
If you secure many sites with free Let’s Encrypt SSL, you may hit a wall. Suddenly, certificate requests stop cold. One day everything works. The next, you see rate-limit errors and wonder what happened.
Here’s the thing. Let’s Encrypt secures over 350 million websites with free SSL. To keep things stable and safe, they enforce strict rate limits. These limits can surprise even seasoned developers. They bite hardest when securing many domains or subdomains at once.
Understanding these limits prevents headaches. It also keeps your sites secure and your business running. I’ll explain what the limits mean. I’ll share five practical steps to avoid SSL issues before they happen.
What Are Let’s Encrypt Rate Limits?
Think of Let’s Encrypt rate limits like a busy restaurant. It can serve only so many guests each hour. They are not there to hassle you. They ensure fair access and protect the system.
The key limit is 50 certificates per registered domain every 7 days. “Registered domain” means your eTLD+1, or main domain. If you own example.com, all subdomains share that weekly pool. That includes www, blog, and shop subdomains.
That’s not the only limit. You get 5 failed validation attempts per domain per hour. Repeated failures trigger a temporary lockout. Common causes include DNS or firewall issues. There’s also a duplicate certificate limit of 5 per week. Renewals do not count against the 50-certificate quota.
Account creation is limited too: 10 accounts per IP every 3 hours. This prevents abuse through mass accounts. It can also affect legitimate teams that need several accounts.
Step 1: Use Wildcard Certificates for Multiple Subdomains
Here’s your first defense against rate limits. Use a single wildcard certificate, not many subdomain certificates. One wildcard covers all subdomains under your domain.
A wildcard for *.example.com secures www, blog, shop, and new subdomains. You issue only one certificate. This slashes issuance volume and stays within Let’s Encrypt limits.
Even better, a single certificate can list up to 100 domains. Managing many brands? Combine domains into fewer certificates. One cert can cover yourcompany.com, .net, and .org.
Look at your setup. Are you requesting one certificate per subdomain? If so, you burn limits quickly. Switching to wildcard certificates is often the top fix.
Step 2: Test in the Staging Environment First
Before deploying live, test in Let’s Encrypt’s staging environment. It’s a safe practice kitchen. Mistakes don’t affect customers.
Staging has relaxed limits: 50 new registrations per IP per 3 hours. Production allows only 10. Use staging to test SSL, fix DNS, and refine deployment.
Many teams skip this step in a rush to go live. That’s when rate-limit problems strike. You issue, it fails, you retry, and hit five failures. Now you must wait.
Follow this rule. Do not issue a production certificate until staging succeeds. Spend 15 extra minutes. It could save days later.
Step 3: Implement Protective Safeguards
Smart hosting platforms add safeguards to prevent runaway certificate requests. You should do the same.
Many platforms lock SSL provisioning after three failures. They stop before Let’s Encrypt’s limit of five. That buffer prevents retry loops and protects weekly limits.
If you manage SSL yourself, add similar safeguards. Monitor requests per domain and per week. Create alerts near the limits. Add automatic delays between retries.
Do not rely on manual steps. SSL issues feel urgent, and pressure creates mistakes. Automation removes human error in Let’s Encrypt rate-limit management.
Step 4: Monitor and Space Out Certificate Requests
If you manage many sites or a SaaS, timing matters. Be strategic with certificate requests. Avoid securing everything at once.
Let’s Encrypt allows 10 certificates per IP every three hours. Migrating dozens at once? Pace your requests. Spread them over days, not one afternoon.
Keep detailed logs of issuance times and domains. This is essential for weekly limits. Know exact counts for each domain over seven days before requesting more.
Use a spreadsheet or database to track issuance dates, renewals, and limit usage. Seeing requests visually helps avoid accidental Let’s Encrypt limit hits.
Step 5: Fix Root Causes Before Retrying Failed Requests
This might be the most important step. When provisioning fails, do not retry immediately. The seven-day window also tracks failed attempts per domain.
Instead, find and fix the root cause. Common causes include DNS mistakes, blocked HTTP validation, or domain verification issues. Retrying without fixes only wastes your limits.
Some common issues to check when certificates fail:
- DNS records pointing to the correct IP address
- Firewall rules allowing HTTP validation on port 80
- Web server configuration properly handling validation requests
- Domain ownership verification working correctly
Follow this rule of thumb. Wait at least an hour between failures. Do not retry until you fix the specific problem. Many providers recommend this. It prevents accidental lockouts.
What Happens When You Hit Rate Limits
Despite your best efforts, you may still hit limits. When it happens, wait for the window to reset. The main certificate limit resets after seven days.
While you wait, consider alternatives. Issue wildcard certificates where missing. Consolidate domains into fewer certificates. For critical needs, consider a commercial CA as a temporary last resort.
Most important, learn from the incident. Review what happened. Update processes to prevent repeats. Confirm your safeguards work properly.
Remember, Let’s Encrypt rate limits keep the service stable for everyone. Follow the five steps. Use wildcards. Test in staging. Add safeguards. Monitor usage. Fix root causes early.
The key is proactive planning, not reactive troubleshooting. With preparation, you can keep sites secure without hitting these limits.
by Charles Oropallo | Jun 30, 2022 | Do-It-Yourself, Email, Internet, Passwords, Security, Website Updates, WordPress
We at CharlesWorks are often asked by our web clients if their site is protected from malware and getting hacked. They also want to know if there site IS hacked, whether there be a charge to fix it.
The totally hack-proof website
The totally hack proof website has no access to it. So it’s not connected to the Internet. No one can view it. Such a website doesn’t sound like its of much use if no one can see it.
So, let’s agree that it is unrealistic to believe that a publicly accessible website can be totally hack-proof. Any website that is accessible via the public Internet is consistently subjected to attempts to break into it. Believe it or not, that’s the norm as opposed to the anomaly.
That being said, however, there ARE things you can do to mitigate website hacks. I have to stress the word mitigate here. Mitigation is defined as the action of reducing the severity, seriousness, or painfulness of something.
Site hacks are based on odds
My goal here is to simply remind you of what you most likely already know: that we can reduce the probability – the odds – of your site being hacked. We at CharlesWorks want that probability to be so low that it hopefully it doesn’t ever happen to you.
The major hacking causes
I have been operating CharlesWorks since 1998. In my experience, there appear to be two major reasons why sites get hacked:
-
- The access credentials/passwords have been compromised.
- The software that operates them wasn’t kept up to date.
Lets take a look at each of these below.
Compromised Access Credentials
Compromised passwords and bad actors gaining access to website login credentials is the major reason we see sites hacked. Think about this in terms of your car. You could have alarms on it. But if you make a copy of your car key and give it to someone, they can do whatever they like with the car. Whether its a drive along the beach or to rob a bank, your car is theirs to use with the key you gave them. Credentials – log in and passwords – work pretty much the same way.
CharlesWorks has many clients who want to be able to do things themselves. We are strong proponents of doing it yourself when it’s feasible and convenient. This is especially true for adding posts or page materials. It also makes sense when making other changes or modifications to your site. It is, after all, YOUR website.
However, many people fall prey to phishing schemes. Directly or indirectly, they usually end up tricked into giving out their website access credentials (as well as credentials to everything else they own). This is especially true if your email account is hacked and the hackers are able to access emails containing your website’s (and other) login credentials.
This problem is exacerbated if you have shared your website’s administrative or other access with others. Think of your emails containing various authorizations or login information as a potential weak link in a chain. If you have shared that information with others you have now created more weak links. This increases the odds of a potential compromise.
One of the best ways to mitigate these situations is to change your site’s access passwords so they are different than those possibly stored in your emails. And, to hope that anyone you may have shared your website access with has done the same.
Obviously, should site access be gained in such a manner, it would be your burden to have the site restored. I’ll expound upon this a little more at the end of this article.
Out of Date Security/Software Updates
Malware and virus protection on home computers operates a little differently than the same types of protection on servers. Website servers operate in the publicly accessible Internet. This results in many more entry points for potential issues. There are a number of very standard server protections available (which we utilize here at CharlesWorks).
After bad actors getting (or guessing) your passwords, the next major reason sites get hacked surrounds unapplied security updates and other software update issues. At CharlesWorks we mitigate such issues by running anti-malware software on our servers. Also, WordPress sites hosted on our servers are kept up to date automatically via automatic updating of the WordPress core as well as automatic updating of the the website’s plugins and themes.
There are literally thousands of individual pieces of software that must work in unison to operate most websites. These are developed by many more thousands of developers around the world. Unfortunately, no company can guarantee that a website will never get hacked. They can only mitigate security compromises and hope against the worst.
Restoring your Website
Regardless of which of the two situations above may have led to your website’s issues, your website will most likely need to be restored. That’s because after a bad actor or a hack back doors into the site will most likely have been installed for the bad actors to gain access again.
Many Internet companies claim to have automatic backups. In most of those, those backups are accessible to the user in their account. If the account is hacked, how safe do you suppose that is?
Some Internet companies delete and account upon a website being hacked. In those cases I have seen many left with no website or backup as a result.
What I believe is most important regarding this topic is the manner in which our WordPress sites are backed up every day for 30 days. Our backups are made to separate servers – external to those your the site operates on. For security reasons, the site administrators do not have access to these backups. So even with a site administrator’s compromised passwords there is no access to the backups. With these backups we can usually restore an average site in about 10-30 minutes if it needs restoring. And we can go back as far back as 30 days. We would only bill our web client for the 10-30 minutes (again – for an average website) which results in only a minor charge to restore it. Note that some websites are extremely large and require much more time to restore but these are very rare).
In my experience running CharlesWorks since 1998, we’ve built and handled more than 5,000 websites. At this point in time, I do not recall the last time a website we built and totally maintained was hacked (unfortunately I recall several instances of sites maintained by others that failed to ensure the site was updated and/or had their passwords compromised).
Sites getting hacked for out of date software happens far less frequently (if at all) when security updates are kept up to date and bad actors are kept out.
I hope this helps you understand a little more about this topic.
by Charles Oropallo | Jul 4, 2021 | Do-It-Yourself, Security, The CW Corner, Website Development, Website Updates
Here we are at the 4th of July of 2021 already! The loss of life suffered in 2020 was horrendous. Yet there are people who still do not think in terms of helping their fellow citizens – and themselves – by being vaccinated. The vaccine misinformation mills are in full production.
So think about this: Exactly who benefits when we don’t vaccinate? When more of us are ill and can’t work, the economy suffers. There is no way the government wants that. They want us to all work so they can collect taxes from our labor. Enemies of America benefit when we don’t vaccinate. Who benefits when we do? We all benefit. The economy will return to normal – as will our lives.
At CharlesWorks we all chose to be vaccinated. Each of us employed here cares about ourselves and our clients. So when you make an appointment with us in person you can at least rest assured we have taken steps indicating we care about you.
The CharlesWorks policy is that the COVID unvaccinated need not apply. That is one of the many ways we show we care about others.
Vaccination will help us return to normalcy. It is a small thing to do. It is the patriotic thing to do. It is the right thing to do.
European Union General Data Protection Regulation Compliant