Month: November 2019

Enlarge (credit: José Antonio Lagier Martin)

At Foradada Cave in northeast Spain, Neanderthal fossils lie mingled with stone tools and animal bones. Here, archaeologists recently unearthed the tip of a 39,000-year-old eagle toe with its claw missing. The phalanx (toe bone) came from the end of a Spanish imperial eagle’s big toe (the left one, to be exact), and cut marks along the length of the bone suggest that someone had cut off the large, curved talon at the end of the toe.

Archaeologist Antonio Rodriguez, of the Institute of Evolution in Africa, and his colleagues suggest that the missing talon ended up on a Neanderthal necklace.

The case of the missing jewelry

Along the top side of the toe (a proximal phalanx, if you’re an anatomy fan), 11 deep cut marks run diagonally across the bone; a shallower twelfth cut crosses the others, parallel with the bone’s length. Under the microscope, the cuts have v-shaped cross-sections, leaning to one side—the signature shape of tool-made cuts rather than predator teeth or damage from scraping against rocks or other bone. In fact, the cuts look almost exactly like the marks archaeologists left behind when they used stone tools to separate a raptor’s claw from its toe (because of course they did, for science).

Enlarge / A fake IRS site used in a set of phishing campaigns observed by Akamai from August to October. (credit: Akamai)

Tax return scammers usually strike early in the year, when they can turn the personal information of victims into fraudulent tax refund claims. But members of Akamai's threat research team found a recent surge in "off-season" phishing attacks masquerading as notices from the Internal Revenue Service, targeting over 100,000 individuals. The attackers used at least 289 different domains hosting fake IRS websites—the majority of them legitimate sites that had been compromised. This wave of attacks came as the October 15 deadline for people who had filed for extensions approached.

According to a post by Akamai's Or Katz, the phishing campaigns kicked off in the second half of August, with the majority of victims targeted between August 22 and September 5. But the campaigns continued to be launched into early October. Each of the fake websites used visually identical HTML pages, but used randomly generated style tags and other content in an attempt to throw off signature detection by security software.

Most of the domains were active for under 20 days. However, a significant number of them remained active after a month—undetected by the owners of the sites. "The lack of maintenance on legacy websites, as well as the challenges of patching and removing injected content, explains the duration over which phishing pages can remain active," Katz wrote.