Did you know that Microsoft, Amazon, and Google are three of the most impersonated brands by phishers in 2024? And while many companies have begun leveraging artificial intelligence (AI) to beef up their cybersecurity efforts, cybercriminals also use the same tech to make their phishing communications as legitimate-looking as possible in domain spoofing attacks.
What is domain spoofing, though? And how can organizations defend against it?
What Is Domain Spoofing ?
Domain spoofing is a common form of phishing. It occurs when attackers seemingly use a popular company’s domain to impersonate it or one of its employees.
In such an attack, threat actors send emails with fake domain names that appear legitimate. A popular example would be googIe[.]com where the lowercase L was replaced with an uppercase i.
Sometimes, cyber attackers set up websites whose domains contain slightly altered characters that read as correct on browsers. Spoofed websites typically use logos or other visual cues to effectively imitate the branding of a legitimate enterprise.
Regardless of lure—an email or a site—users are prompted to enter their financial details or other sensitive data, trusting they are in the right place.
What Are the Kinds of Domain Spoofing ?
As inferred above, there are two major types of domain spoofing—email and website spoofing.
Email Spoofing
Email spoofing happens when attackers use fake email addresses using the legitimate domain of a company or its look-alike. They craft email addresses like jane_doe@micrоsоft[.]com, for instance, where the Cyrillic lowercase O replaced the ASCII version. This lets cybercriminals launch phishing attacks that convince users the phishing email is legitimate. Why? The email seems to come from a company representative at first glance rather than from some random individual. Their goal? To get recipients to visit a certain website, download malware, open a malicious email attachment, enter their account credentials, or transfer money to an account the threat actors control.
In many cases, email spoofing is paired with website spoofing. That way, the link embedded in the email will lead to a spoofed website where users should enter their usernames and passwords for the targeted accounts.
Website Spoofing
Website spoofing occurs when attackers build a website with a Uniform Resource Locator (URL) that closely resembles or even copies that of a legitimate and trusted site. Most often than not, they also copy the site’s content and style, complete with images and text.
Threat actors imitate URLs using characters from other languages or Unicode characters that look almost the same as regular American Standard Code for Information Interchange (ASCII) characters. In this case, the domain spoofing attack can also be called a “homograph attack.” Less convincing spoofed URLs only add or substitute regularly used characters and hope users don’t notice.
The fake websites the attackers create typically figure in phishing where the login pages trick users into submitting their login credentials.
How Can You Defend against Domain Spoofing ?
Email spoofing is possible since the Simple Mail Transfer Protocol (SMTP) does not have a built-in address authentication mechanism. In its place, users can utilize other protocols.
- Sender Policy Framework (SPF): This is an email validation system that lets domain managers authorize individual hosts to use a domain for emails. The list of approved domain names can be used to verify a sender’s authenticity.
- Domain-based Message Authentication, Reporting and Conformance (DMARC): This is an email authentication protocol that uses reporting and enforcement components. It automates authenticity verification and alerts administrators to false email domains immediately. Emails that use false domains are prevented from entering inboxes.
- DomainKeys Identified Mail (DKIM): This validates a domain name identity associated with a message. It adds a digital signature to an email to ensure its authenticity. While it cannot filter emails, it can guarantee the legitimacy of a message.
- Sender ID (SID): This protocol is largely based on SPF and comes built into Microsoft exchange servers. It reads SMTP headers then queries Domain Name System (DNS) records to verify a sender’s address.
Other best practices can also thwart domain spoofing attacks. Here are some of them.
- Be mindful of an email’s source. Keep in mind that unexpected requests and warnings often come from scammers.
- Scrutinize URLs.
- Bookmark important websites so you won’t land on suspicious websites in case of mistyping.
Organizations can prevent their domains from being spoofed by using Secure Sockets Layer (SSL) certificates. This step makes website spoofing more difficult for attackers since they will have to register for spoofed SSL certificates in addition to registering spoofed domains.
