Domain Spoofing Explained: Learn How to Stop This Cyber Threat

You’ve probably heard of the term “phishing”, which is a type of domain spoofing. Other than phishing, domain spoofing happens in a few ways, each posing unique challenges for detection and prevention:

Email spoofing

In email spoofing, attackers forge the “From” address in an email to make it appear as though it came from a trusted source.

This form of spoofing is frequently used in phishing attacks, where the recipient is tricked into clicking malicious links or downloading harmful attachments. It may also be used to impersonate high-level executives (CEO or executive fraud), requesting wire transfers or confidential information.

• How it works: Most often, attackers will use fake email addresses  by manipulating the Simple Mail Transfer Protocol (SMTP), which lacks strong email authentication checks. Recipients often fail to notice subtle discrepancies, which leads to successful data or financial theft.
• Example: You receive an email that appears to be from your CEO, requesting an urgent wire transfer. The email address looks legitimate at first glance, but upon closer inspection, you notice that the domain is slightly altered—e.g., “[email protected]” instead of “[email protected].”

Website spoofing

Website spoofing involves creating a fake site that looks and behaves like the legitimate website. These fraudulent sites often feature exact replicas of the design, logos, and content of the targeted organization. Users are lured to these sites via phishing emails, ad campaigns, or social media links, where they unknowingly provide login credentials, personal data, or payment details.

• How it works: Attackers register domains that are slightly different from the legitimate website. This can be as simple as using a different top-level domain (ex .com versus .net) or making minor spelling changes (e.g., faceboook.com instead of facebook.com). Once a user accesses the spoofed site, the attacker can collect sensitive information and potentially cause a lot of damage.
• Example: A phishing site might use the domain “c01nbase.com” instead of “coinbase.com,” with numbers replacing the “o” and “i” to deceive users into visiting a malicious site. The site looks identical to the real one, deceiving users into providing their Coinbase login details, which can then be used for financial gain like stealing cryptocurrency or making trades.

The example above is what’s known as a homograph attack, where attackers register a domain that uses characters that look nearly identical to those of a legitimate domain. As shown, they might replace an “o” with a zero or use characters from different alphabets that appear similar to English letters.

DNS spoofing (aka DNS poisoning)

In DNS spoofing, attackers change the address of a legitimate website, redirecting users to a fake version. They do this by “poisoning” the DNS cache, which alters the IP addresses associated with a domain name.

This technique allows attackers to steal personal data or block access to the site altogether, and users are often unaware the attack even occurred, as the fake site may appear and function normally. In other cases, users experience issues when loading the site, and will mistakenly blaming the company for technical problems.

• How it works: Cybercriminals send fake responses to DNS queries, replacing legitimate domain records with fraudulent ones. When users attempt to access a legitimate site, they are redirected to the attacker’s site instead, where their data may be harvested.
• Example: The Chinese government is known to use DNS poisining to block access to restricted websites like Facebook, sending users to alternate servers that deliver completely different content, even when the correct web address is entered.