Spoofing is a form of fraud where the sender falsifies their identity to trick the victim into believing it is sent from someone they trust.
Email, phone number, URL, DNS, ARP, IP, and SMS, among others.
Spoofing is often used as a technique in email phishing, but instead of making it obvious like in regular phishing, spoofers make minimal changes to their email address.
Genuine email: support@yourbank.no typically looks like this.
A fraudster engaging in regular email phishing might look like this.
Obvious phishing: support@yourbank1234.com or support@randomdomain.net
In obvious phishing, they have kept “support” and “@” as in the genuine email, but they have either added “yourbank with 1234.com” at the end or “randomdomain.net.”
Credible spoofing: support@yourbank.com instead of support@yourbank.no
In credible spoofing, they have only changed what comes after support@yourbank. The only difference between the genuine and spoofed address is “no” and “com.”
A more common method than replacing .no with .com is to change nearly identical letters.
dnb.no becomes dmb.no
and
secret.no becomes secretljg.no and so on.
If you are knowledgeable about phishing and spoofing, well-rested, and good at reading email addresses carefully, you can avoid falling victim to phishing and spoofing.
At the same time, it is relevant to mention that we are not always in top form, and fraudsters use social engineering to get you to act, often by clicking on a link. They often use strong emotions and put you under time pressure.
Fraudsters know when you are most tired during the day. They often send messages when you are on your way home from work or picking up the kids from daycare.
Check the sender’s address carefully: Even if the sender’s address looks correct, small details can reveal the forgery.
Do not click on links in unexpected emails: Go directly to the bank’s official website by typing in the URL yourself.
Contact the bank directly: If you are unsure, call your bank to confirm if the email is genuine.
In addition to email spoofing, there is also phone spoofing, SMS spoofing, IP address spoofing, URL spoofing, ARP spoofing, DNS spoofing.
Similar to email spoofing, they have made small changes to make it appear credible.
No one is perfect. Sometimes we click on a malicious link when we are stressed. If you happen to become a victim of spoofing, we at Sicra can help your company.
Phishing with a credible spoofing of an email can lead to a ransomware attack. A link can lead to a page that downloads ransomware that encrypts all your files.
Fear not: We at Sicra can help you decrypt and regain control of your data if the accident should happen.
Fraudsters are no match for the expertise at Sicra. So don’t be afraid. We are here for you.
With a good security plan where your network is divided into several smaller zones and thus a smaller attack surface, you can focus on what is important to you. Running your business with great security and confidence.
Read about our "CISO-for-Hire" service here >
Read about "security training" here >
Related words: FQDN, Phishing, Ransomware, Social engineering, URL spoofing, DNS spoofing, ARP spoofing, IP address spoofing, SMS spoofing, Email fraud, Identity theft, Malware, Pentesting.