Domain spoofing is a little bit like a real-life scam I heard about from a friend who visited Thailand. He called a cab and asked to be taken to a well-reviewed restaurant he had heard about. After being dropped off, supposedly at the address he provided, and seated in the restaurant, he realized the menu didn’t match what he’d seen online. Funnily enough, the name of the restaurant wasn’t anywhere to be seen, either.

He pulled up Google Maps on his phone and saw that he wasn’t in the right restaurant at all! The cab driver had dropped my friend off at an entirely different restaurant, probably somewhere owned by the cabbie’s brother or friend.

Okay, so restaurant spoofing can’t be that common in real life. But online, everything is mediated through our computer browser and the domain name system (DNS). And these can be tricked, by sophisticated cybercriminals. You need to be aware of the risks and take measures to protect your site, otherwise, your customers might get taken for a ride.

So what is domain spoofing, and how does it work? Even more importantly, how can you stop domain spoofing to protect your customers and your online reputation?

What is Domain Spoofing?

Domain spoofing is the imitation of a website name or email address by cybercriminals to trick users into believing it’s legitimate. By imitating your website address (domain name) or email address (email domain), cybercriminals can persuade users to give up delicate personal information — because they think they’re interacting with your legitimate business!

The aim of domain spoofing is usually some form of phishing attack. The perpetrator wants to steal credit card information and login details or trick the user into downloading malware onto their computer. Sometimes domain spoofing is used to trick advertisers into thinking a website has more traffic than it does in reality, so they’ll pay for ads on the illegitimate site. Implementing robust email authentication protocols, such as DMARC, significantly reduces the risk and impact of domain spoofing in phishing attacks.

Domain spoofing is like a form of online impersonation. If someone appeared at your door to read your gas meter, you’d usually ask for identification. But if they were already wearing the uniform of your gas provider, and driving a van with a big logo on the side, you might not think twice. By impersonating a trusted business, they could gain access to your home.

Domain spoofing is a digital version, and without adequate security, your customers could be at risk. So let’s find out how domain spoofing works and see how you can prevent it to safeguard the trusted relationship you’ve worked so hard to build.

What is a Domain?

Before we go any further, are you wondering, what is a domain? Or, what is a domain name? Domain names are the unique address of any website — our domain is Atom.com.

Domain names are like a street address: 55 Washington Street, and the website is the building constructed at that address.

Domain names also make up the base of your business email address and appear after the @ symbol. 

Imagine you run a florist, furnishing your customers with the blooming best flowers. You’ve spent a long time building up your reputation, to the extent that customers immediately associate your business name with the scent of a fresh bouquet, a good price, and quick delivery.

Whether cybercriminals are impersonating your website, “www.bloomingbestflowers.com” or your email address, “jo@bloomingbestflowers.com”, your customers could be fooled. Your hard-won reputation is being leveraged to trick your customers into interacting with a dangerous website.

But how do these cybercriminals pull it off?

How Does Domain Spoofing Work?

There are a few types of domain spoofing, and all rely on imitating a domain name.

Website/URL Spoofing

Website spoofing, or URL spoofing, is the imitation of a web address to trick users into believing they’re on a trusted website. Usually, attackers will register similar domain names to that of the original URL and hope web users don’t notice the difference.

Things like: www.g00gle.com, www.squadheip.com, or www.irs-gov may, at a glance, look like trusted websites google.com, Atom.com, or irs.gov. 

Occasionally, sophisticated cybercriminals can impersonate websites using foreign characters. These are called homograph attacks. For example, the domain “аррӏе.com” uses Cyrillic characters translated from a Unicode domain “xn–80ak6aa92e.com”, and PayPal was the victim of such an attack using an uppercase ‘I’ (i) in place of the lowercase ‘l’ (L).

paypaI.com vs paypal.com, can you spot the difference? 

However, as of 2024, most web browsers have taken measures to fix these security issues and alert users when a domain name is using unicode characters.

In all of these cases, the fraudulent website is spread through ads or additional email spoofing. The website’s design may imitate the original website, or simply present a login profile to capture user credentials.

Subdomain Spoofing

Subdomain spoofing is similar to website spoofing but uses subdomains to create an appearance of legitimacy. Subdomains appear before the domain name of a website in the URL, such as en in en.wikipedia.org and mail in mail.google.com. They are used to subdivide websites and improve user experience.

Subdomain spoofing involves creating subdomains that copy the main domains of legitimate websites, such as google.com.xyz.co. In this case, google.com is a subdomain of xyz.co, and has no legitimate connection to Google. (In the reverse domain, xyz.co.google.com, xyz.co is a subdomain of google.com, and could therefore be trusted.)

Email Spoofing

Email spoofing is the practice of using legitimate domains to create fake email addresses. These emails appear in user inboxes as if they came from a recognized business, and will contain links to malware or fraudulent websites to capture personal information.

Email spoofing is possible because the protocol that email messaging is built upon, Simple Mail Transfer Protocol (SMTP), does not verify the domains of incoming email. However, newer email protocols such as DKIM and DMARC add layers of verification and are more secure. To ensure your domain is properly configured and protected, you can use a free DKIM record checker.

DNS Cache Poisoning

There’s also DNS Cache Poisoning, a sophisticated spoofing tactic that uses the domain name system (DNS) to trick a browser into returning a fraudulent website. Technically, this has nothing to do with domain names, so it isn’t domain spoofing but it’s important to be aware of.

The browser cache is a memory bank of recently visited websites and makes web browsing faster and more efficient,. Your browser doesn’t have to look up a website’s IP address every time you search the domain name, instead it can drop into the cacge to see which IP address it found last time. DNS cache poisoning injects false information into the cache, switching IP addresses so a different website is returned.

How To Prevent Domain Spoofing

Because website and subdomain spoofing doesn’t rely on security issues of the spoofed site, domain spoofing can be hard to stop. However, there are some important steps you can take to protect and monitor your domain.

1. SSL Certificates

SSL certificates allow domains to use the more secure HTTPS protocol (over the HTTP protocol), add encryption, and authenticate the domain’s identity. You can get an SSL certificate from your domain registrar, often for free, and most web browsers alert users when they’re visiting a website without SSL certification.

This makes it harder for attackers to imitate your domain and adds a layer of protection for your users.

2. Email Verification

While the standard email protocol does not verify domains, new protocols such as DMARC and DKIM do offer further verification. These certificates reassure mail providers that the domain and email address are legitimate.

3. Domain Monitoring

Domain monitoring is a service that identifies when similar domain names are registered. If you owned www.bloomingbestbelowers.com, for example, it will alert you to the registration of bloomingbestflowers.co, blookmingbestflowers.ru, bl00mingbestflowers.com and so on.

Some of these registrations may be legitimate — for example, a Russian florist using the same name in a completely different market. Others may be attempts at domain spoofing, and domain monitoring gives you a warning of when copycats are imitating your domain.

Wrapping Up

How worried should you be about domain spoofing? According to the FTC, 96% of businesses will suffer a domain spoofing attack, and 3.4 billion spam emails are sent every day. Take a quick look at your spam folder, and you’ll likely see your very own example of email spoofing.

Businesses should know how to prevent spoofing attacks, and employees should be trained to spot phishing attempts in their mailboxes. While your own brand could be a victim of spoofing, so could your suppliers and industry peers — which could put you on the other side of a phishing attack.

FAQ

How do you know if your domain can be spoofed?

All domains can be spoofed, but by using SSL certification and ensuring DMARC and DKIM compliance for your email domain you can make spoofing more difficult for attackers.

Can I stop my email being spoofed?

It’s almost impossible to stop email spoofing altogether but you can make it more difficult for attackers by ensuring DKIM and DMARC compliance. You can protect your customers by using two-factor authentication and offering additional verification in your communications.

Does DKIM prevent spoofing?

DKIM authenticates your outgoing emails with a digital signature, ensuring mail providers that the email has originated from a legitimate source. This adds a layer of security for receivers, but it doesn’t prevent spoofing altogether as cybercriminals can spoof your email domain and send emails without DKIM.