Website spoofing is the creation of a replica of a trusted site with the intention of misleading visitors to a phishing site. Legitimate logos, fonts, colors and functionality are used to make the spoofed site look realistic in some cases utilizing a URL similar to the real site.
Once you click a link on a page or in an email you have received.
Its looks like the email is from the bank or trusted organization, it has their familiar logo and all their usual wording in it. The clicked link takes you to a page with the usual account login fields for enter your username and password.
The URL up in the address bar is the usual URL for your on-line banking and so you’re pretty comfortable. You type in your username and password but for some reason it doesn’t take. You try again and you’re logged in in the usual fashion and see all your account details. Everything is as it should be. Or is it?
Unfortunately, it is very possible that you have just become a victim of a crime involving a “spoofed” website address and the contents of all your bank accounts are now at risk. when you enter any form information on the spoofed website, it is logged and recorded on the cyber criminal’s servers.
What can you do to protect yourself?
- To defend against website spoofing, make sure you access a website via SSL/TLS. Non-SSL/TLS websites provide a multitude of spoofing opportunities for hackers, so if you’re looking to avoid that fate, ensure that the website is SSL/TLS.
- If the site is not an SSL secured site, perhaps because it doesn’t actually use financial information but collects or uses some other personal information, you should consider carefully whether or not you want to provide any of the requested information. These sites can also be spoofed, but you won’t have the SSL certificate to help you identify the spoof.
- There are threats when using SSL/TLS, though, as well. A man-in-the-middle attack can occur, which is a type of spoofing attack where DNS and the SSL/TLS connection or routes are poisoned and send you to a malicious site. To defend against these types of attacks, make sure you are running the most up-to-date software with patches for man-in-the-middle vulnerabilities and use trusted networks where network-level protections are in place.
- Be leery of pop-ups. Be careful if you’re sent to a website that immediately displays a pop-up window asking you to enter your username and password. Phishing scams may direct you to a legitimate website and then use a pop-up to gain your account information.
- You may also want to check with your ISP to ensure they have protections in place. If an attacker is able to send spoofed IP packets, they could attempt a denial-of-service or attack external hosts to make the attack look like it is coming from a different network, which makes stopping the attack more difficult.
Give a fake password. If you not sure if a site is authentic, don’t use your real password to sign in. If you enter a fake password and appear to be signed in, you’re likely on a phishing site. Do not enter any more information; close your browser. - Use a Web browser with antiphishing detection. Internet Explorer, Mozilla Firefox, Web browsers have free add-ons (or “plug-ins”) that can help you detect phishing sites
