Phishing & Domain Spoofing Detection

Recognizing and Defending Against Domain-Based Attacks

Phishing and domain spoofing are among the most common cyber attacks. Attackers create fake domains or emails that mimic legitimate organizations to steal credentials, install malware, or commit fraud.

Types of Domain Spoofing

Lookalike Domains (Typosquatting)

Registering domains similar to legitimate ones:

• Character substitution: g00gle.com (zeros instead of 'o's)
• Missing characters: gogle.com
• Extra characters: googgle.com
• Adjacent key typos: goofle.com
• Different TLD: google.co (instead of .com)

Homograph Attacks (IDN Spoofing)

Using international characters that look identical to ASCII letters:

• Cyrillic 'а' (U+0430) looks identical to Latin 'a' (U+0061)
• Greek 'ο' (U+03BF) looks identical to Latin 'o' (U+006F)
• Modern browsers display the punycode (xn--) version to alert users

Subdomain Spoofing

• paypal.com.malicious-site.com
• secure-login.apple.com.fake-domain.net
• Users may see the trusted brand name and miss the actual domain

How to Detect Phishing Domains

Check the Domain Carefully

• Look at the full URL, not just the beginning
• Check for subtle character differences
• Verify the TLD is correct
• Use our WHOIS lookup to check domain registration details

Inspect the SSL Certificate

• Click the padlock icon to view certificate details
• Phishing sites often use free DV certificates
• Check if the organization name matches expectations
• Use our SSL Checker for detailed analysis

Check Domain Age and Registration

• Phishing domains are typically very recently registered
• WHOIS privacy on a domain claiming to be a major brand is suspicious
• Check the registrant information matches the expected organization

Protecting Your Domain from Being Spoofed

• Register common variations: Secure typos and different TLDs of your domain
• Implement DMARC: Prevent email spoofing of your domain
• Monitor for lookalikes: Use brand monitoring services
• Use EV certificates: Provide higher visual trust indicators
• Educate users: Train employees and customers to recognize phishing
• Report abuse: File takedown requests for phishing domains

Red Flags to Watch For

• Urgent or threatening language ("Your account will be closed!")
• Unexpected requests for login credentials or personal information
• Generic greetings instead of your name
• Mismatched sender email and display name
• Suspicious attachments or links
• Poor grammar or spelling