Glossary Home

Domain Impersonation

What is domain impersonation?

Domain impersonation, also known as domain spoofing, is a spoofing tactic employed by hackers to steal sensitive information by creating fake domains or websites that closely mimic legitimate ones. This technique allows attackers to collect critical data such as credentials, financial details, personal information, business data, authentication codes, and system access, enabling identity theft, financial fraud, and further cyberattacks.

How does domain impersonation work?

Domain impersonation works by crafting fake domains or websites that closely resemble the proprietary websites of well-known organizations or businesses. To make these fraudulent domains appear authentic, attackers often use subtle changes to established domain names, such as: 

• Misspellings (e.g., zoh.com, zohoo.com)
• Character substitutions (e.g., z0ho.com, zoho.corn)
• Adding or removing characters (e.g., zho.com, zo-ho.com)
• Homoglyphs (e.g., ẓoho.com with a dotted "ẓ," or zоho.com with a Cyrillic "о")
• Alternative TLDs (e.g., zoho.net, zoho.org)
• Subdomain spoofing (e.g., login.zoho-security.com)

Attackers then lure victims to the fake domain through phishing emails, malicious links, or ads, often offering services or urgent requests. Once users interact with the site (by logging in, filling out forms, or making transactions), the attackers collect sensitive data such as credentials, financial information, or personal details. This information is then used for identity theft, financial fraud, or further cyberattacks. By preying on user trust and familiarity, domain impersonation enables attackers to deceive victims into revealing valuable information.

Why is domain impersonation done?

Domain impersonation is typically done for malicious purposes, including:

• Phishing attacks to steal sensitive information like login credentials, financial data, or personal details.
• Brand exploitation to erode consumer trust or damage reputations.
• Financial fraud through deceptive invoices or payment redirections.

What would be the impact of a domain impersonation attack?

• For Users: The risk of losing personal or financial information, suffering financial losses, experiencing identity theft, and being exposed to malware.
• For Organizations: Brand damage, financial losses, reduced customer trust, and legal consequences.
• For Systems: Exploitation of network vulnerabilities, leading to broader cybersecurity risks.

Real-life case study

In late 2023, a series of fake websites replicating PayPal’s login page tricked customers into entering their account details. Hackers created these fake websites with URLs similar to PayPal’s, such as “paypaysecurity.com” or “paypa1.com,” and complemented this with a website layout identical to the original’s. Hackers used phishing techniques, such as email notifications about an alleged account issue, to prompt users to log into their ‘PayPal accounts.’ However, these were actually fake websites designed to look like the legitimate PayPal site.
Once users submitted their details, hackers could steal their credentials, take over their accounts, drain their balances—or carry out a combination of these actions. This attack affected thousands of users and resulted in millions of dollars in estimated losses. While the exact number wasn’t divulged, just a few years earlier, in 2020, Action Fraud determined victims lost $8 million in PayPal scams during that year. For more examples of fake websites used for phishing attacks, refer to "5-recent-examples-of-fake-websites".

How can we prevent domain impersonation attacks?

To mitigate the risk of domain impersonation attacks, consider the following measures:

• Implement domain monitoring: Regularly monitor for suspicious or similar domain names.
• Use domain-based email authentication: Implement protocols like DMARC, SPF, and DKIM to secure email communications.
• Register similar domain variants: Secure common misspellings, homoglyphs, and alternative TLDs of your domain.
• Educate users and employees: Train individuals to recognize phishing attempts and verify domain authenticity.
• Enable Multi-Factor Authentication (MFA): Add an extra layer of security to user accounts.
• Invest in cybersecurity tools: Use advanced threat detection systems to identify and block impersonation attempts.
• Report and take down fake domains: Act promptly to report fraudulent domains to hosting providers or authorities.