What PR pros need to know about web spoofing and cybersecurity awareness

Watch out for faulty domains and untrusted links in this targeted cyberattack.

It’s important to practice cybersecurity best practices to keep your company’s information safe on the web. We are a trusted public relations advisor to cybersecurity companies and organizations seeking helpful expert guidance on corporate communication before, during, and after a cyber attack.

We’ve already covered many cybersecurity threats, such as spear-phishing, human error, vishing, internet downloads, computer theft, and more. There's a new cybersecurity breach tactic, however, that you need to be aware of: web spoofing. 

Audio: Listen to this article.

Web spoofing occurs when a cybersecurity attacker builds a website with a URL closely resembling the URL of a trusted website. When attackers build these websites, they replace a letter or symbol with another that appears similar to the original character, making it look like the well-known domain at first glance. For example, we’ll use our own website. 

Our trusted domain is www.axiapr.com.

An attacker could create a domain like www.ax1apr.com or even www.axiapr.co. 

The attacker could even go as far as making the URL with characters from other languages or Unicode characters that look almost exactly like the original characters. This type of targeted web spoofing is called a homograph attack.

The attacker sometimes copies the original and trusted website’s design, images, and copy to make the fake website appear even more real.

Web spoofing can be extremely dangerous if you aren't careful, as it's an easy way for attackers to gather your company’s logins, passwords, and private information. You can help protect yourself from this type of cyberattack by having your company and employees follow these seven cybersecurity practices:

1. Be mindful of sources. 

Ask yourself: Were you sent a web link unexpectedly? Is this link from an email? Would this company or person typically send a web link? Does anything feel or look wrong?

2. Take a close look at the URL.

Always look – not glance – at the URL before clicking the link. Are there any extra characters? Does it look right? Does anything look different or off within the URL?

3. Purchase a few variants of your original domain.

Since attackers can easily change the ending of your domain to .co, .edu, .net, and such, it’s easier to prevent web spoofing by purchasing a few other common options as your domain as well. Domains are fairly cheap, and it's easier to prevent domain squatting (the method of web spoofing that uses your original domain with a different ending) from occurring. 

4. Watch out for email chain hijacks.

Email chain hijacks occur when an attacker quickly switches from a domain like www.axiapr.com to www.axiapr.co within the same email chain to get you to click the corrupted link. It’s not always easy to catch these changes, especially when it changes so quickly within an email chain where the trusted link is also used. This is why you must always be careful. 

5. Verify all banking destination changes with a trusted contact. 

To make sure you aren’t being tricked, you can always call the contact of the company you're emailing with. Search the company number on Google and verify everything is safe and correct and that you aren’t being spoofed. 

6. Be vigilant.

Watch out for the source of emails as most cyberattacks start from an account with a leaked password. 

7. Keep an eye out for anything that comes with a sense of urgency. 

If you’re being rushed and prompted to make a decision quickly, always be wary of the contents or purpose of the email. 

Web spoofing is one of many cyberattacks that can occur. You must always be aware and actively check external links, sources, and other aspects of emails and websites to keep your company’s information safe. 

If you're currently experiencing a cybersecurity incident, book a crisis cybersecurity consultation. Not under duress but looking for help communicating about cybersecurity before a potential cyber attack? We can help you. Book a free cybersecurity consultation. 

Photo by Tatiana Syrikova