What is a spoofed website?

A spoofed website is as it sounds: a fake website. It is one of many tools cyberattackers use to trick people into clicking on malicious links/attachments, and ultimately causing a data breach. That is because hacking and cyberattacks are unfortunately a part of daily life. This is especially dangerous for covered entities who must balance patient care with safeguarding protected health information (PHI) and maintaining strong cybersecurity. Let’s explore the idea of a spoofed website and spoofing in general before concluding with some helpful mitigation techniques.

What is a spoofed website?

Website spoofing (sometimes called domain spoofing) is the act of creating a fake website as a way to mislead users. Such cyberattacks use a similar (but slightly different) logo, branding, interface, and/or visual design of a real website.

RELATED: FBI: Watch Out for Spoofed Websites with Deceptive URLS

Anyone who has access to website-building tools (as everyone does nowadays) can easily create a fake website with a spoofed domain URL. Spoofed URLs may be off by a single letter or two, even transposed. Punycode and homograph attacks use slightly different characters disguised to read like normal Internationalized Domain Names. There are several different ways that users find these websites. The most common method though is when someone is sent a malicious link in a phishing email (also known as email spoofing).

Phishing and spoofed websites

According to Verizon, 90% of data breaches originate from phishing attacks. The Anti-Phishing Working Group (APWG) moreover states that the number of phishing websites is at an all-time high. Phishing emails can be targeted (e.g., spear phishing) or sent en masse (e.g., spam). Whatever the case, the goal is to get a victim to click a malicious link/attachment. We even recently saw a spike of such emails that include fake coronavirus-related domain names.

RELATED: Coronavirus Cyberattacks: How to Protect Yourself

With one click, a victim may accidentally download malware (a drive-by download) or may be sent to a spoofed website. They may even unintentionally reveal personally identifiable information (PII) ( login spoofing). Unfortunately, there are many ways that cyberattackers use spoofing to find victims.

Spoofing as a cyberattack method

Through spoofing, hackers may gain access to PII/PHI, spread malware, or bypass network access controls. Cyberattackers may also attempt to pull off larger attacks such as an advanced persistent threat (APT) or man-in-the-middle attack. Website and email spoofing are the most known, but other common types of spoofing include:

• Caller ID spoofing (call comes from somewhere it isn’t)
• Text message spoofing (text uses someone else’s phone number or sender ID)
• IP spoofing (hide/disguise location)
• Display name spoofing (altering or spoofing an email display name)

They are all related and use the same social engineering tactics to trick users. Such attack methods are popular because anybody can become a victim at any time. This shouldn’t surprise anyone because human error is a leading cause of data breaches.

RELATED: Compromised Employee Accounts Are an Expensive Problem According to IBM Report

Tired, stressed, or rushed employees easily fall prey. And an influx of new remote workers along with increasingly sophisticated attacks may mean disaster.

RELATED: Healthcare Data Breaches—A Haunting Reality

Mitigating spoofed websites

Zero trust security—where everyone and every device is a potential threat until proven otherwise—may be the best answer to preventing cyberattacks. Ultimately, if concerned about a website, leave it immediately. At the same time, a spoofed website can be difficult to identify, especially if the spoofed website/URL seamlessly matches a real website. This is why certain safeguards must be employed, including anti-malware software, filters, firewalls, patches, and access controls. Moreover, employee awareness training is effective when combined with such security tools.

RELATED: Recognizing and Blocking a Malicious Email

Training reduces human error by teaching users to always:

• Hover over a link before clicking
• Identify the actual URL of a web page
• Open a new tab to input the real URL
• Stop before opening an unsolicited attachment
• Check for a digital certificate (i.e., a lock symbol) but don’t rely on it

Furthermore, IT departments must ensure all software on all devices is up-to-date and that all systems are continuously monitored.

Email security—a necessary protective measure

And as always, it is vital to use strong email security. Paubox Email Suite Plus provides needed inbound email security protection and requires no change in behavior to send encrypted, HIPAA compliant email. With our  HITRUST CSF certified solution, all emails are encrypted directly from an existing email platform (such as  Microsoft 365 and  Google Workspace). No extra logins, passwords, or portals for sender or recipient to read a message. Paubox Email Suite Plus also comes with ExecProtect, built to block display name spoofing emails from reaching the inbox in the first place.  Our Zero Trust Email feature also requires an additional piece of evidence to authenticate every single email before being delivered to your team’s inboxes. Spoofing can catch victims off guard, which is why organizations must be proactive with strong security features in place to eliminate future problems.