Email spoofing is one of the most common forms of cybercriminal activity. It underpins the mechanism required to conduct hacking activities such as spear phishing and business email compromise, and it can take many forms. Unfortunately, most email users will eventually receive an email that has been spoofed—whether they know it or not.
Just as forgery was a key method used by traditional criminals as the gateway key to more complex crimes, email spoofing is the forgery of an email sender address so that the message appears to have come from someone other than the actual source. Spammers will often spoof emails in order to encourage recipients to open, reply to, or even take action in response to their solicitations. And while brand spoofing is common, we are increasingly seeing criminal activities where individuals are spoofed to target employees and partners.
Spoofing Using Legitimate Domains
In addition to manipulating the display name, an attacker may also use the actual email address of the impersonated identity in the From header, such as “United Customer Service” <noreply@united.com>. This type of attack, known as a Domain Spoofing Attack, does not require compromising the account or the servers of the impersonated identity, but exploits the security holes in the underlying email protocols. Attackers often use public cloud infrastructure or third-party email sending services that do not verify domain ownership to send such attacks. Email authentication standards, such as DMARC, can be used by a domain owner to prevent spoofing of their domain, but are still not adopted widely by popular brands and government organizations.
Spoofing Using Look-alike Domains
In cases where a domain is protected by email authentication and domain spoofing is not possible, attackers try to deceive the recipient by registering and using domains that are similar to the impersonated domain. These types of attacks, known as look-alike domain attacks, often use homoglyphs or characters that appear similar to the original characters in the impersonated domain. Attackers can use rendering similarities, such as “PayPal” <paypal@paypa1.com>, exploiting the specific fonts and rendering styles used in popular email clients. Another variation of the Look-alike Domain Attack is to add additional words to the domain name. For example, if an attacker wanted to send you a bogus invoice from Acme Corporation, whose domain might be acme.com, the attacker could simply register acme-payments.com, or invoices-acme.com. Finally, attackers can use characters from another script in the Unicode set. Cyrillic is a common choice, as in the From header “Dropbox” <notifications@ dropbox.com=””>, where the “o”s in the domain are actually Cyrillic characters, but an email client will render the version that looks exactly like the impersonated domain.
Preventing Email Spoofing in Your Inboxes
While it is not possible to prevent cybercriminals from spoofing email addresses, as they continuously find new ways to trick their targets, it is possible to block these messages before they reach the inboxes of your employees, customers, and partners. Here at Agari, we use a combination of email authentication and identity detection to ensure that spoofed emails are detected before they ever reach the inbox. As part of the Secure Email Cloud, this strategy ensures that intended targets stay safe from brand impersonation, identity deception, and email spoofing, ultimately helping you trust your inbox.