February 2, 2021 By David Bisson 2 min read

A recent FBI announcement warned that threat actors are creating domains that spoof the law enforcement agency’s official websites.

Inside the FBI Announcement

On Nov. 23, 2020, the FBI warned that malicious actors were using domain spoofing to look like its real websites. The FBI announcement listed 99 websites that threat actors had set up. Each was meant to look like its main official website, www.fbi[dot]gov.

Some of those spoofed domains simply used different top level domains than the bureau’s official website. These included fbi[dot]camera, fbi[dot]cash, fbi[dot]health, fbi[dot]studio and fbi[dot]systems. One domain, fbi[dot]ca, used the country code top-level domain for Canada.

Meanwhile, other domains were a bit more lengthy. These included fbiorganisation[dot]online, fbigrantinvestigation[dot]com and fbifraud[dot]primebnkonline[dot]com.

At the time of the FBI announcement, the agency had found 14 of the 99 spoofed domains were unable to resolve. A few of those domains got creative with country code top-level domains. These included fbilibrary[dot]ml (using the country code for Mali) and fbi99[dot]cn (the code for the People’s Republic of China).

The url fbiboston[dot]com[dot]jo is one of the stranger ones. This curious example uses the city of Boston and the country of Jordan in the same domain.

As the FBI announcement said, the danger here is that people could visit one of the fakes when looking for official sites.

There’s also the potential that threat actors could use seemingly official email accounts to trick readers. This is a common tactic for leading people into visiting malicious websites or downloading malware.

Other Targets of Domain Spoofing

Back in early November, malicious actors impersonated the IRS. They leveraged that disguise along with the spoofed domain support@irs[dot]gov to trick people into handing over their payment information.

Less than a month later, a spear-phishing campaign targeted mostly users who worked in the financial services, health care, insurance, manufacturing, utilities and telecom industries. Like the one in the FBI announcement, that campaign made the attack emails look as though they had come from the real domain no-reply@microsoft[dot]com. Clicking on an embedded link led to a fake Microsoft login page designed to steal Office 365 credentials.

It was around that same time that government-authorized nonprofit investment security firm FINRA published a regulatory notice warning users to be on the lookout for an attack campaign. The operation used fraudulent emails that included the domain @invest-finra[dot]org.

How to Not Fall for a Spoofed Domain

Employers can help their users to not fall for a spoofed domain such as the ones in the FBI announcement by investing in ongoing security awareness training for their entire workforce. First, they should conduct phishing tests that use spoofed domains in order to check employees’ behavior. By raising awareness around tricks like the ones in this FBI announcement, employers can emphasize the importance of checking email links and attachments sent by strangers.

In addition, make sure you’re prepared to respond to a successful phishing scam such as the one in the FBI announcement. Employers should consider putting together an incident response plan and building an incident response team. Going forward, test both the plan and team on a regular basis.

More from News

Cyberattack on American Water: A warning to critical infrastructure

3 min read - American Water, the largest publicly traded United States water and wastewater utility, recently experienced a cybersecurity incident that forced the company to disconnect key systems, including its customer billing platform. As the company’s investigation continues, there are growing concerns about the vulnerabilities that persist in the water sector, which has increasingly become a target for cyberattacks. The breach is a stark reminder of the critical infrastructure risks that have long plagued the industry. While the water utility has confirmed that…

CISA and FBI release secure by design alert on cross-site scripting 

3 min read - CISA and the FBI are increasingly focusing on proactive cybersecurity and cyber resilience measures. Conjointly, the agencies recently released a new Secure by Design alert aimed at eliminating cross-site Scripting (XSS) vulnerabilities, which have long been exploited to compromise both data and user trust. Cross-site scripting vulnerabilities occur when a web application improperly handles user input, allowing attackers to inject malicious scripts into web pages that are then executed by unsuspecting users. These vulnerabilities are dangerous because they don't attack…

Has BlackCat returned as Cicada3301? Maybe.

4 min read - In 2022, BlackCat ransomware (also known as ALPHV) was among the top malware types tracked by IBM X-Force. The following year, the threat actor group added new tools and tactics to enhance BlackCat's impact. The effort paid off — literally. In March 2024, BlackCat successfully compromised Change Healthcare and received a ransom payment of $22 million in Bitcoin. But here's where things get weird: Immediately after taking payment, BlackCat closed its doors, citing "the feds" as the reason for the…

Topic updates

Get email updates and stay ahead of the latest threats to the security landscape, thought leadership and research.
Subscribe today