February 2, 2021 By David Bisson 2 min read

A recent FBI announcement warned that threat actors are creating domains that spoof the law enforcement agency’s official websites.

Inside the FBI Announcement

On Nov. 23, 2020, the FBI warned that malicious actors were using domain spoofing to look like its real websites. The FBI announcement listed 99 websites that threat actors had set up. Each was meant to look like its main official website, www.fbi[dot]gov.

Some of those spoofed domains simply used different top level domains than the bureau’s official website. These included fbi[dot]camera, fbi[dot]cash, fbi[dot]health, fbi[dot]studio and fbi[dot]systems. One domain, fbi[dot]ca, used the country code top-level domain for Canada.

Meanwhile, other domains were a bit more lengthy. These included fbiorganisation[dot]online, fbigrantinvestigation[dot]com and fbifraud[dot]primebnkonline[dot]com.

At the time of the FBI announcement, the agency had found 14 of the 99 spoofed domains were unable to resolve. A few of those domains got creative with country code top-level domains. These included fbilibrary[dot]ml (using the country code for Mali) and fbi99[dot]cn (the code for the People’s Republic of China).

The url fbiboston[dot]com[dot]jo is one of the stranger ones. This curious example uses the city of Boston and the country of Jordan in the same domain.

As the FBI announcement said, the danger here is that people could visit one of the fakes when looking for official sites.

There’s also the potential that threat actors could use seemingly official email accounts to trick readers. This is a common tactic for leading people into visiting malicious websites or downloading malware.

Other Targets of Domain Spoofing

Back in early November, malicious actors impersonated the IRS. They leveraged that disguise along with the spoofed domain support@irs[dot]gov to trick people into handing over their payment information.

Less than a month later, a spear-phishing campaign targeted mostly users who worked in the financial services, health care, insurance, manufacturing, utilities and telecom industries. Like the one in the FBI announcement, that campaign made the attack emails look as though they had come from the real domain no-reply@microsoft[dot]com. Clicking on an embedded link led to a fake Microsoft login page designed to steal Office 365 credentials.

It was around that same time that government-authorized nonprofit investment security firm FINRA published a regulatory notice warning users to be on the lookout for an attack campaign. The operation used fraudulent emails that included the domain @invest-finra[dot]org.

How to Not Fall for a Spoofed Domain

Employers can help their users to not fall for a spoofed domain such as the ones in the FBI announcement by investing in ongoing security awareness training for their entire workforce. First, they should conduct phishing tests that use spoofed domains in order to check employees’ behavior. By raising awareness around tricks like the ones in this FBI announcement, employers can emphasize the importance of checking email links and attachments sent by strangers.

In addition, make sure you’re prepared to respond to a successful phishing scam such as the one in the FBI announcement. Employers should consider putting together an incident response plan and building an incident response team. Going forward, test both the plan and team on a regular basis.

More from News

What is the Open-Source Software Security Initiative (OS3I)?

3 min read - The Open-Source Software Security Initiative (OS3I) recently released Securing the Open-Source Software Ecosystem report, which details the members’ current priorities and recommended cybersecurity solutions. The accompanying fact sheet also provides the highlights of the report. The OS3I includes both federal departments and agencies working together to deliver policy solutions to secure and defend the ecosystem. The new initiative is part of the overall National Cybersecurity Strategy. After the Log4Shell vulnerability in 2021, the Biden-Harris administration committed to improving the security…

Europe’s Cyber Resilience Act: Redefining open source

3 min read - Amid an increasingly complex threat landscape, we find ourselves at a crossroads where law, technology and community converge. As such, cyber resilience is more crucial than ever. At its heart, cyber resilience means maintaining a robust security posture despite adverse cyber events and being able to anticipate, withstand, recover from and adapt to such incidents. While new data privacy and protection regulations like GDPR, HIPAA and CCPA are being introduced more frequently than ever, did you know that there is new…

Feds release urgent guidance for U.S. water sector

3 min read - The water and wastewater sector (WWS) faces cybersecurity challenges that leave it wide open to attacks. In response, the CISA, EPA and FBI recently released joint guidance to the sector, citing variable cyber maturity levels and potential cybersecurity solutions. The new Incident Response Guide (IRG) provides the water sector with information about the federal roles, resources and responsibilities for each stage of the cyber incident response lifecycle. Sector owners and operators can use this information to augment their incident response…

Topic updates

Get email updates and stay ahead of the latest threats to the security landscape, thought leadership and research.
Subscribe today