Website spoofing is the act of creating a

website A website (also written as a web site) is any web page whose content is identified by a common domain name and is published on at least one web server. Websites are typically dedicated to a particular topic or purpose, such as news, educatio ...

with the intention of misleading readers that the website has been created by a different person or organization.

Techniques

Normally, the spoof website will adopt the design of the target website, and it sometimes has a similar URL. A more sophisticated attack results in an attacker creating a "shadow copy" of the

World Wide Web The World Wide Web (WWW or simply the Web) is an information system that enables Content (media), content sharing over the Internet through user-friendly ways meant to appeal to users beyond Information technology, IT specialists and hobbyis ...

by having all of the victim's traffic go through the attacker's machine, causing the attacker to obtain the victim's sensitive information. Another technique is to use a 'cloaked' URL. By using domain forwarding, or inserting control characters, the URL can appear to be genuine while concealing the actual address of the malicious website. Punycode can also be used for this purpose. Punycode-based attacks exploit the similar characters in different writing systems in common fonts. For example, on one large font, the greek letter tau (τ) is similar in appearance to the Latin lowercase letter t. However, the greek letter tau is represented in punycode as 5xa, while the Latin lowercase letter is simply represented as t, since it is present on the ASCII system. In 2017, a security researcher managed to register the domain xn--80ak6aa92e.com and have it show on several mainstream browsers as apple.com. While the characters used did not belong to the latin script, due to the default font on those browsers, the end result was non-latin characters that were indistinguishable from those on the latin script.

Motives

The objective may be fraudulent, often associated with phishing, e-mail spoofing or to lure potential victims to scams such as a get-rich-quick scheme, like in the case of fake news articles with sensational titles purporting of incidents involving popular celebrities with a forged interview discussing about and leading victims to a cryptocurrency scam. Because the purpose is often malicious, "spoof" (an expression whose base meaning is innocent parody) is a poor term for this activity so that more accountable organisations such as government departments and banks tend to avoid it, preferring more explicit descriptors such as "fraud", "counterfeit" or "phishing". A relatively more benign use of website spoofing is to criticize or make fun of the person or body whose website the spoofed site purports to represent. As an example of the use of this technique to

parody A parody is a creative work designed to imitate, comment on, and/or mock its subject by means of satire, satirical or irony, ironic imitation. Often its subject is an Originality, original work or some aspect of it (theme/content, author, style, e ...

an organisation, in November 2006 two spoof websites, www.msfirefox.com and www.msfirefox.net, were produced claiming that

Microsoft Microsoft Corporation is an American multinational corporation and technology company, technology conglomerate headquartered in Redmond, Washington. Founded in 1975, the company became influential in the History of personal computers#The ear ...

had bought Firefox and released "Microsoft Firefox 2007." A similar incident occurred in 2023 when the culture jamming collective Barbie Liberation Organization created a satirical parody page closely resembling the

Mattel Mattel, Inc. ( ) is an American multinational corporation, multinational toy manufacturing and entertainment company headquartered in El Segundo, California. Founded in Los Angeles by Harold Matson and the husband-and-wife duo of Ruth Handler, ...

corporate website using the URL mattel-corporate.com where they announced a fictitious line of Barbie dolls called "MyCelia EcoWarrior" alongside a series of hoax videos with actress Daryl Hannah posing as a spokesperson for Mattel to lend further legitimacy to the nonexistent dolls, leveraging the publicity surrounding the 2023 live-action film. The website's heavy resemblance to the legitimate Mattel corporate site led to a number of news outlets mistakenly reporting it as real, to which they eventually issued a correction and removed the articles in question.

Prevention tools

Anti-phishing software

Spoofed websites predominate in efforts developing anti-phishing software though there are concerns about their effectiveness. A majority of efforts are focused on the PC market leaving mobile devices lacking.

DNS filtering

DNS is the layer at which botnets control drones. In 2006, OpenDNS began offering a free service to prevent users from entering website spoofing sites. Essentially, OpenDNS has gathered a large database from various anti-phishing and anti-botnet organizations as well as its own data to compile a list of known website spoofing offenders. When a user attempts to access one of these bad websites, they are blocked at the DNS level. APWG statistics show that most phishing attacks use URLs, not domain names, so there would be a large amount of website spoofing that OpenDNS would be unable to track. At the time of release, OpenDNS is unable to prevent unnamed phishing exploits that sit on Yahoo, Google etc.

References