How it works
Attackers pose as a bank, a parcel service, a software vendor or a business partner and push for quick action: confirm your password, pay this invoice, open the attachment. The link leads to a cloned login page that captures whatever is typed into it.
As the sender they use the real domain if no DMARC policy protects it, a look-alike domain such as invoice-example.com, or a hijacked mailbox. The phishing page itself often sits on a freshly registered look-alike domain or in a subfolder of a hacked website.
Targeted variants such as spear phishing or CEO fraud aim at individual people and reference real names and ongoing business, for instance a supplier’s supposedly new bank account.
Why it matters
Your clients can end up in two roles: as victims when staff fall for a phishing page, and as tools when their domain or website is abused to attack others. In the second case Google adds the site to its warning list, Chrome, Firefox and Safari show a red warning page before opening it, and visitors stay away.
A single look-alike domain is enough to send fake invoices to a shop’s or agency’s customers, and the real company is left with the damage and the cleanup.
How to prevent it
- Enforce DMARC up to p=reject so nobody can phish with the exact sender domain.
- Register the obvious typo and TLD variants of the domain yourself.
- Keep the CMS, plugins and logins up to date and protected with two-factor authentication so the website cannot be turned into a phishing host.
- Report newly appearing look-alike domains to the registrar and host, and warn clients and staff.
- Always confirm payment changes and unusual requests through a second channel.
How DomainWarn detects it
DomainWarn does not see phishing emails themselves. The look-alike domains check generates up to 250 spellings of the domain (typos, confusable characters, other TLDs, additions such as -login) and checks daily via DNS which of them are registered. A variant that appears after the first run with a website or mail server is a warning, a parked one is a hint; whatever already exists at the first run counts as existing stock.
The Google warning list check queries Google’s Web Risk API daily: if Google flags the website as phishing, malware or unwanted software, that is critical and immediately opens the incident “Google warns about the website”. The DMARC check makes sure an unprotected exact domain does not go unnoticed.
DomainWarn checks this for all your domains on a schedule and alerts you when something is missing or changes.