Phishing and look-alike domains

How phishing works, how to recognise a forged sender, and what to do when someone clicks.

← Training·Level 3 of 9 · Chandraghanta — the bell that warns·Foundation·about 10 minutes

1The trick is trust

Phishing (MITRE ATT&CK T1566) gets a person to act: click a link, open an attachment, enter a password, approve a payment. It works because the message looks like it comes from someone the person already trusts.

Look-alike domains are the most common disguise. 'rn' reads as 'm' at a glance, so rn1crosoft-billing.com passes for microsoft. Other tricks are a swapped letter, an extra word like -billing or -secure, or a different top-level domain.

2Check what you can verify

The display name is chosen by the sender and proves nothing. The actual sending address and its domain are what to check. On a link, the real destination is what the browser shows when you hover, not the link text.

Email authentication (SPF, DKIM and DMARC) lets a receiving server check that a domain authorised the message. A failure is a strong signal. A pass only proves the message came from that domain, which may be the attacker's own look-alike.

3When someone clicked

Find out exactly what happened: link opened, credentials entered, or file run. If credentials were entered, reset them and revoke active sessions, because a reset alone leaves an attacker's existing session working.

Search for the same sender or link across all mailboxes. Phishing rarely goes to one person.

Test what you learned

5 questions · pass mark 80% · every answer explains itself after you submit.

1.Which sender domain is most likely impersonating Microsoft?
2.An email shows 'IT Support' as the sender. What does that prove?
3.A message passes SPF and DKIM. What can you conclude?
4.A user entered their password on a phishing page. What is the right first response?
5.Which ATT&CK technique ID is Phishing?