Cloudflare study emphasises importance of online brand monitoring
E-mail is the most common attack vector used against organisations
Cloudflare is a global service provider active in fields such as website infrastructure and security, DDoS mitigation and DNS support. As such, the company is uniquely placed to study the tactics that cybercriminals use against target organisations. In its recently published 2023 Phishing Threats Report, Cloudflare reports that 36.5 per cent of attacks against companies make use of e-mail, with lookalike domain names playing a crucial role. Domain name spoofing is much less common, but the report doesn't specify how much damage is caused by the cases that do occur.
Identity theft and brand imitation
The use of secure, modern internet standards is a tried-and-tested, effective way of frustrating many forms of internet crime. However, for a variety of reasons, internet standards don't prevent all online scams. One reason is that scammers find workarounds, such as using domain names that are very similar to the names used by legitimate businesses. For example, a gang might register the domain rabibank.nl, and use it to trick people who mistake it for rabobank.nl, the domain of one of the Netherlands' leading banks. Mail from the lookalike domain won't be blocked by internet standards designed to prevent 'spoofing', because it comes from a real mail domain – albeit a real domain registered for dishonest purposes because of its similarity to the bank's domain. Over the course of a year, Cloudflare identified a billion instances of brand imitation. Half of them involved just 20 high-profile brands, with Microsoft as the most mimicked brand. The findings serve to underscore just how important the monitoring of domain name registrations is for large organisations.
More costly than ransomware
One of Cloudflare's most eye-catching observations is that the business community is losing huge sums to CEO fraud. The scams cost companies significantly more than ransomware, for example. In 2022, 2,385 ransomware cases were reported, involving a grand total of more than $34.3 million. Meanwhile, 21,832 cases of CEO fraud were reported, which cost the victims more than $2.7 billion – 17 per cent up on the previous year. During the course of 2022, 71 per cent of all Cloudflare-affiliated organisations were targeted by CEO fraudsters.
Multi-channel phishing
A new trend highlighted by Cloudflare is the rise of multi-channel phishing, where cybercriminals use not only e-mail but also SMS, WhatsApp, social media and other channels in their efforts to get past an organisation's defences. So, for example, the same person within an organisation will get both an e-mail and a text message ('smishing'). In addition, scammers will often set up a 'clean' website to win the confidence of a victim and their firewalls, then add their malicious code later.
Open internet standards
The open internet standards DMARC, DKIM and SPF protect against e-mail spoofing. Cloudflare reports that 89 per cent of all unwanted mail is nevertheless sent by circumventing those standards. However, that should not be interpreted as meaning that the standards are ineffective. In point of fact, the standards do a good job of preventing the abuse of genuine domain names such as sidn.nl, forcing scammers to use lookalike domain names such as s1dn.nl instead. Although lookalike domain names are a huge problem, the situation would be even worse if criminals could easily spoof genuine domain names, making phishing e-mails much harder to spot. Open internet standards therefore help to make the e-mail environment safer, especially when used in combination with measures such as smart spam filters and brand monitoring.
Want to know more?
Cloudflare's findings show how important it is for brand owners to look out for registrations that involve domain names resembling their brands. And SIDN BrandGuard is an excellent tool for doing that. For details, see this website's BrandGuard pages. For more information about open standards and e-mail security, do the test on Internet.nl or use the DMARC Advisor tool.
