Fake media websites are the latest scam
RTL News site spoofed by cybercrooks
RTL News site spoofed by cybercrooks
Now that more and more organisations are monitoring their brands online, cybercrooks are looking for new ways in. Domain names resembling well-known media titles and trade journals are the latest scam. Media-oriented typosquatting was one of the main phishing trends in 2019. And, in the last few weeks, we've seen a lot of fake sites trying to lure visitors with news about COVID-19. There was a fake news bulletin about the closure of schools and universities, for example, pretending to be from RTL News.
Phishing with fake media sites enables fraudsters to go under most big organisations' radar. While the organisations monitor for registrations that look like their brand names, the crooks are registering names that resemble the titles of journals and media outlets that write about the brands. They might go for a domain name echoing the title of a financial news site, for example. That name is then used to publish 'news' about a bank, with a link to a phishing site made to look like that bank's. The tactic enables the scammers to take advantage of the media title's profile in order to defraud customers of the brand without needing a domain name that would attract the brand owner's attention. Because the brand owners are looking out for things that look like their brands, not media titles.
With the new threat in mind, we're investing more in content-focused monitoring. That means looking for web pages that ask for card details, when they don't have links to payment service providers, for example. Or sites with content relating to high-profile brands plus links to dubious URLs. In the course of 2020, we'll be investigating the scope for building relevant new forms of monitoring into SIDN BrandGuard.