What is a phishing domain? How to avoid phishing websites?

Phishing domain name is a domain name used in online fraud. Phishing refers to the attacker trying to obtain sensitive information from users, such as usernames, passwords, credit card numbers, etc., by disguising as a legitimate and trustworthy organization or website.

Phishing domain names usually imitate the domain names of legitimate websites such as well-known brands, financial institutions, social media, etc. They may only make some minor changes to the original domain name, such as changing the case of letters, adding or removing a letter, replacing similar characters, adding some seemingly inconspicuous numbers or symbols, etc.

The following are some examples of phishing domain names:

I. Fake bank website

1. Case situation:

An attacker registered the domain name "1cbc.com.cn", which is very similar to the official domain name "icbc.com.cn" of the Industrial and Commercial Bank of China. The page design of the phishing website imitates the official website of the Industrial and Commercial Bank of China, and the color layout is almost the same.

Fraud method:

When users visit the phishing website, if they do not carefully identify the domain name, they will mistake it for the real Industrial and Commercial Bank of China website. Then the website will induce users to enter information such as bank card number, password, verification code, etc., claiming to conduct account security verification or provide some special services. Once the user enters this sensitive information, the attacker can obtain and use this information to steal the user's account funds.

2. Case situation:

There have been phishing websites with the domain name "bcm-online.com" that attempt to impersonate the Bank of China (BOC). Its domain name has a certain similarity with the official domain name of the Bank of China, which can easily mislead users.

Fraudulent means:

The phishing website will guide users to log in and enter their personal bank account information, ID number, etc. under false reasons such as system upgrades and account abnormalities. After that, the attacker uses this information to illegally transfer funds or carry out other fraudulent activities.

2. Fake e-commerce platforms

1. Case situation:

There are phishing domain names such as "taobao-official.com". It imitates the official name of Taobao (Taobao) and adds a confusing word such as "official".

Fraudulent means:

The website will publish some false promotional information, such as super low-priced product promotions, limited-time discounts, etc., to attract users to click. When users try to buy these products, the website will ask them to register and enter payment information. In fact, these products do not exist at all, and the money paid by users will go directly into the attacker's account, and users will not receive any products.

2. Case situation:

There have been phishing domain names such as "jd-mal.com", which are similar to the domain name of JD.com.

Fraud methods:

The phishing website will guide users to log in and participate in the so-called lottery activities under the false name of JD.com's anniversary lottery. Once the user logs in and follows the prompts, they will be asked to provide personal information and payment account information, claiming that it is for the purpose of issuing prizes or collecting taxes. In the end, not only will the user not get the prize, but their personal information will also be leaked, and their account funds may also be at risk.

3. Fake social network platform

1. Case situation:

There is a phishing domain name such as "faceb00k.com" (replace the letter o with the number 0), which disguises itself as Facebook.

Fraud methods:

After the user logs in, the phishing website will prompt the user that there is a security risk in the account and that personal information needs to be updated to ensure the security of the account. If users follow the prompts and enter their name, date of birth, email address and other information, this information will be collected by attackers. Attackers may use this information to commit identity theft or send spam or fraudulent emails to users.

2. Case:

There is a phishing domain name "linikedin.com" (replace the letter i in front of the letter k with the letter l) that attempts to impersonate LinkedIn.

Fraudulent means:

It will send false in-site messages to users, claiming that there are high-paying job opportunities or invitations to cooperative projects. When users click on the link to enter and fill in more personal resume information, contact information, etc., the attacker obtains these valuable personal data and may sell them to third parties for illegal marketing and other activities, or use this information to further defraud users, such as defrauding money on the grounds that job interviews require fees.