- \n
- Malicious links or attachments, used to infect the user\u2019s device with malware. <\/li>\n<\/ul>\n\n\n\n
- \n
- Cloning reputable brands\u2019 email templates to capture sensitive data or login credentials that will later be used to defraud the target, steal further information, steal money or intellectual property. <\/li>\n<\/ul>\n\n\n\n
Email Spoofing and Its Role in Phishing <\/h2>\n\n\n\n
Email spoofing is a common technique used to impersonate a legitimate sender. The attacker manipulates the email “From” address to make it appear as if the message comes from a trusted individual or domain. <\/p>\n\n\n\n
By combining spoofed sender information with legitimate branding and language, attackers increase the chances that victims will click links or open malicious attachments. <\/p>\n\n\n\n
Here\u2019s an example of phishing via email spoofing: <\/p>\n\n\n\n
- \n
- An email appears to come from support@yourbank.com but actually originates from a malicious IP address and includes a link to a fake login page. <\/li>\n<\/ol>\n\n\n\n
- \n
- The user inputs their details <\/li>\n<\/ol>\n\n\n\n
- \n
- Once the victim enters their details, these are then sent to the malicious actor, who can then access the victim\u2019s account on the legitimate website. <\/li>\n<\/ol>\n\n\n\n
![\"Email](\"https:\/\/www.20i.com\/blog\/wp-content\/uploads\/2025\/06\/Phishing_inner.png\")
<\/figure>\n\n\n\nPhishing Vs. Pharming <\/h2>\n\n\n\n
Pharming is a type of cyberattack that redirects users from legitimate websites to fraudulent ones without their knowledge. <\/p>\n\n\n\n
Unlike phishing, which typically relies on tricking individuals into clicking a malicious link, pharming manipulates the underlying infrastructure of the internet. <\/p>\n\n\n\n
This can be done in two main ways: <\/p>\n\n\n\n
DNS poisoning<\/strong> (DNS spoofing)<\/strong> <\/h4>\n\n\n\n
The attacker corrupts the Domain Name System (DNS) cache or server, so that when a user types in a legitimate web address, they\u2019re unknowingly redirected to a fake site controlled by the attacker. <\/p>\n\n\n\n
Local host file modification:<\/strong> <\/h4>\n\n\n\n
The attacker alters the local host file on the victim\u2019s computer, which maps domain names to IP addresses. This bypasses DNS and redirects traffic to a fake site even if the correct web address is entered. This is usually achieved through social engineering or malware. <\/p>\n\n\n\n
Types of Phishing Attacks <\/h2>\n\n\n\n
Email Phishing (Mass Campaigns)<\/strong> <\/h4>\n\n\n\n
Much like marketing campaigns, phishing campaigns are sent to thousands of recipients and commonly attempt to spoof large brand names like Microsoft, Amazon, PayPal, etc. <\/p>\n\n\n\n
The goal of this is to collect credentials for the respective websites or infect systems with malware. <\/p>\n\n\n\n
Spear Phishing<\/strong> <\/h4>\n\n\n\n
Spear phishing is a highly targeted and personalised variation of a traditional phishing attack. These are aimed at specific individuals or roles within a company and the attacker. Often uses detailed knowledge of the victim or organisation to boost credibility.\u00a0<\/p>\n\n\n\n
Usually, the attacker will gain intelligence of their target, such as names and hierarchy and will exploit this knowledge to pose as a legitimate, known actor. <\/p>\n\n\n\n
Business Email Compromise<\/strong> <\/h4>\n\n\n\n
Spoofs mail to originate from executives or partners to manipulate employees into making payments or disclosing sensitive data. Often coupled with urgency, this involves email spoofing and social engineering to fool subordinates into disclosing sensitive information. <\/p>\n\n\n\n
Smishing (SMS\/text message Phishing)<\/strong> <\/h4>\n\n\n\n
Smishing is delivered via text message or SMS (Short Message Service) and may include malicious links or fake account notifications. Malicious actors often impersonate banks, delivery services, and government agencies to steal sensitive information. <\/p>\n\n\n\n
Vishing (Voice Phishing)<\/strong> <\/h4>\n\n\n\n
Attackers call victims pretending to be support agents, IT staff, or government officials to extract information or persuade the target to perform an action such as install malicious software or disclose sensitive information. <\/p>\n\n\n\n
Clone Phishing<\/strong> <\/h4>\n\n\n\n
Clone phishing is the act of copying a legitimate email, changing the links or attachments, and resending it. As the victims will likely have seen similar emails before, this exploits familiarity to increase trust. <\/p>\n\n\n\n
Common Phishing Tactics <\/h2>\n\n\n\n
Urgency and fear<\/strong> <\/h4>\n\n\n\n
The most common phishing tactic is using urgency to instil fear into their victims. This could be claiming that a payment for a large sum of money is due to leave their account and to contact them (the attacker) if the victim didn\u2019t action this. The attacker will then gather sensitive information from the victim to further exploit their trust. <\/p>\n\n\n\n
This method is particularly effective, as it causes the victim to act fast, often causing them to overlook discrepancies differentiating the attacker from the legitimate source. <\/p>\n\n\n\n
Spoofed email addresses\/domains<\/strong> <\/h4>\n\n\n\n
Spoofing email addresses and domains is a very effective way for an attacker to pose as a legitimate source. As this involves them sending emails from a legitimate domain, it is much harder to detect. <\/p>\n\n\n\n
This attack is not very effective at posing as large firms, such as Google or Apple, as these companies will have security measures, such as SPF, DKIM and DMARC in place to prevent their domains from being spoofed. <\/p>\n\n\n\n
Phishing websites<\/strong> <\/h4>\n\n\n\n
An attacker can create an exact clone of an existing website and will often attempt to use a domain as similar to the legitimate source as possible, such as \u2018bar.clays-bank.com\u2019<\/em>. <\/p>\n\n\n\n
This method is often paired with email spoofing, smishing, vishing etc to boost its footfall and attempts to trick victims into entering their credentials, which are then harvested. <\/p>\n\n\n\n
Malicious attachments<\/strong> <\/h4>\n\n\n\n
Malware can be sent to victims via phishing and is often disguised as invoices, resumes, or security reports. When the victim downloads the malicious attachment, malware will be installed on their device which will be used to harvest credentials, gather personal data and potentially extort the victim. <\/p>\n\n\n\n
Most email providers, such as 20i, can automatically detect malware in attachments and outright reject the email or display a warning for the recipient. <\/p>\n\n\n\n
How to Prevent Phishing Attacks <\/h2>\n\n\n\n
At 20i, we don\u2019t believe that you should have to pay extra for security features, so we include an extensive security suite<\/a> with our Reseller<\/a> and Managed Cloud Hosting services<\/a>.<\/p>\n\n\n\n
As a reseller, this is something that you can advertise as your own and provide to your customers for free to distinguish yourself from mediocre hosting providers. <\/p>\n\n\n\n
Implement Email Authentication<\/strong> <\/h4>\n\n\n\n
Use SPF, DKIM, and DMARC to prevent bad actors from impersonating your brand. <\/p>\n\n\n\n
A Sender Policy Framework (SPF) record is a DNS TXT record that helps prevent email spoofing and the record is automatically added to the DNS on our platform. <\/p>\n\n\n\n
When an email is received, the recipient’s mail server will check the SPF record of the sender’s domain to verify whether the sending mail server is permitted to send emails on behalf of that domain. <\/p>\n\n\n\n
The purpose of DomainKeys Identified Mail (DKIM) is to authenticate that the content of any DKIM-signed email message is not modified during the transfer between sender\u2019s or ISP (Internet Service Provider) and receiver\u2019s mail servers. <\/p>\n\n\n\n
Learn how to add DKIM here<\/a> <\/p>\n\n\n\n
Domain-based Message Authentication, Reporting, and Conformance (DMARC) works in conjunction with SPF and DKIM records and is designed to prevent the domain from being spoofed. <\/p>\n\n\n\n
Learn how to add DMARC here<\/a> <\/p>\n\n\n\n
Use Advanced Email Security Solutions<\/strong> <\/h4>\n\n\n\n
Many modern mail providers will have security measures in place to minimise the risk of you receiving phishing scams. At 20i, we use three layers of security on our advanced Stackmail platform: <\/p>\n\n\n\n
- \n
- Network-level \u2013 we utilise multiple deny lists from Spamhaus, Invaluement and Barracuda Networks to block any known bad actors. <\/li>\n<\/ul>\n\n\n\n
- \n
- Virus scanning \u2013 our comprehensive virus scanner will automatically scan emails and attachments for known malware signatures. This database is continuously updated to stay ahead of the curve. <\/li>\n<\/ul>\n\n\n\n
- \n
- Content-based \u2013 all messages are scanned for spam and phishing-like characteristics and either sent to spam\/junk or outright rejected. You can also change your own personal settings to be more lenient or strict for spam on a per mailbox basis. <\/li>\n<\/ul>\n\n\n\n
Conduct Regular User Awareness Training<\/strong> <\/h4>\n\n\n\n
For companies, it is beneficial to teach employees how to spot phishing indicators, such as generic greetings (\u201cDear user\u201d), spelling or grammar mistakes, and hovering over links to inspect URLs before visiting. <\/p>\n\n\n\n
We also encourage companies to run phishing simulations to test and improve user response to get accurate data on how phishing incidents are handled. <\/p>\n\n\n\n
Keep Software and Browsers Updated<\/strong> <\/h4>\n\n\n\n
To combat phishing websites, it is advised to keep your web browsers and antivirus tools up to date as browser security features and antivirus tools can block known phishing sites and payloads. <\/p>\n\n\n\n
Search engines, like Google are typically very fast to take action against a malicious website and will typically show a \u2018Dangerous Site\u201d warning as shown below. <\/p>\n\n\n\n
![\"dangerous](\"https:\/\/www.20i.com\/blog\/wp-content\/uploads\/2025\/06\/google-dangerous-site-warning.png\")
<\/figure>\n\n\n\nMonitor Old Accounts<\/strong> <\/h4>\n\n\n\n
If an attacker manages to access an old, redundant mailbox, they can use this to boost credibility and other members of the same organisation are more likely to trust the attacker\u2019s advances. <\/p>\n\n\n\n
In a small team, this may be easily detected but in larger teams, especially if virtual or spread across multiple locations, this can pose a substantial risk. <\/p>\n\n\n\n
Due to this, it is advised to: <\/p>\n\n\n\n
- \n
- Frequently delete mailboxes that are no longer in use, particularly those of ex-employees <\/li>\n<\/ul>\n\n\n\n
- \n
- Regularly check mailboxes that are rarely used <\/li>\n<\/ul>\n\n\n\n
- \n
- Ensure passwords are regularly changed and are as complex and lengthy as possible <\/li>\n<\/ul>\n\n\n\n
Reporting<\/strong> <\/h4>\n\n\n\n
Report phishing attempts to the relevant teams within your organisation so that word can be spread to minimise the chances of a colleague falling victim to it. <\/p>\n\n\n\n
You can also report phishing scams to platforms like report@phishing.gov.uk<\/a> or reportphishing@apwg.org<\/a>. <\/p>\n\n\n\n
Conclusion <\/h2>\n\n\n\n
Phishing remains one of the most effective and widespread cyber threats with tactics that continue to evolve and exploit human psychology. <\/p>\n\n\n\n
Targeting individuals and businesses alike, it is imperative to ensure you and your organisation take a multi-layered approach to defence. <\/p>\n\n\n\n
By combining a secure mail platform, like Stackmail, with technical safeguards, such as SPF\/DKIM\/DMARC and email filters with user education and vigilance, you can significantly reduce your exposure to phishing and the damage it can cause. <\/p>\n\n\n
- Ensure passwords are regularly changed and are as complex and lengthy as possible <\/li>\n<\/ul>\n\n\n\n
- Regularly check mailboxes that are rarely used <\/li>\n<\/ul>\n\n\n\n
- Frequently delete mailboxes that are no longer in use, particularly those of ex-employees <\/li>\n<\/ul>\n\n\n\n
- Content-based \u2013 all messages are scanned for spam and phishing-like characteristics and either sent to spam\/junk or outright rejected. You can also change your own personal settings to be more lenient or strict for spam on a per mailbox basis. <\/li>\n<\/ul>\n\n\n\n
- Virus scanning \u2013 our comprehensive virus scanner will automatically scan emails and attachments for known malware signatures. This database is continuously updated to stay ahead of the curve. <\/li>\n<\/ul>\n\n\n\n
- Network-level \u2013 we utilise multiple deny lists from Spamhaus, Invaluement and Barracuda Networks to block any known bad actors. <\/li>\n<\/ul>\n\n\n\n
- Once the victim enters their details, these are then sent to the malicious actor, who can then access the victim\u2019s account on the legitimate website. <\/li>\n<\/ol>\n\n\n\n
- The user inputs their details <\/li>\n<\/ol>\n\n\n\n
- An email appears to come from support@yourbank.com but actually originates from a malicious IP address and includes a link to a fake login page. <\/li>\n<\/ol>\n\n\n\n
- Cloning reputable brands\u2019 email templates to capture sensitive data or login credentials that will later be used to defraud the target, steal further information, steal money or intellectual property. <\/li>\n<\/ul>\n\n\n\n
![\"Managed](\"https:\/\/www.20i.com\/blog\/wp-content\/uploads\/2025\/09\/20i-wordpress-hosting-ad.png\")
<\/a><\/div>\n\n","protected":false},"excerpt":{"rendered":"Introduction Phishing is one of the most pervasive and effective forms of cybercrime. It involves fraudulent attempts to…","protected":false},"author":34,"featured_media":17030,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"inline_featured_image":false,"ub_ctt_via":"","_monsterinsights_skip_tracking":false,"_monsterinsights_sitenote_active":false,"_monsterinsights_sitenote_note":"","_monsterinsights_sitenote_category":0,"csco_singular_sidebar":"","csco_page_header_type":"","csco_page_load_nextpost":"","footnotes":""},"categories":[288],"tags":[],"class_list":["post-16133","post","type-post","status-publish","format-standard","has-post-thumbnail","category-security","cs-entry"],"featured_image_src":"https:\/\/www.20i.com\/blog\/wp-content\/uploads\/2025\/06\/no-title-5.png","author_info":{"display_name":"Arron C","author_link":"https:\/\/www.20i.com\/blog\/author\/arroncruse\/"},"_links":{"self":[{"href":"https:\/\/www.20i.com\/blog\/wp-json\/wp\/v2\/posts\/16133","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.20i.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.20i.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.20i.com\/blog\/wp-json\/wp\/v2\/users\/34"}],"replies":[{"embeddable":true,"href":"https:\/\/www.20i.com\/blog\/wp-json\/wp\/v2\/comments?post=16133"}],"version-history":[{"count":6,"href":"https:\/\/www.20i.com\/blog\/wp-json\/wp\/v2\/posts\/16133\/revisions"}],"predecessor-version":[{"id":18210,"href":"https:\/\/www.20i.com\/blog\/wp-json\/wp\/v2\/posts\/16133\/revisions\/18210"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.20i.com\/blog\/wp-json\/wp\/v2\/media\/17030"}],"wp:attachment":[{"href":"https:\/\/www.20i.com\/blog\/wp-json\/wp\/v2\/media?parent=16133"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.20i.com\/blog\/wp-json\/wp\/v2\/categories?post=16133"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.20i.com\/blog\/wp-json\/wp\/v2\/tags?post=16133"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}