Skip to content

Phishing & brand protection glossary

Plain-language definitions of the terms used in phishing, domain abuse and takedowns. 40 terms.

A

Abuse reportAn abuse report is a formal complaint to a registrar, host or other provider asking it to act against misuse of its service, such as a phishing site.AiTM phishing (adversary-in-the-middle)AiTM phishing places a proxy between the victim and the real login page, capturing passwords and session cookies so attackers can bypass many MFA methods.

B

BIMI (Brand Indicators for Message Identification)BIMI shows a brand's logo next to authenticated email in supporting inboxes, and only works once the sending domain enforces DMARC.Brand impersonationBrand impersonation is the unauthorized use of a company's name, logo or design to deceive people through fake websites, ads, social accounts or emails.Brand protectionBrand protection is the ongoing work of finding and stopping online misuse of a brand, from phishing sites and fake accounts to counterfeit listings.Bulletproof hostingBulletproof hosting is web hosting that knowingly tolerates abuse such as phishing and malware, ignoring complaints so criminal sites stay online.Business email compromise (BEC)Business email compromise (BEC) is fraud in which criminals impersonate or take over a business email account to redirect payments or obtain data.

C

Certificate Transparency (CT)Certificate Transparency is a system of public logs recording TLS certificates as they are issued, so anyone can see certificates created for any domain.CloakingCloaking is a technique that shows harmful content to real victims but a harmless page to security scanners, reviewers and anyone checking a report.Clone phishingClone phishing copies a real email the target has already received, swaps its links or attachments for malicious ones and resends it as an update.CombosquattingCombosquatting is registering a domain that adds a word to a brand name, such as login, support or secure, so the fake address looks official.Credential harvestingCredential harvesting is the collection of usernames, passwords and other login data through fake sites or forms so attackers can take over real accounts.CybersquattingCybersquatting is registering or using a domain that matches someone else's trademark in bad faith, to profit from it, sell it back or deceive users.

D

DefangingDefanging is the practice of rewriting malicious URLs, such as hxxps://example[.]com, so they cannot be clicked or opened by accident when shared.DKIM (DomainKeys Identified Mail)DKIM adds a cryptographic signature to email so receivers can verify which domain signed the message and that it was not altered in transit.DMARCDMARC is an email authentication policy that tells receivers what to do with mail that fails SPF and DKIM checks for your domain, and sends you reports.DMCA takedown noticeA DMCA takedown notice is a formal request under US copyright law asking a provider to remove material that copies your content, such as a cloned website.Domain blocklistA domain blocklist is a list of domains or URLs known to be malicious, used by browsers, email filters and DNS resolvers to block or warn on access.Domain spoofingDomain spoofing is pretending to be a legitimate domain, either by forging it in email headers or by using a lookalike domain for websites and mail.

E

Email spoofingEmail spoofing is forging the sender details of an email, such as the From address or display name, so that it appears to come from someone else.

G

Google Safe BrowsingGoogle Safe Browsing is Google's service that flags phishing and malware sites and shows warnings in Chrome and other browsers that use its data.

H

Homograph attackA homograph attack uses look-alike characters, often from other alphabets, to build a domain that appears identical or nearly identical to a real one.

L

Letter of authorization (LoA)A letter of authorization is a signed document in which a brand authorizes an agent to file takedown requests and complaints on its behalf.Lookalike domainA lookalike domain is a domain name built to resemble a real brand's domain through typos, extra words, other extensions or similar-looking characters.

M

MalvertisingMalvertising is the use of online ads, often on search engines or social media, to send people to phishing pages, scams or malware downloads.

N

Newly registered domain (NRD)A newly registered domain is one created very recently, often within the last 30 days; phishing campaigns rely heavily on such fresh, short-lived domains.

P

PharmingPharming redirects users to a fake website even when they type the correct address, by tampering with DNS settings, routers or the device's hosts file.PhishingPhishing is a scam in which attackers pose as a trusted organization to trick people into revealing passwords, card details or other sensitive data.Phishing kitA phishing kit is a ready-made bundle of pages and scripts that lets an attacker put up a convincing fake version of a brand's login site in minutes.Phishing takedownA phishing takedown is the process of getting a phishing site removed or blocked by reporting it to registrars, hosts, CDNs and browser blocklists.PunycodePunycode is the ASCII encoding used to store internationalized domain names in DNS; such names start with xn-- and can hide look-alike characters.

Q

QuishingQuishing is phishing that hides a malicious link in a QR code, in an email or on a printed sticker, so people who scan it land on a fake page.

S

SmishingSmishing is phishing by SMS or messaging app: a text that impersonates a trusted brand and links to a fake site or asks the reader to call a number.Social media impersonationSocial media impersonation is the creation of fake profiles or pages posing as a brand, its support team or its executives in order to deceive people.Spear-phishingSpear-phishing is a targeted phishing attack that uses personal or company details to make a fake message convincing to one person or a small group.SPF (Sender Policy Framework)SPF (Sender Policy Framework) is a DNS record that lists the servers allowed to send email for a domain, so receivers can detect unauthorized senders.

T

TyposquattingTyposquatting is registering domains that differ from a brand's real domain by a typing error, so mistyped visits and careless clicks reach the attacker.

U

UDRP (Uniform Domain-Name Dispute-Resolution Policy)The UDRP is ICANN's policy for resolving domain disputes, letting trademark owners seek transfer or cancellation of a domain registered in bad faith.

V

VishingVishing is voice phishing: a phone call or voice message in which a scammer poses as a bank, support team or authority to obtain codes, data or money.

W

WhalingWhaling is spear-phishing aimed at senior executives or board members, using tailored messages to obtain payments, sensitive data or account access.