Menu

Look-Alike Domains

Part of the Security Fundamentals section of Coddy's Cybersecurity journey. Lesson 9 of 43.

The part of an email address after @ is called the domain. An email can use a familiar name even when it comes from someone else. One trick is to use a look-alike domain: an address that looks almost like the real one. Compare these examples with Lumen's address, lumen.test:

payroll@lumen.test         Lumen's domain
payroll@lurnen.test        rn replaces m
payroll@lumen.payroll.test Lumen's name is added to payroll.test

In the second address, the letters r and n are placed together to look like an m. It is easy to miss if you only glance at the sender.

The third address uses another trick. It includes the word lumen, but lumen.payroll.test is part of payroll.test. It is not Lumen's lumen.test. Check the complete address after @, rather than trusting the name at the beginning.

challenge icon

Challenge

Easy

Ticket from Priya, support

Three more emails from Lumen came in this morning, people are opening them, and the team is nervous. Tell me which ones are really ours, and pull the fakes out of everyone's mail.

Try it yourself

Terminal

All lessons in Security Fundamentals