Spoofing-as-a-Service Site Taken Down



Spoofing as a Service SiteLaw enforcement authorities across Europe, Australia, the United States, Ukraine, and Canada have taken down a popular website used by cybercriminals to impersonate major corporations in voice phishing (vishing) attacks. The website, called “iSpoof,” allowed scammers to pay for spoofed phone numbers so they could appear to be calling from legitimate organizations.

According to Europol, which coordinated the operation, users of the website are believed to have scammed victims around the world out of more than €115 million (approximately US$120 million).

“The services of the website allowed those who sign up and pay for the service to anonymously make spoofed calls, send recorded messages, and intercept one-time passwords,” Europol says. “The users were able to impersonate an infinite number of entities (such as banks, retail companies and government institutions) for financial gain and substantial losses to victims. The investigations showed that the website has earned over EUR 3.7 million in 16 months.”

As a result of the operation, 142 users and administrators of the site were arrested in November. More than 100 of these, including iSpoof’s main administrator, were arrested in the UK. London’s Metropolitan Police Commissioner Sir Mark Rowley stated that online fraud should be a major priority for law enforcement.

“The exploitation of technology by organised criminals is one of the greatest challenges for law enforcement in the 21st century,” Rowley said. “Together with the support of partners across UK policing and internationally, we are reinventing the way fraud is investigated. The Met is targeting the criminals at the centre of these illicit webs that cause misery to thousands. By taking away the tools and systems that have enabled fraudsters to cheat innocent people at scale, this operation shows how we are determined to target corrupt individuals intent on exploiting often vulnerable people.”

New-school security awareness training can enable your employees to thwart social engineering attacks.

Europol has the story.


Can hackers spoof an email address of your own domain?

DSTAre you aware that one of the first things hackers try is to see if they can spoof the email address of your CEO? If they are able to commit "CEO Fraud", penetrating your network is like taking candy from a baby.

Now they can launch a "CEO fraud" spear phishing attack on your organization, and that type of attack is very hard to defend against, unless your users are highly ‘security awareness’ trained.

Find out now if your domain can be spoofed. The Domain Spoof Test (DST) is a one-time free service. Run this test so you can address any mail server configuration issues that are found.

Try To Spoof Me!

PS: Don't like to click on redirected buttons? Cut & Paste this link in your browser:

https://www.knowbe4.com/domain-spoof-test/

Topics: Phishing

Subscribe To Our Blog


Ransomware Hostage Rescue Manual




Get the latest about social engineering

Subscribe to CyberheistNews