| Nature | Type | ID | Name |
|---|---|---|---|
| ChildOf | S | 616 | Establish Rogue Location |
| CanFollow | S | 98 | Phishing |
| CanPrecede | S | 89 | Pharming |
| CanPrecede | D | 543 | Counterfeit Websites |
Determine target website
The adversary first determines which website to impersonate, generally one that is trusted, receives a consistent amount of traffic, and is a homophone.
| Technique |
|---|
| Research popular or high traffic websites which are also homophones. |
Impersonate trusted domain
In order to impersonate the trusted domain, the adversary needs to register the SoundSquatted URL.
| Technique |
|---|
| Register the SoundSquatted domain. |
Deceive user into visiting domain
Finally, the adversary needs to deceive a user into visiting the SoundSquatted domain.
| Technique |
|---|
| Execute a phishing attack and send a user an e-mail convincing the user to click on a link leading the user to the SoundSquatted domain. |
| Assume that a user will unintentionally use the homophone in the URL, leading the user to the SoundSquatted domain. |
Adversaries must be able to register DNS hostnames/URL’s.
| Scope | Likelihood | Impact | Note |
|---|---|---|---|
| Other | N/A | Other | Depending on the intention of the adversary, a successful SoundSquatting attack can be leveraged to execute more complex attacks such as cross-site scripting or stealing account credentials. |
| ID | Name |
|---|
| Taxonomy Name | Entry ID | Entry Name |
|---|