URL Disguise

ID: TEQ-002
Phase(s): Resource Development
Tactic(s): Website Creation

URL Disguise is where an adversary attempts to make their illegitimate version of a legitimate site appear to be the legitimate domain by associating it with a similar URL (such as F0rbes.com or G00gle.com). Traffic to and from this site may thus be mistaken by a human analyst as being associated with the legitimate version of the site. Alternatively an adversary may employ a shortened URL (such as a bit.ly address) in order to obfuscate the true URL.

Related Kill Chains