Using a visually similar domain as the destination for a phishing link to impersonate a trusted organization and prompt a user to disclose credentials or access/download malicious content. This record covers the phishing-link behavior; acquiring a lookalike domain is a preparatory Resource Development action (MITRE ATT&CK T1583.001).
Requirements: none specified (operational prerequisites may still apply)
Check before starting: RESTRICTED_ACCESS_BLUR_MARKER
Variant:
Full outcome coverage
Gophish · Start Gophish Services
Start Gophish Services
powershell
RESTRICTED_ACCESS_BLUR_MARKER
Version: RESTRICTED_ACCESS_BLUR_MARKER. Requirements: ALL(RESTRICTED_ACCESS_BLUR_MARKER)Documents all requested outcomes. This is a candidate, not proof of execution or compatibility.Shell: RESTRICTED_ACCESS_BLUR_MARKER. Privileges: not documented.preconditions: RESTRICTED_ACCESS_BLUR_MARKERdependencies: RESTRICTED_ACCESS_BLUR_MARKERverification: RESTRICTED_ACCESS_BLUR_MARKERfailure modes: RESTRICTED_ACCESS_BLUR_MARKERlimitations: RESTRICTED_ACCESS_BLUR_MARKER