Phishing is a form of social engineering attack that uses deceptive digital communications — primarily email, but also SMS (smishing), phone (vishing), and social media — to trick targets into taking harmful actions.
Common Attack Types
| Type | Vector | Goal |
|---|---|---|
| Email phishing | Spoofed sender or lookalike domain | Credential theft, malware |
| Spear phishing | Targeted, personalized | High-value targets (executives) |
| Smishing | SMS with shortened URLs | Mobile credential theft |
| Vishing | Phone calls impersonating support | Account takeover |
| Clone phishing | Replicated legitimate email with malicious link | Bypass trust |
How Phishing URLs Work
Attackers register lookalike domains (paypa1.com, paypal.com.evil.net), use URL shorteners to hide destinations, or exploit open redirects on legitimate domains. A valid HTTPS certificate says nothing about whether a site is safe — phishing sites routinely use Let’s Encrypt.
Defenses
Domain-level: DMARC p=reject prevents your domain from being spoofed in emails. Register common typosquats of your brand. Monitor blacklist status.
User-level: Check the registered domain (not just the TLS padlock), use a password manager (won’t autofill on wrong domains), enable MFA, report suspicious emails.
Technical: Email filters (Google Workspace, Defender), browser reputation lists (Safe Browsing), DNS-based protection (Cloudflare Gateway, Cisco Umbrella).