FBI Warns of 63 Spoofed Domains Impersonating the US Census Bureau

Cybercriminals register fake US Census Bureau domains to dupe unsuspecting citizens to provide personal information and install malware, the FBI warns.

In a flash alert published in coordination with the federal government statistical agency, the FBI notes that they have observed around 63 domains impersonating the US Census Bureau.

“Spoofed domains (aka typosquatting) mimic legitimate domains by either altering character(s) within the domain or associating another domain with similar characteristics to the legitimate domain, such as ‘Censusburea[.]com’ or “census-gov[.]us’,” the FBI said.

Although the Census Bureau is working hard to disable these spoofed domains, the alert emphasized the dangers of accessing look-alike websites. Threat actors will “attempt to exploit respondents and users of the data for financial gain and other nefarious purposes,” such as harvesting usernames, passwords, email addresses and spread malware.

“As part of the US government’s facilities sector, the Census Bureau remains a target for both criminal and nationstate actors aiming to negatively affect the US Government and create distrust among US citizens,” the FBI added.

The warning also provides a list of recommended mitigations to help users and businesses fend off malicious activity:

• Pay close attention to the spelling of websites you access
• Regularly patch operating systems and software
• Make sure that the SSL (Secure Sockets Layer) certificate is present, and the top-level domain for the website is “.gov”
• Keep security solutions up to date on all devices
• Use two-factor or multi-factor authentication where possible
• Audit networks and systems for unauthorized remote communication
• Disable or remove unneeded software, protocols, macros, and portals

Last but not least, report any suspicious activity to your local FBI field office or Internet Crime Complaint Center (IC3).