Typosquatted Domains

Layer 6: Presentation Medium risk

How it works

Typosquatting relies on domain names that are easy to misread: a swapped letter, a missing character, a different ending such as .co instead of .ca, or characters from other alphabets that look identical on screen. Attackers register these names cheaply and use them to send email that appears to come from you, your suppliers or your clients. Registering a domain takes only minutes and costs very little, so attackers can create many variations at once.

In a busy inbox, few people check every letter of a sender's address. Lookalike domains are a common ingredient in invoice fraud and business email compromise, and they can host fake login pages or websites that copy your branding. Your own customers may be targeted using your name, which can damage trust even though your systems were never breached. Lookalike sites can also appear in search results or ads, catching people who type your name into a search engine.

Warning signs

• Emails from domains that differ from the real one by a character
• Customers asking about messages you did not send
• New domains registered that resemble your brand
• Replies going to an address slightly different from the sender
• Fake websites copying your logo or content

How to defend against it

• Monitor new domain registrations similar to your name
• Consider registering common variations of your domain
• Use email security that flags lookalike sender domains
• Publish a DMARC policy to stop direct spoofing of your domain
• Teach staff to check sender addresses on financial requests

If it happens to you

1. Warn affected clients and partners through trusted channels
2. Report the domain to the registrar and hosting provider for takedown
3. Block the domain in your email filtering
4. Review whether any payments or data were sent to it