--- id: CP-015 slug: typosquatting-combosquatting-lookalike-domains lang: en title: Typosquatting and combosquatting description: How an attacker registers a domain close to a brand's to steal your credentials, and how to spot the booby-trapped address. canonical_url: https://startbrain.io/cyberpedia/en/articles/typosquatting-combosquatting-lookalike-domains/ markdown_url: https://startbrain.io/cyberpedia/en/articles/typosquatting-combosquatting-lookalike-domains.md publisher: Brain (https://startbrain.io) license: CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/) cite_as: Brain, "Typosquatting and combosquatting", Cyberpedia, 2026. https://startbrain.io/cyberpedia/en/articles/typosquatting-combosquatting-lookalike-domains/ (CC BY 4.0) wing: 1 theme: detect_phishing reflex: cr-005 schema: G1 updated: "2026-11-03" translations: en: https://startbrain.io/cyberpedia/en/articles/typosquatting-combosquatting-lookalike-domains/ fr: https://startbrain.io/cyberpedia/fr/articles/typosquatting-combosquatting-domaines-sosies/ de: https://startbrain.io/cyberpedia/de/articles/typosquatting-combosquatting-doppelgaenger-domains/ es: https://startbrain.io/cyberpedia/es/articles/typosquatting-combosquatting-dominios-gemelos/ sources: - "n": 1 title: "Acquire Infrastructure: Domains, Sub-technique T1583.001 - Enterprise | MITRE ATT&CK®" publisher: MITRE ATT&CK url: https://attack.mitre.org/techniques/T1583/001/ accessed: "2026-11-03" - "n": 2 title: Avoiding Social Engineering and Phishing Attacks publisher: CISA url: https://www.cisa.gov/news-events/news/avoiding-social-engineering-and-phishing-attacks published: "2021-02-01" accessed: "2026-11-03" - "n": 3 title: "Phishing: Spearphishing Link, Sub-technique T1566.002 - Enterprise | MITRE ATT&CK®" publisher: MITRE ATT&CK url: https://attack.mitre.org/techniques/T1566/002/ accessed: "2026-11-03" - "n": 4 title: "Phishing for Information: Spearphishing Link, Sub-technique T1598.003 - Enterprise | MITRE ATT&CK®" publisher: MITRE ATT&CK url: https://attack.mitre.org/techniques/T1598/003/ accessed: "2026-11-03" - "n": 5 title: "Phishing scams: how to spot and report them" publisher: NCSC (UK) url: https://www.ncsc.gov.uk/collection/phishing-scams published: "2021-11-26" accessed: "2026-11-03" - "n": 6 title: Phishing, Technique T1566 - Enterprise | MITRE ATT&CK® publisher: MITRE ATT&CK url: https://attack.mitre.org/techniques/T1566/ accessed: "2026-11-03" --- # Typosquatting and combosquatting A domain name is the readable address of a website, for example the part after the "@" in an email or the one shown in the browser's address bar. A domain can be bought and, in some cases, obtained for free [1]. An attacker sometimes picks one close to that of a legitimate company: letters replaced by characters that look like them (homoglyphs) or a different extension, such as .co instead of .com [1]. Domains close to a legitimate domain can be used to deliver malicious payloads through a drive-by compromise of a website [1]. ## In 30 seconds - Where it happens: in an email, a text message or a message whose sender address or link imitates a known company. The address can be very close to the real one, with a few characters changed or left out [2]. - What the attacker wants: to get you onto a fake site to collect personal information, often login credentials [4]. - The reflex: read the address in full, do not follow the link you received to provide personal or financial information [2], open the service from your bookmarks instead (Brain's advice), and report the message. - If it is already done: tell the right people in the organization and change the passwords you entered without delay, along with those of any other accounts where the same password is used [2]. ## Straight answers ### What is a lookalike domain? It is a domain name registered to resemble that of a real organization. MITRE ATT&CK describes domains similar to legitimate domains, obtained with homoglyphs or a different extension [1]. CISA describes sender addresses that closely resemble that of a reputable company, by altering or omitting a few characters [2]. ### What is a homoglyph? It is a character that visually resembles another. MITRE cites "IDN homograph attacks": the attacker uses internationalized domain names and other alphabets (Cyrillic, Greek) to create domains that look visually like the original [1]. Links that look harmless but abuse special characters to imitate a legitimate site fall under the same technique [3]. ### Does a padlock in the browser prove the site is the right one? The CISA source cited here recommends looking for an address starting with "https" and a closed padlock, signs that the information will be encrypted [2]. It speaks of encryption, not of the site's identity: the same text asks you to also check the spelling of the address and the domain [2]. The padlock therefore does not replace reading the address. ### Can an email with a lookalike link also install malware? Yes. MITRE states that typosquatting can be used to deliver malicious payloads when a site is visited [1]. The link can also lead to a page that offers a file to download [3]. ### What should I do if I think I clicked? If information belonging to the organization may have been revealed, CISA advises telling the people concerned, including network administrators, who can watch for unusual activity [2]. Passwords that were revealed should be changed immediately [2]. ## Inside the attacker's head The attacker starts by choosing a name close to the target. MITRE describes several variants: homoglyphs, a different extension, different alphabets [1]. The group EXOTIC LILY, for example, impersonated organizations by changing the extension to ".us", ".co" or ".biz" [1]. The attacker then buys the domain. Registrars each keep a public database that shows the contact details of every registered domain. Private WHOIS services show their own information instead, which hides the owner. The attacker can also vary the registration information and the registrars to hinder tracking of their infrastructure [1]. Some domains are single-use: MITRE notes that addresses can be generated dynamically to serve malicious content to a single victim, including with one-time-use domain names [1]. Other attackers buy expired domains, which may already be allowed or judged trustworthy by defenders based on their history [1]. That leaves the site itself. The targeted site can be a clone of a legitimate login portal, or look enough like it to carry elements of the real site in its address [4]. The accompanying message tries to get you to click, sometimes with several messages that look urgent [4]. ## What you see on screen The message seems to come from a known organization. CISA lists clues: a sender address close to a real address, a generic greeting such as "Dear Valued Customer", a signature with no contact details, spelling mistakes and an inconsistent layout [2]. The link is the weak point. If you hover over it and the displayed address does not match the link text, it may be forged. A malicious site can look like the original, but its address uses a different spelling or another domain, for example .com instead of .net [2]. A URL shortening service can also hide the real destination [2]. The login page can be a copy of the legitimate portal: the information entered in the forms is collected and sent to the attacker [4]. With some phishing kits (EvilProxy, Evilginx2), the victim is then redirected to the real site, and the attacker also captures the session cookie in addition to the username and password [4]. Visual checking has limits. MITRE acknowledges that homoglyphs, in ASCII as well as in internationalized domains, and the obfuscation of addresses, can make manual verification difficult [3]. Hence the value of tools: warning banners on emails from outside, filters, and the anti-phishing features of the browser and the mail system [2][3]. ## Under the hood The technical path comes down to a few steps that the sources describe separately. The attacker acquires a domain close to the target [1]. They prepare a site that clones a legitimate portal or imitates its appearance [4]. They send an email with a link and text that pushes you to click or to copy the address into the browser [4]. The site then collects the credentials, or offers a file to download depending on the pretext [3][4]. The link can hide its destination in other ways. MITRE cites the address format that uses whole or hexadecimal numbers as the host name, and the fact that the text placed before an "@" is ignored. Here is a neutralized illustration of this type of address, taken from MITRE's example [4]: ```text Illustration (neutralized address): hxxp://google[.]com@1157586937 [the browser ignores "google.com" before the @ and connects to the numeric address] ``` On the defense side for an organization, MITRE suggests voluntarily registering domains close to its own to discourage typosquatting [1], monitoring recently created domains with a structure similar to its own, including under another extension [1], and using SPF, DKIM and DMARC to filter messages based on the validity of the sender domain [6]. ## Case files MITRE's pages give real cases without a campaign date: the date a page was last modified does not date the incident. The cases below are therefore presented without a date. ### FIN7: a typosquatted link to a fake tool (date not given by the source) MITRE reports that FIN7 sent spearphishing emails containing a typosquatted link to "ip-sccanner[.]com" [3]. The group also registered a malicious domain, advanced-ip-sccanner[.]com, which redirected to an attacker-controlled Dropbox containing the malicious executable [1]. ### Magic Hound: domains chosen for specific victims (date not given by the source) Magic Hound registered fraudulent domains such as "mail-newyorker[.]com" and "news12[.]com.recover-session-service[.]site" to target specific victims through phishing attacks [1]. ### Scattered Spider and Silent Librarian (date not given by the source) Scattered Spider registered domains to impersonate corporate login portals [1]. Silent Librarian acquired domains for credential-harvesting pages, which often impersonate the targeted organization, with free extensions: .TK, .ML, .GA, .CF and .GQ [1]. ## What you do - Read the address in full, from left to right, before clicking. Hover over the link and compare it with the displayed text [2]. - Do not open the service from the link you received: CISA recommends not following links sent by email to provide personal or financial information [2]. Brain advises using your bookmarks. CISA also recommends verifying the request with the organization, using contact details found in a previous exchange, not on the site named in the message [2]. - Turn on multifactor authentication when it exists [2]. - Report the message. The UK NCSC states that reporting a scam is free, takes a minute and helps protect other people [5]. It can investigate fraudulent email addresses and websites and have them removed [5]. In a company, follow the internal reporting procedure first. ## Pitfalls - Relying on the padlock alone: see above, the source speaks of encryption [2]. - Judging by the layout: a site can be a faithful clone of the legitimate portal [4]. - Counting on your eyes: homoglyphs make manual verification difficult [3]. - Reusing a password: if a password entered on a fake site is used elsewhere, it must be changed everywhere [2]. - Publishing too much information about yourself: the NCSC notes that criminals use information available online, including on social media, to make their messages more convincing [5]. ## Sources 1. MITRE ATT&CK, "Acquire Infrastructure: Domains, Sub-technique T1583.001 - Enterprise | MITRE ATT&CK®". https://attack.mitre.org/techniques/T1583/001/ (accessed 3 November 2026) 2. CISA, "Avoiding Social Engineering and Phishing Attacks", 1 February 2021. https://www.cisa.gov/news-events/news/avoiding-social-engineering-and-phishing-attacks (accessed 3 November 2026) 3. MITRE ATT&CK, "Phishing: Spearphishing Link, Sub-technique T1566.002 - Enterprise | MITRE ATT&CK®". https://attack.mitre.org/techniques/T1566/002/ (accessed 3 November 2026) 4. MITRE ATT&CK, "Phishing for Information: Spearphishing Link, Sub-technique T1598.003 - Enterprise | MITRE ATT&CK®". https://attack.mitre.org/techniques/T1598/003/ (accessed 3 November 2026) 5. NCSC (UK), "Phishing scams: how to spot and report them", 26 November 2021. https://www.ncsc.gov.uk/collection/phishing-scams (accessed 3 November 2026) 6. MITRE ATT&CK, "Phishing, Technique T1566 - Enterprise | MITRE ATT&CK®". https://attack.mitre.org/techniques/T1566/ (accessed 3 November 2026) --- Original source: Cyberpedia, the public cybersecurity and AI encyclopedia published by Brain. Canonical version: https://startbrain.io/cyberpedia/en/articles/typosquatting-combosquatting-lookalike-domains/ You may reuse this text freely under the CC BY 4.0 license (https://creativecommons.org/licenses/by/4.0/), provided you credit "Brain, Cyberpedia" with a link to the canonical URL above.