Cyberpediaby Brain
ENDEFR

Typosquatting and combosquatting

How an attacker registers a domain close to a brand's to steal your credentials, and how to spot the booby-trapped address.

In 30 seconds

Where it happens
In an email, a text message or a message whose sender address or link imitates a known company. The address can be very close to the real one, with a few characters changed or left out2.
What the attacker wants
To get you onto a fake site to collect personal information, often login credentials4.
The reflex
Read the address in full, do not follow the link you received to provide personal or financial information2, open the service from your bookmarks instead (Brain's advice), and report the message.
If it is already done
Tell the right people in the organization and change the passwords you entered without delay, along with those of any other accounts where the same password is used2.

What it is

A domain name is the readable address of a website, for example the part after the "@" in an email or the one shown in the browser's address bar. A domain can be bought and, in some cases, obtained for free1. An attacker sometimes picks one close to that of a legitimate company: letters replaced by characters that look like them (homoglyphs) or a different extension, such as .co instead of .com1.

Domains close to a legitimate domain can be used to deliver malicious payloads through a drive-by compromise of a website1.

Straight answers

What is a lookalike domain?

It is a domain name registered to resemble that of a real organization. MITRE ATT&CK describes domains similar to legitimate domains, obtained with homoglyphs or a different extension1. CISA describes sender addresses that closely resemble that of a reputable company, by altering or omitting a few characters2.

What is a homoglyph?

It is a character that visually resembles another. MITRE cites "IDN homograph attacks": the attacker uses internationalized domain names and other alphabets (Cyrillic, Greek) to create domains that look visually like the original1. Links that look harmless but abuse special characters to imitate a legitimate site fall under the same technique3.

Does a padlock in the browser prove the site is the right one?

The CISA source cited here recommends looking for an address starting with "https" and a closed padlock, signs that the information will be encrypted2. It speaks of encryption, not of the site's identity: the same text asks you to also check the spelling of the address and the domain2. The padlock therefore does not replace reading the address.

Can an email with a lookalike link also install malware?

Yes. MITRE states that typosquatting can be used to deliver malicious payloads when a site is visited1. The link can also lead to a page that offers a file to download3.

What should I do if I think I clicked?

If information belonging to the organization may have been revealed, CISA advises telling the people concerned, including network administrators, who can watch for unusual activity2. Passwords that were revealed should be changed immediately2.

1Inside the attacker's head1 min

The attacker starts by choosing a name close to the target. MITRE describes several variants: homoglyphs, a different extension, different alphabets1. The group EXOTIC LILY, for example, impersonated organizations by changing the extension to ".us", ".co" or ".biz"1.

The attacker then buys the domain. Registrars each keep a public database that shows the contact details of every registered domain. Private WHOIS services show their own information instead, which hides the owner. The attacker can also vary the registration information and the registrars to hinder tracking of their infrastructure1.

Some domains are single-use: MITRE notes that addresses can be generated dynamically to serve malicious content to a single victim, including with one-time-use domain names1. Other attackers buy expired domains, which may already be allowed or judged trustworthy by defenders based on their history1.

That leaves the site itself. The targeted site can be a clone of a legitimate login portal, or look enough like it to carry elements of the real site in its address4. The accompanying message tries to get you to click, sometimes with several messages that look urgent4.

2What you see on screen1 min

The message seems to come from a known organization. CISA lists clues: a sender address close to a real address, a generic greeting such as "Dear Valued Customer", a signature with no contact details, spelling mistakes and an inconsistent layout2.

The link is the weak point. If you hover over it and the displayed address does not match the link text, it may be forged. A malicious site can look like the original, but its address uses a different spelling or another domain, for example .com instead of .net2. A URL shortening service can also hide the real destination2.

The login page can be a copy of the legitimate portal: the information entered in the forms is collected and sent to the attacker4. With some phishing kits (EvilProxy, Evilginx2), the victim is then redirected to the real site, and the attacker also captures the session cookie in addition to the username and password4.

Visual checking has limits. MITRE acknowledges that homoglyphs, in ASCII as well as in internationalized domains, and the obfuscation of addresses, can make manual verification difficult3. Hence the value of tools: warning banners on emails from outside, filters, and the anti-phishing features of the browser and the mail system23.

3Under the hoodIT teams1 min

The technical path comes down to a few steps that the sources describe separately. The attacker acquires a domain close to the target1. They prepare a site that clones a legitimate portal or imitates its appearance4. They send an email with a link and text that pushes you to click or to copy the address into the browser4. The site then collects the credentials, or offers a file to download depending on the pretext34.

The link can hide its destination in other ways. MITRE cites the address format that uses whole or hexadecimal numbers as the host name, and the fact that the text placed before an "@" is ignored. Here is a neutralized illustration of this type of address, taken from MITRE's example4:

Excerpt
Illustration (neutralized address):
hxxp://google[.]com@1157586937
[the browser ignores "google.com" before the @ and connects to the numeric address]

On the defense side for an organization, MITRE suggests voluntarily registering domains close to its own to discourage typosquatting1, monitoring recently created domains with a structure similar to its own, including under another extension1, and using SPF, DKIM and DMARC to filter messages based on the validity of the sender domain6.

4Case filesReal cases1 min

MITRE's pages give real cases without a campaign date: the date a page was last modified does not date the incident. The cases below are therefore presented without a date.

FIN7: a typosquatted link to a fake tool (date not given by the source)

MITRE reports that FIN7 sent spearphishing emails containing a typosquatted link to "ip-sccanner[.]com"3. The group also registered a malicious domain, advanced-ip-sccanner[.]com, which redirected to an attacker-controlled Dropbox containing the malicious executable1.

Magic Hound: domains chosen for specific victims (date not given by the source)

Magic Hound registered fraudulent domains such as "mail-newyorker[.]com" and "news12[.]com.recover-session-service[.]site" to target specific victims through phishing attacks1.

Scattered Spider and Silent Librarian (date not given by the source)

Scattered Spider registered domains to impersonate corporate login portals1. Silent Librarian acquired domains for credential-harvesting pages, which often impersonate the targeted organization, with free extensions: .TK, .ML, .GA, .CF and .GQ1.

5What you do1 min
  • Read the address in full, from left to right, before clicking. Hover over the link and compare it with the displayed text2.
  • Do not open the service from the link you received: CISA recommends not following links sent by email to provide personal or financial information2. Brain advises using your bookmarks. CISA also recommends verifying the request with the organization, using contact details found in a previous exchange, not on the site named in the message2.
  • Turn on multifactor authentication when it exists2.
  • Report the message. The UK NCSC states that reporting a scam is free, takes a minute and helps protect other people5. It can investigate fraudulent email addresses and websites and have them removed5. In a company, follow the internal reporting procedure first.
6Pitfalls1 min
  • Relying on the padlock alone: see above, the source speaks of encryption2.
  • Judging by the layout: a site can be a faithful clone of the legitimate portal4.
  • Counting on your eyes: homoglyphs make manual verification difficult3.
  • Reusing a password: if a password entered on a fake site is used elsewhere, it must be changed everywhere2.
  • Publishing too much information about yourself: the NCSC notes that criminals use information available online, including on social media, to make their messages more convincing5.

Fact sheet

Identifier
CP-015
Wing
1. Attacks and techniques
Brain skill
Detecting Phishing (detect_phishing)
Brain reflex
cr-005
Diagram
G1 · Attack vs Defense Chain
Languages
de, en, fr
Sources
6 sources checked on 3 November 2026
Sources6 sources
  1. MITRE ATT&CK, “Acquire Infrastructure: Domains, Sub-technique T1583.001 - Enterprise | MITRE ATT&CK®”. https://attack.mitre.org/techniques/T1583/001/ (accessed 3 November 2026)
  2. CISA, “Avoiding Social Engineering and Phishing Attacks”, 1 February 2021. https://www.cisa.gov/news-events/news/avoiding-social-engineering-and-phishing-attacks (accessed 3 November 2026)
  3. MITRE ATT&CK, “Phishing: Spearphishing Link, Sub-technique T1566.002 - Enterprise | MITRE ATT&CK®”. https://attack.mitre.org/techniques/T1566/002/ (accessed 3 November 2026)
  4. MITRE ATT&CK, “Phishing for Information: Spearphishing Link, Sub-technique T1598.003 - Enterprise | MITRE ATT&CK®”. https://attack.mitre.org/techniques/T1598/003/ (accessed 3 November 2026)
  5. NCSC (UK), “Phishing scams: how to spot and report them”, 26 November 2021. https://www.ncsc.gov.uk/collection/phishing-scams (accessed 3 November 2026)
  6. MITRE ATT&CK, “Phishing, Technique T1566 - Enterprise | MITRE ATT&CK®”. https://attack.mitre.org/techniques/T1566/ (accessed 3 November 2026)

Cite this article

Brain, “Typosquatting and combosquatting”, Cyberpedia, 2026. https://startbrain.io/cyberpedia/en/articles/typosquatting-combosquatting-lookalike-domains/

BibTeX 
@misc{brain_cp015_en_2026,
  author = {Brain},
  title = {Typosquatting and combosquatting},
  year = {2026},
  howpublished = {Cyberpedia},
  url = {https://startbrain.io/cyberpedia/en/articles/typosquatting-combosquatting-lookalike-domains/},
  note = {CC BY 4.0}
}
CC BY 4.0 licence