Typosquatting and Homoglyph Domains: Teaching Staff to Read URLs Properly

It is a recurring scene inside Security Operations Centres across the UK. A hurried employee receives an urgent alert purportedly sent by internal IT, clicks the link, inputs their credentials, and approves an MFA push notification. At first glance, the landing page was a pixel-perfect replica of the corporate single sign-on portal. In reality, the domain harboured an almost imperceptible alteration, turning a routine morning task into a critical perimeter breach.

For CISOs and information security leaders, defending the estate is no longer just about technical perimeter filtering. Secure email gateways intercept the vast majority of commodity threats, but cybercriminals increasingly invest in deceptive domain registrations tailored specifically to fool the human eye. To counter this risk sustainably, organisations must transform every employee into an astute proofreader, equipped to dissect the underlying architecture of a URL before placing their trust in it.

How Can You Detect a Spoofed Domain From Typosquatting or a Homoglyph Attack?#

Direct Answer: To detect a spoofed domain, inspect the root domain immediately preceding the first single forward slash, watch out for visual letter mergers such as "rn" mimicking an "m", and spot non-Latin Cyrillic characters via the automated "xn--" Punycode prefix in the browser address bar.

Domain spoofing relies on cognitive shortcuts. When reading familiar terms at speed, the human brain does not parse every single character sequentially; it recognises overall geometric shapes. Cybercriminals exploit this cognitive vulnerability through two principal techniques:

• Classic typosquatting: This vectors on common typing slips, omitted letters, swapped adjacent consonants, or subtle character insertions. The most insidious variation remains visual substitution: placing "r" next to "n" to simulate an "m" (such as "rnicrosoft.com" instead of "microsoft.com"). On a compact smartphone screen or standard laptop display, the visual illusion is extraordinarily convincing.
• IDN homoglyph attacks: This tactic leverages Internationalised Domain Names to swap standard Latin characters with visually indistinguishable glyphs from alternate scripts, most notably Cyrillic or Greek. The Cyrillic small letter "а" (U+0430) looks identical to the Latin "a" (U+0061), yet resolving web infrastructure treats it as an entirely distinct host.
• The Punycode indicator: When a domain incorporates non-Latin characters, contemporary web browsers translate the string into ASCII-compatible Punycode, which invariably starts with the prefix "xn--". Teaching staff to recognise this prefix in their browser address bar delivers an immediate, definitive defence against homoglyph deception.

Why Does Subdomain Stacking Deceive Corporate Users So Easily?#

Direct Answer: Attackers stack legitimate-looking subdomains to disguise the destination host, placing reassuring corporate terms on the left. The countermeasure is reading leftwards from the first single forward slash to expose the authentic hosting domain.

Another sophisticated manoeuvre involves manipulating subdomain hierarchies. An adversary registers an innocuous, arbitrary root domain, such as "secure-portal.co.uk", and subsequently configures a cascading series of subdomains imitating a corporate identity.

An unsuspecting staff member sees the following string displayed in their address bar: https://login.microsoft.com.secure-portal.co.uk/auth.

Faced with this syntax, an untrained user reads intuitively from left to right, stops at "login.microsoft.com", and assumes the destination is genuine. To dismantle this deception, security teams must embed a straightforward parsing discipline:

• Isolate the first single slash: Locate the initial single forward slash ("/") following the "https://" protocol indicator.
• Read immediately leftwards: The legitimate host consists strictly of the domain label and extension directly preceding that single forward slash (such as .com or .co.uk).
• Identify the true host: Everything positioned further to the left is merely a subdomain managed entirely by the owner of the root domain. In the example above, the destination belongs to "secure-portal.co.uk" and carries no contractual or technical association with the enterprise vendor.

Which Operational Habits Establish Resilient Browsing Routines?#

Theoretical guidance alone does not change behaviour: operational resilience takes root through consistent habits and simplified workflows. To minimise exposure to credential theft and social engineering, security awareness programmes should embed several pragmatic practices into corporate culture.

Standardising Corporate Bookmarks

The simplest way to neutralise typosquatted links is to eliminate clicking on unverified links received via email or messaging tools for high-value services. Encourage teams to curate a managed folder of verified bookmarks inside their work browser. Whether logging into corporate webmail, human resources portals, banking consoles, or cloud administrative dashboards, access should occur solely through authenticated bookmarks or deliberate manual entry.

Active Practice Through Gamified Challenges

To ensure these analytical habits stick without causing compliance fatigue, gamified training formats offer substantial measurable value. Running brief, competitive scenarios exposes employees to authentic URL analysis under conditions of mild time pressure.

This dynamic is central to Cyber Cup, an arcade-style team cybersecurity quiz competition. Featuring fast-paced 3-minute rounds and real-time leaderboards, this platform is accessible via self-service (including 5 free access passes without requiring credit card details) to sharpen staff visual acuity against weaponised URLs while strengthening team culture.

BRAIN SECURITY PRODUCT IN ACTION · Cyber Cup

Moving From Passive Suspicion to Active Verification#

Typosquatting and homoglyph campaigns will remain staples of the adversarial playbook because their operational cost is negligible compared to the commercial value of compromised enterprise credentials. However, once your workforce learns how to deconstruct an address bar methodically, the success rate of these deceptive facades drops dramatically.

By combining solid defensive architecture (such as phishing-resistant FIDO2 multi-factor authentication) with frequent, interactive capability-building, you construct a resilient human firewall. Looking to elevate your organisation's security posture through engaging, high-impact methodologies? Book a demo with us to explore our tailored training programmes.

Further reading: related articles and Brain Security solutions#

Related articles on this topic

• Fake Document Shares and E-Signatures: The B2B Phishing Trap (Phishing & Social Engineering) : Discover how to counter document share phishing, fake e-signatures, AiTM reverse proxy attacks, and session hijacking across your organisation.
• AiTM Phishing: Why Even 2FA Codes Entered on Fake Pages Are Stolen (Phishing & Social Engineering) : Discover how AiTM phishing bypasses multi-factor authentication via session cookie theft, and explore practical solutions to protect your organisation.
• Phishing Reporting Rate: Why CISOs Must Ditch the Click Rate (Phishing & Social Engineering) : Discover why phishing reporting rates outperform click rates to slash risk exposure and protect your business in minutes. Read our guide.
• Data Breaches: Why the 72-Hour Regulatory Clock Relies on First-Witness Instincts (Cyber Crisis & Ransomware) : Data breach and 72-hour notification: discover why staff internal detection governs GDPR compliance and how to dismantle the fear of reporting.

Explore Brain Security solutions on our website

• Featured solution : Cyber Cup : The fully customisable cyber competition: custom game flow, boss fights and a public leaderboard.
• Browse use cases by security goal and sector
• Compare our cybersecurity and AI awareness formats
• Explore the full interactive Brain Security catalogue
• Discuss your needs with our team (demo and setup)