Domain squatting is the registration or use of a domain deliberately resembling a name, trademark or existing domain. Some registrations are intended for profitable resale. In cybersecurity, lookalike domains are often used to create false trust, steal credentials, manipulate invoices or distribute malware.
Which forms exist?
| Variant | Example and principle |
|---|---|
| Cybersquatting | A protected or well-known name is registered directly as a domain. |
| Typosquatting | Characters are omitted, transposed or replaced by nearby keyboard keys. |
| Homograph attack | Visually similar characters from another script imitate the genuine name. |
| Combosquatting | The brand is combined with plausible terms such as login, support or invoice. |
| TLD squatting | The correct name is registered under a different top-level domain. |
| Subdomain deception | The brand appears only on the left of an unrelated domain, such as company.login-example.tld. |
How are lookalike domains abused?
A deceptive domain may host a copied login page or act as a sender domain for phishing and business email compromise. Attackers sometimes configure only mail servers and show no website at all. Other domains redirect visitors to advertising, distribute malware, collect misdirected email or damage a brand. Expired domains from old campaigns and abandoned projects can also be taken over.
How can suspicious domains be identified?
- Read the registrable domain from right to left instead of focusing on a brand term at the beginning.
- Look for missing, added or transposed characters, unexpected hyphens and unusual endings.
- Check the Punycode representation of internationalized domains.
- Compare registration time, DNS, MX and certificate data with the claimed purpose.
- Do not visit a suspicious domain unprotected; inspect it in an isolated analysis environment.
A TLS padlock proves only that the connection to the displayed domain is encrypted. A fraudulent domain can possess a valid certificate too.
How can organizations protect themselves?
A risk-based defensive domain portfolio covers particularly likely typos, important country and generic endings, and campaign names. Registering every theoretical variant is neither possible nor economical. Continuous monitoring of registrations, certificate transparency, DNS and brand terms provides earlier warning. SPF, DKIM and DMARC protect the genuine domain against some sender forgery, but they do not stop mail from a differently spelled domain.
Staff should confirm payments, account changes and password requests over a second known channel. Password managers also help because they normally do not autofill credentials on a merely similar domain.
What should happen after discovery?
- Preserve the domain, timestamp, DNS, certificate, email headers and content as evidence.
- Assess risk: is it only registered, or already active for mail, login pages or malware?
- Warn affected users and block it in appropriate mail, web and monitoring controls.
- Notify the registrar, hosting provider and relevant browser, mail or CERT reporting channels.
- Consider trademark or domain dispute procedures with legal support.
Is every similar domain unlawful?
No. Identical terms can be descriptive, refer to different organizations or be used for criticism and other legitimate purposes. Trademark rights, likelihood of confusion, legitimate interest and bad- faith use can all matter. A technical similarity score therefore proves neither abuse nor a right to transfer. It is a signal for manual and, where necessary, legal review.
Thank you for your feedback! We will review it and optimize this content.