Typosquatting is a deceptive technique in which threat actors register misspelled or look-alike domains of legitimate organizations to trick users into visiting fraudulent sites. It remains one of the most effective and underestimated attack vectors in the modern cyber threat landscape.
What appears to be a misspelled domain often conceals sophisticated campaigns designed to phish company employees or customers, harvest credentials, deliver malware, and damage organizational reputation. Recent observations by CrowdStrike Counter Adversary Operations reveal that threat actors have refined their typosquatting techniques to a concerning degree of sophistication, making detection increasingly challenging for security teams.
Adversaries’ ability to easily establish seemingly legitimate infrastructure poses significant risks to organizations of all sizes. One typosquatted domain can serve multiple malicious purposes while appearing benign to casual observers. In this blog, we examine key typosquatting tactics to help organizations understand and defend against brand impersonation and credential harvesting attacks.
The Foundation: Exploiting Domain Registration Weaknesses
The domain registration process presents numerous opportunities for threat actors to establish seemingly credible infrastructure. Most domain registrars require minimal verification, allowing adversaries to populate WHOIS records with fabricated but convincing company information mirroring that of legitimate organizations.
While the Internet Cooperation for Assigned Names and Numbers (ICANN) 2013 Registrar Accreditation Agreement requires registrars to validate and verify certain WHOIS fields — often just enough to ensure the registrant’s provided contact details are operational — threat actors can still register credible-looking infrastructure using disposable email addresses and scraped business details.
Threat actors commonly register domains using slight variations of target company names, replacing characters with visually similar alternatives, adding common prefixes or suffixes, or exploiting common typing errors. For example, a threat actor targeting examplecorp[.]com might register examp1ecorp[.]com, example-corp[.]com, or examplecorp-support[.]com.
A registered domain’s WHOIS information plays a critical role in the deception. Adversaries often populate these records with information that appears legitimate at first glance: seemingly real company names, professional email addresses, and valid phone numbers. Some sophisticated actors even register domains using publicly available corporate information — including legitimate business addresses and contact details harvested from the target organization’s public filings — to increase their appearance of authenticity.
