How To Spot Typosquatting Domains Using Asset Discovery Tools

Last Updated on 2 May 2024 by Alastair Digby

There’s a seemingly endless list of cybersecurity threats facing organisations today. Among these threats, typosquatting stands out as a deceptive practice used by threat actors to exploit user errors in typing website addresses. To combat this growing menace, asset discovery tools play a crucial role in identifying and mitigating the risks associated with malicious typosquatting domains.

What is typosquatting?

Typosquatting, also known as URL hijacking, is a social engineering attack where threat actors register domain names that closely resemble legitimate websites. These fraudulent domains are designed to capitalise on common typing mistakes made by users, such as misspelling a website’s URL or omitting a character.

How typosquatting works

Threat actors create typosquatting domains with the intention of deceiving unsuspecting users into visiting counterfeit websites. These fraudulent sites may mimic the appearance and functionality of legitimate platforms, aiming to steal sensitive information, distribute malware, or engage in other illicit activities. Here are some common methods used in typosquatting:

• Character Omission: This happens when a user forgets to type a character in the URL. For example, typing “gogle.com” instead of “google.com”.
• Character Permutation: This occurs when two characters are swapped. For example, typing “googgle.com” instead of “google.com”.
• Character Substitution: This happens when a character is replaced by another character. For example, typing “googel.com” instead of “google.com”.
• Adding Extra Characters: This occurs when an extra character is added to the URL. For example, typing “googlle.com” instead of “google.com”.
• Adjacent Key Errors: This happens when a user hits a key adjacent to the intended key on the keyboard. For example, typing “googke.com” instead of “google.com”.

Examples of typosquatting attacks

Examples of typosquatting attacks include registering domain names with slight variations in spelling, such as replacing letters with similar-looking characters or appending additional words to the original URL. For instance, a malicious actor might register “googgle.com” instead of “google.com” to trick users into visiting a fake search engine.

Several high-profile cases illustrate the prevalence and impact of typosquatting, underscoring the importance of proactive detection and mitigation efforts. For instance, cybercriminals have targeted well-known brands like Google, Facebook, and PayPal by registering typosquatting domains to impersonate legitimate services and steal sensitive information from unsuspecting users.

In February this year researchers from Palo Alto Networks identified a new Linux variant of the Bifrost (also known as Bifrose) malware. This malware used typosquatting to mimic a legitimate VMware domain, enabling it to fly under the radar. Active since 2004, the Bifrost remote access Trojan (RAT) gathers sensitive information like hostname and IP address from systems it compromises.

The need for asset discovery tools

Asset discovery tools play a crucial role in cybersecurity by providing organizations with comprehensive visibility into their digital assets, including domains, subdomains, and associated infrastructure. These tools employ various techniques such as passive and active reconnaissance to gather information about an organization’s online presence, helping security teams identify potential vulnerabilities and threats.

Challenges in identifying typosquatting domains

The sheer volume of domain registrations and the dynamic nature of the internet present significant challenges for cybersecurity professionals tasked with identifying typosquatting domains. Traditional methods of detection are often time-consuming and ineffective, leaving organisations vulnerable to exploitation by cybercriminals.

Identifying Malicious Typosquatting Domains

Identifying typosquatting domains can be challenging due to their subtle differences from legitimate ones. However, asset discovery tools can streamline this process by scanning vast swathes of the internet to uncover suspicious domains that mimic popular brands or trademarks. By analyzing domain registrations, WHOIS records, and DNS data, these tools can flag potential instances of typosquatting for further investigation.

Steps to spot typosquatting domains using asset discovery tools

To effectively spot typosquatting domains using asset discovery tools, organizations can follow a structured approach that includes the following steps:

1. Define Scope: Begin by defining the scope of the investigation, including the target domain or brand names susceptible to typosquatting.

2. Configure Scans: Configure the asset discovery tool to scan relevant portions of the internet, focusing on domains similar to the target brand or keywords associated with typosquatting.

3. Analyze Results: Review the scan results to identify domains that exhibit characteristics indicative of typosquatting, such as phonetic similarities, misspellings, or variations in top-level domains (TLDs).

4. Verify Legitimacy: Validate the legitimacy of identified domains by conducting further analysis, such as WHOIS lookups, DNS resolution, and website content inspection.

5. Flag Suspicious Domains: Flag suspicious domains for further investigation or mitigation actions, such as domain takedown requests or monitoring for malicious activity.

Case Study

One of our clients, a leading international trade association, was recently a victim of a typosquatting threat. Fortunately thanks to our EASM platform they were able to spot the malicious domain quickly and take the necessary steps to mitigate the threat.

Using our asset discovery tool the typosquatting domain appeared as a new asset which on the surface looked similar to one of their websites. However, upon closer inspection and by delving into the underlying data it became clear that this domain was indeed malicious. 

The threat actor had spun up the typosquatting domain and scrapped one of our client’s website’s content which included their analytics codes and copyright details. This gave the impression to an unsuspected user the site was legitimate. A technique which is commonly used to deceive users. 

Once identified and confirmed as a threat further investigations into the DNS records identified who the individual was. This led to a site takedown service being used to remove the malicious site and infrastructure from the internet.

Without using an EASM solution the malicious site could have gone undetected which could have caused an array is serious issues.

Benefits of using asset discovery tools

The use of asset discovery tools offers numerous benefits for organizations seeking to improve visibility, protect their digital assets and mitigate the risks of typosquatting attacks.

Early detection of potential threats

Asset discovery tools enable organizations to identify potential threats at an early stage before they can cause significant harm or damage. By continuously scanning the internet for new domain registrations and suspicious activities, these tools provide organizations with actionable intelligence to mitigate emerging threats proactively.

Protection of brand reputation

Malicious typosquatting domains pose a significant risk to organizations’ brand reputation and credibility. By using asset discovery tools to identify and block fraudulent domains, organizations can protect their brand identity and maintain the trust and confidence of their customers and stakeholders.

Reduction of security risks and financial losses

The financial implications of falling victim to a typosquatting attack can be substantial, including potential losses from fraud, data theft, and regulatory penalties. Asset discovery tools help organizations minimize these risks by identifying and mitigating potential threats before they can escalate into costly security breaches.

Best practices for implementing asset discovery tools

Effective implementation of asset discovery tools requires careful planning and adherence to best practices to maximise their effectiveness.

Regular scanning and monitoring

Organizations should conduct regular scans of their digital assets using asset discovery tools to identify potential threats and vulnerabilities. Continuous monitoring ensures that any suspicious activity is promptly detected and addressed before it can cause harm.

Collaboration with cybersecurity experts

Collaboration with cybersecurity experts and threat intelligence providers can enhance the effectiveness of asset discovery tools by providing access to up-to-date threat intelligence feeds and industry insights. By leveraging external expertise, organizations can stay informed about emerging threats and adapt their security strategies accordingly.

Continuous updates and adjustments

Cyber threats are constantly evolving, requiring organizations to adapt their security measures accordingly. Asset discovery tools should be regularly updated and configured to reflect changes in the threat landscape, ensuring that they remain effective in identifying and mitigating emerging threats.

Future trends in asset discovery

As cyber threats become increasingly sophisticated, asset discovery tools are expected to evolve to meet the growing demands of organizations seeking to protect their digital assets.

Advancements in machine learning and AI

Machine learning and artificial intelligence (AI) technologies are poised to revolutionize the field of asset discovery, enabling more accurate and proactive detection of cyber threats. By leveraging machine learning algorithms trained on vast datasets of historical domain registrations and threat indicators, asset discovery tools can identify patterns and anomalies indicative of typosquatting activity with unprecedented accuracy.

Expansion of detection capabilities

Asset discovery tools will continue to expand their detection capabilities to encompass a broader range of cyber threats beyond typosquatting. These may include domain hijacking, phishing attacks, and other forms of online fraud, requiring asset discovery tools to adapt and evolve in response to emerging threats.

Final thoughts

In conclusion, asset discovery tools play a vital role in identifying and mitigating the risks associated with malicious typosquatting domains. By leveraging advanced scanning techniques, real-time monitoring capabilities, and integration with existing security systems, these tools empower organizations to stay one step ahead of cyber threats and protect their digital assets and brand reputation.

Frequently Asked Questions