Academy
TermAttack

Typosquatting

Registering a domain that resembles a well-known domain through a typo or small difference and luring users to a fake site.

Flow

  1. 1Name registered
  2. 2Site copied
  3. 3Traffic directed
Related families
Vidar
MITRE ATT&CK
T1583.001 · Acquire Infrastructure: Domains
Sources
3 sources
01

Overview

The attacker registers a name very similar to the real domain by changing or adding letters or choosing a different extension. This name is used in phishing emails, ads or fake download pages. MITRE ATT&CK

A lookalike domain does not only wait for visitors who make a typo; traffic is deliberately sent to it through ads and email. MITRE ATT&CK

02

How it works

  1. 1

    Name registered

    A domain resembling the target brand is registered. MITRE ATT&CK

  2. 2

    Site copied

    The look of the real site is imitated.

  3. 3

    Traffic directed

    Visitors are sent through ads, email or social media. MITRE ATT&CK

03

Real-world examples

Fake Windows 11 download sites

Vidar profile

Zscaler documented that Vidar was distributed with backdoored packages from sites imitating Windows 11 download pages. Zscaler

04

How to detect it

  • Monitor new domain registrations and certificate records resembling your brand. MITRE ATT&CK
05

What to do

  • Register commonly confused variations defensively; enforce email authentication (DMARC).
06

MITRE ATT&CK

T1583.001Acquire Infrastructure: DomainsT1583.008Malvertising
07

Related families and terms

Families

VidarActive

Report

Infostealer Threat Report — October 2026

Terms

PhishingMalvertisingOpen-source intelligence
08

Sources

  1. 1Acquire Infrastructure: Domains (T1583.001) · MITRE ATT&CK
  2. 2Malvertising (T1583.008) · MITRE ATT&CK
  3. 3Vidar distributed through backdoored Windows 11 downloads · Zscaler
From the Essential plan

Infostealer Detection

See your firm's attack surface on one screen: how many findings, at which severity, on which domain.

View productCompare plans