Skip to main content

EASM Typosquatting detection

EASM compares discovered Domain and Similar domain assets with your organization's legitimate, monitored domains to identify possible typosquatting. Typosquatting domains are often registered to impersonate a brand in phishing campaigns or to host malicious websites.

EASM detects the following techniques:

  • Misspelled domain: letters are added, removed, replaced, or swapped in the domain name. For example, exmaple.com or examplle.com.

  • Alternative TLD: the domain name matches a legitimate domain but uses a different top-level domain. For example, example.net or example.org instead of example.com.

  • Typographic technique: characters are replaced with visually similar characters or with characters adjacent on the keyboard. For example, examp1e.com (1 instead of l), ex0mple.com, or exampke.com (k is next to l).

A single domain can match more than one technique. In this case, all detected techniques are displayed.

Note

Typosquatting detection runs against the domains listed in your scan configuration. To monitor additional domains, add them to the scan configuration.

View typosquatting results

  • Asset details. For Domain and Similar domain assets, the Asset details panel displays Typosquatting: Yes or No and, when applicable, Techniques detected.

  • Typosquatting assessment column. Add this column to the EASM Assets grid to see all detected techniques for each asset. A dash (-) means no technique was detected. The Domains default view includes this column.

  • Typosquatting assessment filter. Select one or more values: Misspelled domain, Alternative TLD, Typographic technique, or No typosquatting. Selecting a technique returns Domain and Similar domain assets with that technique. No typosquatting returns Domain and Similar domain assets with no detected technique.

Typosquatting Detection widget

The EASM Dashboard includes the Typosquatting Detection widget, which displays the number of domains detected for each technique.

Click a technique in the widget to open the EASM Assets page with the following filters applied:

  • Asset type: Domain, Similar domain

  • Typosquatting assessment: the selected technique

In this section: