Evicting Typosquatters: How CrowdStrike Protects Against Domain Impersonations

Threat actors constantly unleash phishing attacks that use emails or text messages containing domains or URLs, all designed to impersonate well-known companies and trick users into visiting fake websites and entering their logon or other confidential information. Unfortunately, many users fall prey to such attacks, unknowingly giving threat actors access to their work or personal accounts. The results are stark — according to Cisco’s 2021 Cybersecurity Threat Trends report, about 90% of data breaches result from phishing.

Domain impersonation, aka “typosquatting” — wherein a threat actor either registers a website or URL designed to impersonate a company or brand, or takes over a legitimate website or URL — has long been a key part of phishing attacks, but its implementation has evolved. Originally used to capture unwary users who mistyped the URL of a website they wanted to visit, domain impersonation is now used to drive business email compromise and SMS-based phishing attacks, and even to conceal command-and-control (C2) servers during malware attacks.

The uses of domain impersonation have evolved, including the availability of generic top-level domains (gTLDs) and the ability to use foreign character sets with visually similar characters when constructing domains for launching attacks — commonly known as punycode attacks. Identifying malicious infrastructure before it can be used in an attack is crucial for protecting targeted organizations and their customers.

Falcon Intelligence Recon Now Detects Domain Impersonations

 

CrowdStrike Falcon Intelligence Recon^™ can now detect instances of typosquatting. This new feature enables security teams and threat intel analysts to create monitoring rules that analyze domains for key terms associated with an organization or brand, and to alert when malicious infrastructure has been created or updated potentially for use in an impersonation attack. A new “loosely” match operator looks for variations of a single word, such as character additions, subtractions and substitutions, including the use of characters in other languages. Monitoring rules can also look for matches on words that are part of longer domains and TLDs.