Domain squatting is the practice of registering a domain name that matches or closely resembles a brand, person, or service in order to profit from confusion. In identity and security contexts, it is used for phishing, impersonation, credential theft, or traffic diversion, often by exploiting lookalike domains and DNS trust.
How Domain Squatting Works
Domain squatting exploits the gap between a name that looks legitimate and the entity that actually owns it. The tactic depends on visual similarity, trust in familiar brands, and the fact that many users will not inspect the full domain closely before clicking or entering credentials.
In practice, attackers often register lookalike domains that differ by a single character, a swapped letter, an added word, or a different top-level domain. Those variations are enough to create confusion, especially in email, login flows, and support impersonation scenarios where the target already expects to interact with the brand.
Why It Is Dangerous
Domain squatting becomes dangerous when the deceptive domain is used to capture credentials, deliver malware, redirect traffic, or impersonate a trusted service. It can also undermine mail security and brand trust by making malicious messages and login pages appear routine.
For security teams, the core problem is not only the registration itself but the trust transfer that follows. Users may enter passwords, one-time codes, API keys, or session details into a hostile site because the domain name appears credible enough to bypass quick visual checks.
Common Abuse Patterns
The most common abuse pattern is phishing, where the squatted domain hosts a fake login page or support portal. Another pattern is traffic diversion, where the domain is used to intercept mistyped URLs, harvest referral data, or stage a secondary attack chain after the victim reaches the site.
Squatted domains also support impersonation in email and messaging. Attackers can create sender addresses, reply-to domains, or branded landing pages that align closely with a trusted organisation, which makes the whole message harder to challenge at a glance.
How Organisations Reduce Exposure
Reducing exposure starts with domain inventory and brand monitoring. Organisations need to know which names they own, which variants matter most, and which registrations are likely to be abused for phishing, impersonation, or customer confusion.
Defensive controls usually combine registration monitoring, DNS and email hardening, takedown processes, and user education. This is also where broader control frameworks can help organisations map ownership and response expectations, including the CSA Cloud Controls Matrix, NIST SP 800-53 Rev 5 Security and Privacy Controls, and the NIST Cybersecurity Framework 2.0.
Risk and Threat Considerations
Domain squatting creates a standing trust risk because the attacker only needs one convincing registration to support many fraud attempts. The same lookalike domain can be reused for phishing, support impersonation, credential harvesting, and traffic diversion until it is detected and removed.
Failure mechanism: The attacker relies on human pattern recognition, brand familiarity, and weak scrutiny of the exact registered name. Once a user trusts the domain, the squatter can collect secrets, redirect the victim to a malicious flow, or pivot into account takeover.
Impact: The result can be credential theft, fraudulent sign-in, brand damage, customer harm, and downstream compromise of email, cloud, or internal systems that trust the stolen access.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
MITRE ATT&CK addresses the attack and risk surface, while CIS Controls v8, NIST SP 800-53 Rev 5 and NIST CSF 2.0 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| CIS Controls v8 | CIS-5 — Account Management | Domain squatting targets credentials and account access through impersonation. |
| Recommendation — Track and protect accounts that attackers may target through fake domains and phishing. | ||
| NIST SP 800-53 Rev 5 | IA-5 — Authenticator Management | Squatted domains are often used to capture passwords, tokens, and codes. |
| Recommendation — Protect authenticator lifecycle and revoke exposed credentials after suspected phishing. | ||
| NIST CSF 2.0 | PR.AA-05 — Managed Credentials and Access Tokens | Lookalike domains commonly harvest secrets used to authenticate users and services. |
| Recommendation — Limit where credentials can be entered and bind access to trusted sign-in paths. | ||
| MITRE ATT&CK | T1583 — Acquire Infrastructure | Registering deceptive domains is a common attacker infrastructure acquisition step. |
| Recommendation — Hunt for malicious domain registrations as part of infrastructure acquisition detection. | ||
Practitioner Guidance
Why practitioners should care: Domain squatting is not only an external-brand issue; it is an identity and access problem because the false domain is often used to steal the very credentials and sessions that protect real services. Teams should treat high-value domain variants as part of the attack surface, not as a marketing-only concern.
What to watch for: Monitor for newly registered lookalike domains, suspicious DNS records, and login pages that imitate internal or customer-facing portals. The strongest response comes from combining takedown readiness with user-facing checks that make exact-domain verification easier at the moment of login.
Related resources from NHI Mgmt Group
- How should security teams monitor for domain squatting and typosquatting at scale?
- Why do cross-domain attacks create more risk than single-domain intrusions?
- How should security teams build a cross-domain identity programme?
- How should security teams harden domain controllers that still need legacy authentication support?
Deepen Your Knowledge
Free weekly newsletter
Subscribe to the NHI & AI Identity Journal
The latest on NHI and Agentic AI security – articles, research, breaches, news and events every week.
Bonus 33% off our NHI Course when you subscribe.
Reviewed and updated by the NHIMG editorial team on October 23, 2026.
NHI Mgmt Group — the #1 independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org