Typosquatting Awareness

What Is Typosquatting Awareness?

Typosquatting catches people who know exactly where they are going, because the mistake is in the typing rather than the judgement. You type an HR portal address from memory, miss a character, and land on a copy that reproduces the logo and the colours. You sign in and get a generic connection error, which is what a credential harvester shows once it has what it came for. You will compare the domains character by character, learn the six registration tricks behind lookalikes, and file the report.

What You'll Learn in Typosquatting Awareness

• Identify a typosquatted domain by reading the address character by character rather than recognizing its shape
• Explain the common registration techniques behind lookalike domains, including character swaps, omissions and additions
• Recognize a generic error immediately after a login as a sign that credentials were harvested rather than a site fault
• Use bookmarks and saved links for frequently visited internal systems instead of typing addresses from memory
• Report a credential entry on a lookalike domain quickly enough for the security team to force a reset before the account is used

Typosquatting Awareness — Training Steps

1. Welcome to Cascadia Insurance Partners

   Today you need to access the HR portal to update your direct deposit information for an upcoming payroll change. You've done this many times before - it's a routine task.

2. A Quick Task Before Lunch

   It's 11:45 AM and Alice wants to finish this quick task before her lunch break. She opens her browser and quickly types the HR portal URL from memory. In her hurry, she types cascadiansurance.com instead of cascadiainsurance.com - missing the 'i' in 'insurance'.

3. The Fake Portal

   The browser loads a page that looks exactly like the company's HR portal. The logo, colors, and layout are all familiar. Alice doesn't notice anything wrong.

4. Something Went Wrong

   After entering her credentials, the page displays a generic error: 'Unable to connect to server. Please try again later.' Alice is annoyed but assumes the HR system is having technical issues. She decides to try again later and opens her email to work on other tasks.

5. The Security Alert

   Alice receives an urgent email from IT Security.

6. Realizing the Mistake

   Alice's heart sinks. She remembers trying to access the HR portal earlier and getting that error message. Could she have entered her credentials on a fake site? She needs to call IT Security to report what happened and find out how her credentials were stolen.

7. Analyzing the Attack

   IT Security has confirmed that Alice fell victim to a typosquatting attack . Let's examine the fake site she visited to understand how it happened. Notice the subtle differences that Alice missed in her hurry.

8. The Typosquatted Domain

   The most critical red flag was in the domain itself.

9. How Typosquatting Works

   Typosquatting is a form of cybersquatting that exploits typing mistakes. Attackers: 1. Register lookalike domains - They identify popular websites and register domains with common typos cascadia n surance.com (missing 'i') cascadiainsurnace.com (letters swapped) cascadiainsurance.net (wrong TLD) cascadiainsurrance.com (extra letter) 2. Clone the legitimate site - They copy the visual design pixel-for-pixel 3. Harvest credentials - Users who mistype the URL unknowingly enter credentials on the fake site

10. Accessing the Security Portal

    Alice needs to file a formal incident report documenting what happened. She navigates to the Security Portal - this time carefully verifying the URL before entering credentials.