Technique Email Origin

Look-Alike Sender Domain

The sender address uses a domain, the part after the @, made to resemble a trusted one through a misspelling, added words, or a misleading prefix. It can make the sender look right at a glance.

Also known as

Aliases: typosquatting

cousin domain

combosquatting

misspelled domain

SoundSquatting

doppelganger domain
Broader terms: Acquire Infrastructure: Domains

Mapped to

MITRE ATT&CK®

T1583.001Domains

Connected in PH!SH

Themes

TH0001Media Service Impersonation TH0004Travel Service Impersonation TH0006Logistics Service Impersonation TH0008Social Media Service Impersonation TH0025Website and Domain Hosting Service Impersonation TH0027Telecommunications Service Impersonation TH0028Benefits Service Impersonation TH0030Utility Service Impersonation TH0031Apple Impersonation TH0032Google Impersonation TH0044Government Entity Impersonation TH0062Retail and Marketplace Service Impersonation TH0063Educational Institution Impersonation TH0064Electronic Signature Service Impersonation TH0065Job Portal Impersonation TH0070Insurance Service Impersonation