Doppelganger domain

A doppelganger domain is a domain spelled identical to a legitimate fully qualified domain name (FQDN) but missing the dot between host/subdomain and domain, to be used for malicious purposes.

Overview

Typosquatting's traditional attack vector is through the web to distribute malware or harvest credentials. Other vectors such as email and remote access services such as SSH, RDP, and VPN also can be leveraged. In a whitepaper by Godai Group on doppelganger domains, they demonstrated that numerous emails can be harvested without anyone noticing.[1]

Example

If someone's email address is "[email protected]", the doppelganger domain would be "financesomecompany.example". Hence, if someone is trying to send an email to that user and they forget the dot after "finance" ([email protected]), it would go to the doppelganger domain instead of the legitimate user.

See also

References

  1. ^ "Doppelganger Domain whitepaper". Godai Group. 6 Sep 2011.

External links



This page was last updated at 2019-11-11 02:56 UTC. Update now. View original page.

All our content comes from Wikipedia and under the Creative Commons Attribution-ShareAlike License.


Top

If mathematical, chemical, physical and other formulas are not displayed correctly on this page, please useFirefox or Safari