Skip to content

Beareye · EASM

Typosquatting detection: identify brand impersonation before it becomes an attack

By Updated on

Typosquatting means registering a domain name very close to yours, one letter apart, to deceive your customers or employees. Beareye continuously monitors these variants, detects the domains that imitate your brand, ranks them by threat level, and alerts you before they are used for phishing or fraud.

Start monitoring my brand
  • Continuous monitoring
  • Scored by threat level
  • Developed in France

A lookalike domain is enough to deceive

One changed character, a different extension or an added word is all it takes for a domain to look like yours. A customer in a hurry, a distracted employee, and the impersonation works: a fake payment site, a fraudulent email, credential harvesting. These domains can be registered in minutes and often go unnoticed.

Which typosquatting variants does Beareye detect?

Beareye monitors several families of impersonation: typos of your name, alternative extensions, added words such as “secure” or “payment”, substitutions with visually similar characters, and combinations with the names of your services or executives.

  • Typos

    A letter swapped, dropped or doubled: company.com becomes comapny.com.

  • Alternative extensions

    The same name under another extension: company.com becomes company.co.

  • Added words

    A reassuring word attached to your name: company-payments.com.

  • Visually similar characters

    A character replaced by a lookalike: “rn” instead of “m”, a zero instead of an “o”.

  • Combinations with your services

    Your name combined with a service or an executive: extranet-company.com.

From detection to action priority

  1. Generate

    Beareye produces the plausible variants of your brand.

  2. Detect

    It spots those that are actually registered and active.

  3. Score

    Each domain is ranked by threat level, with the help of AI.

  4. Alert

    The most threatening domains trigger a priority alert.

From detection to action priority, Beareye works in four steps: generate, detect, score, alert.

What should you do about a domain impersonating your brand?

Each detected domain is qualified: a simple defensive registration, advertising parking, or an active phishing site. Depending on the case, Beareye guides the response: placing it under watch, reporting it, or building a file with a view to taking action. Each case is raised in the Command Center with its priority level.

Triage of lookalike domains in Beareye, anonymised data

How many domains imitate a brand?

A first search run with Beareye identifies a median of 144 lookalike domains per brand, 9 of which are rated dangerous after analysis. The rating combines mail configuration, imitation of a login page and the recent appearance of a certificate: no single signal on its own proves malicious use. Detecting them early leaves time to request their suspension.

Aggregated, anonymised data from Beareye’s typosquatting module: brands of the 20 organisations monitored over two years. Medians calculated on the registered, deduplicated domains found in the first search.

Sources and references

  1. WIPO, domain name dispute resolution, World Intellectual Property Organization
  2. Cybermalveillance.gouv.fr (phishing and impersonation), the French national victim assistance service (in French)

Sources consulted on . Report an error: contact+site@bearops.fr

Frequently asked questions

What is typosquatting?

Typosquatting is the registration of a domain name that resembles a brand’s, differing by a typo or a variation. It is used to deceive internet users for phishing, fraud or credential harvesting.

How does Beareye detect impersonating domains?

Beareye generates the plausible variants of your brand, identifies those that are actually registered and active, then ranks them by threat level with the help of AI. The most threatening domains trigger a priority alert.

Does Beareye get fraudulent domains taken down?

Beareye detects, qualifies and prioritises impersonating domains, and guides the response. The takedown procedure, for example a complaint before the WIPO Arbitration and Mediation Center, or legal action, is a matter for your organisation and its advisers.

Is typosquatting part of the EASM module?

Yes. Typosquatting detection is a capability of Beareye’s EASM module , alongside the inventory of exposed assets and the assessment of email configuration. It is activated in the same environment.

Find out who is imitating your brand

The Beareye Cyberscore reveals the domains impersonating your brand, along with the rest of your external exposure , in 30 minutes.

Start monitoring my brand