Threats Tagged 'dns analysis'

Lookalike domain attacks exploit human cognitive biases by registering domain names that closely resemble legitimate services. These attacks use techniques such as homographs, typosquatting, domain embedding, and keyword association to deceive users and bypass security controls. The domain names themselves reveal attacker intent and can be detected through DNS infrastructure analysis before malicious activity occurs. Attackers often keep these domains dormant between campaigns to avoid takedown. Detection is challenging due to similarities with legitimate domains, requiring careful differentiation between genuine and impostor domains. This threat is categorized as medium severity due to its reliance on social engineering rather than technical vulnerabilities.