Calvin Klein is one of the world’s leading global fashion lifestyle brands, with a history of bold, non-conformist advertising. The company also has a number of registered websites, including calvinklein.com and calvinklein.us. All of these bring users to well-known fashion houses.

But Calvin Klein Inc. cried foul – and filed a complaint with the World Intellectual Property Organization – when a mainland China-based organization set up its own calvinklein site. The cyber criminal replaced the “.com” top-level domain name with an “ai.” We advise against navigating there, since the disputed site may contain malicious links or other threats.

This is cybersquatting — and it is on the rise, affecting businesses and other organizations of all sizes. But companies that work with a trained cybersecurity provider can defend themselves against this kind of threat.

Cybersquatting occurs when a bad actor buys or registers a “look-alike” domain name, identical or similar to an existing domain. The intention is to profit off a recognizable trademark, company name or personal name, perpetrating various forms of cyber crime. Cybersquatting can also have wide-ranging negative effects on legitimate businesses since it can result in fraud, data breaches and reputational damage.

“Look-alike” domains (site names), closely resemble legitimate websites. For example, a look-alike domain might use the letter “o” instead of zero (0), add an extra letter, or use a different top-level domain, such as “.net” instead of “.com.”

The primary goal behind these deceptive domains is to exploit the trust users place in well-known brands and services. By creating a nearly identical domain, attackers can trick users into visiting malicious sites, which can lead to various cybersecurity threats.

• Typographical variants: These involve slight modifications to the domain name. For example, replacing “l” (lowercase L) with “I” (uppercase version of “i”) or using similar-looking characters from different alphabets (like Cyrillic letters) can create look-alike domains that are visually deceptive but technically different.
• Domain name homoglyphs: This technique uses characters that look similar but are technically different. For example, the letter “o” from the Cyrillic alphabet might replace the letter “o” from the Latin alphabet. The two look identical but are actually different characters.
• Adding prefixes or suffixes: Attackers may add extra words or letters to the domain to create a look-alike version. A bad actor might call their virus-laden site “Secure-payments-online.com” instead of “Secure-payments.com.”
• Different top-level domains: Changing the top-level domain can also be effective. A site named “example.com” could be mimicked by “example.net” or “example.org.” This exploits the fact that many users might not pay attention to the TLD.

A number of cybersecurity risks are associated with look-alike domains. One of the most common is phishing. Attackers may create a domain that resembles a legitimate financial institution, social media platform or email provider. The goal is to trick users into entering sensitive information, like usernames, passwords or credit card details. Once this information is entered, it can be used for identity theft or unauthorized financial and other asset-transfer transactions.

Look-alike domains can also host malware or malicious software. Users who innocently visit these domains may download malware disguised as legitimate software or updates. This malware can then compromise their system, steal data, or cause other forms of damage.

Creating a domain that looks like a legitimate login page can let attackers collect login credentials from unsuspecting users. This is particularly dangerous when combined with social engineering techniques that create a sense of urgency or need for immediate action.

Your organization may suffer when a look-alike domain damages your valuable brand reputation. Customers who fall victim to phishing or malware attacks from a look-alike domain may associate the negative experience with the legitimate brand, leading to a loss of trust and customer loyalty.

Some solutions

Educating users about the dangers of look-alike domains and training them to recognize suspicious URLs is a critical first step. Awareness campaigns should emphasize checking the domain carefully before entering any sensitive information.

More Tech Intelligence

• The importance of data backups in protecting your vital information
• A recent national data breach highlights cybersecurity gaps
• In cybersecurity, hope for the best but plan for a disaster
• Why Security Operations Centers are essential for thwarting cyber attacks

Your organization can deploy various security technologies to detect and block access to known malicious look-alike domains. Tools such as multifactor authentication, domain-based blacklists, anti-phishing filters and web security gateways can help prevent users from visiting harmful sites.

Regularly monitoring domain registrations that are similar to your own can help identify potential threats early. This involves keeping an eye on newly registered domains that closely resemble your brand’s domain.

In some cases, rightful owners may take legal action. Trademark owners and brand managers can work with legal professionals to take down infringing domains and hold perpetrators accountable.

Securing multiple domain variations and TLDs related to your brand can prevent attackers from easily creating look-alike domains. You can also register common misspellings, or similar-sounding names to reduce the chances of being exploited.

Look-alike domains represent a significant cybersecurity threat, leveraging the subtleties of domain names to deceive users and carry out malicious activities. You can work with a trusted cybersecurity partner to understand how these domains are created and the risks they pose. A combination of user education, technological defenses and vigilant monitoring can mitigate the impact of look-alike domains, ensuring a safer online environment for everyone.

Carl Mazzanti is president of eMazzanti Technologies in Hoboken, providing IT consulting and cyber securityservices for businesses ranging from home offices to multinational corporations.