domain.typosquat
The domain looks like a one- or two-character typo of a well-known brand domain.
Also emitted by /v1/links (check link.destination_reputation, evaluated against the redirect chain’s final destination).
What it looks at#
The same restricted edit-distance algorithm as
email.typo_domain, run against a curated list of about
32 well-known brand domains spanning payments and finance (paypal.com, stripe.com,
banks, card networks), major platforms (google.com, facebook.com, linkedin.com),
retail (amazon.com, ebay.com), big tech and infrastructure (apple.com,
microsoft.com, github.com), and delivery/logistics (fedex.com, ups.com). Same tight
bounds as the email version: an absolute cap of 2 edits and a relative cap of 20% of the
target’s length.
Why it matters#
A domain one edit away from paypal.com or amazon.com is a classic impersonation
pattern, used in phishing and fake-checkout scams — the near-identical string is meant to
be misread at a glance.
What to do#
Medium severity — treat as worth a second look, especially in combination with a young registration age (domain.newly_registered) or a parked/no-content destination.