What does the ARO: Suspected Typosquat Domain Detected mean?

Introduction

Typosquatting or URL hacking takes advantage of a users attention to detail and attempts to steal login credentials through websites commonly misspelled or makes use of some visual trickery. 

One of the most famous examples was the registration of Goggle.com which was operating as a phishing site around 2006 and more recently, researchers discovered the domain twiter.com.. 

Fonts can also play a significant role where the use of l I & O 0 could appear to be similar in appearance: G00GLE.COM is not the same as GOOGLE.COM 

Threat actors can also take advantage of domains that no one has registered yet. Most users are familiar with .com, .net, .org but there are around 1500 other possibilities and it could be expensive for an organization to register every single one.

https://en.wikipedia.org/wiki/List_of_Internet_top-level_domains

What can you do? 

The primary concern with typosquat domains is the potential for phishing attempts targeting your users, or possibly clients that authenticate to services hosted on your domain. For this reason, we recommend that you block these domains within your organization. However it is more difficult to prevent accidental access to these domains by clients or other external access. 

• https://o365reports.com/2020/03/25/how-to-add-external-email-warning-message/
• https://techcommunity.microsoft.com/blog/exchange/native-external-sender-callouts-on-email-in-outlook/2250098

It is important to note that the registration of a typosquat domain does not necessarily indicate that a phishing attempt or other malicious activity is likely, and may not warrant additional action. For example, in some cases organizations may attempt to register a large number of unregistered domains as a form of investment, in hopes that they may be able to sell some domains at a profit in the future. This is especially likely in cases where a domain may be particularly meaningful, such as a common word or name. 

If you do wish to take action against these domains, there are a few options: 

First, the hosting organization typically lists an abuse report contact, usually an email address, for domains registered through the Internet Corporation for Assigned Names and Numbers (ICANN). These are typically accessible via the ICANN Registration data lookup tool.

Second, it is possible to submit a complaint directly to ICANN via their Uniform Domain-Name Dispute-Resolution Policy. This form of complaint typically would require a claim of copyright infringement, evidence of associated malicious activity (such as phishing attempts), or similar substantiation.

Lastly report it to the Google Safe Browsing service. https://safebrowsing.google.com