Typosquatting in the browser

How it usually happens in the browser

• An employee mistypes a URL, clicks a lookalike link, or follows a search/ad result to a near-identical domain.
• The attacker hosts a clone of a login page, software download page, or support portal.
• Victims enter credentials, download “updates,” or submit payment details.
• The attacker uses stolen access for account takeover or financial fraud.

What traditional defenses miss

• New typosquat domains often have no reputation history; blocklists are reactive.
• Ads and SEO spam can push lookalike domains into prominent search positions.
• Users rarely notice subtle domain differences like swapped letters, extra hyphens, or different TLDs.

How isolation changes the game

• Isolation limits the blast radius of landing on an untrusted domain by keeping active content away from the endpoint.
• Policy can route newly registered or unknown domains into isolation automatically.
• Disposable sessions reduce follow-on persistence from malicious downloads and embedded scripts.

Operational checklist

• Maintain an allowlist for key business apps and identity portals; promote bookmark usage.
• Force unknown domains into isolation; add tighter restrictions for new domains and ad-clicks.
• Block downloads from untrusted domains by default.
• Monitor for lookalike domains of your brand and critical vendors; set up takedown workflows.
• Use password managers that verify domain matches before filling credentials.

FAQs.