A company's website is www. Company. com Attackers purchased the domain wwww. company.com Which of the following types of attacks describes this…

Typosquatting is the act of registering domain names that are slight misspellings or

variations of legitimate, often popular, domain names. The goal is to capture traffic from

users who mistype the intended URL. The scenario – "Attackers purchased the domain

www. company.com" (intended as a variant of a legitimate "www.Company.com") –

directly aligns with this definition. This technique relies on user typographical errors to

lead them to a malicious site.

B. Brand Impersonation: While typosquatting is often a method used for brand

impersonation (i.e., making the malicious site look like the legitimate brand's site), the

question specifically describes the act of acquiring the deceptive domain name.

Typosquatting is the more precise term for this specific action, whereas brand

impersonation is a broader outcome or goal.

C. On-path: An on-path attack (formerly man-in-the-middle) involves an attacker

intercepting and potentially altering communications between two parties. It does not

primarily involve the purchase of misleading domain names.

D. Watering-hole: A watering-hole attack involves compromising a legitimate

website that is frequently visited by the intended targets. This is different from

registering a new, similarly named domain to lure victims.

Typosquatting:

NIST Computer Security Resource Center - Glossary: "Typosquatting: A form of

cybersquatting that relies on mistakes such as typographical errors made by Internet

users when inputting a website address into a web browser. (Also known as URL

hijacking.)"

URL: https://csrc.nist.gov/glossary/term/typosquatting

Cybersecurity and Infrastructure Security Agency (CISA): "Typosquatting, also called

URL hijacking, is a common type of cybersquatting that targets users who incorrectly

type a URL into their web browser. Attackers register domains with names that are

common misspellings of legitimate, frequently accessed domains."

URL: https://www.cisa.gov/news-events/news/understanding-typosquatting (Page:

Understanding Typosquatting)

Brand Impersonation (as a broader concept distinct from the specific act):

While not a direct definition of the act of domain purchase, Microsoft describes related

impersonation tactics: "Impersonation is when attackers try to make a message look like

it came from a trusted company or person." Typosquatted domains are often used in

such impersonation attempts.

Source: Microsoft Learn - "Anti-phishing policies in Microsoft 365" (Section on

impersonation settings)

URL: https://learn.microsoft.com/en-us/microsoft-365/security/office-365security/anti-phishing-policies-about?view=o365-worldwide

On-path Attack:

NIST Computer Security Resource Center - Glossary: "On-Path Attack: An attack

where an adversary positions himself between the user and the system so that he can

intercept and alter data. (Formerly known as man-in-the-middle attack.)"

URL: https://csrc.nist.gov/glossary/term/on_path_attack

Watering-hole Attack:

NIST Computer Security Resource Center - Glossary: "Watering Hole Attack: A

specialized type of spear phishing attack where the attacker identifies a group of

targets, determines a website that they frequent, and then compromises that website to

install malware. When a target in the group visits the compromised website, they

become infected."

URL: https://csrc.nist.gov/glossary/term/watering_hole_attack