Glossary.
Phishing, lookalike domains, brandjacking, and the rest of the vocabulary that shapes our work.
Phishing is a fraud technique where threat actors impersonate a trusted brand or individual to trick a target into handing over credentials, money, or sensitive information.
The attacker’s lure is usually delivered by email, SMS, or social media with a link to a fake login page or support form. The page is hosted on a lookalike domain or a compromised legitimate site, and harvests credentials the moment they are typed. Attackers then sell the credentials, use them to drain accounts, or pivot deeper into corporate environments.
Phishing remains the single most common initial-access vector in breach data year after year. The defenses that work are layered: domain monitoring to catch impersonating infrastructure before it is weaponized, takedowns to remove active phishing pages, and security awareness so the people who receive the lure can spot it.
DomainGuard’s Owl tier monitors for lookalike domains and known phishing infrastructure, and runs takedowns end to end when malicious intent is identified.
ClickFix is a social-engineering technique where a webpage silently copies a malicious command to the visitor’s clipboard, then walks them through pasting and running it in a terminal under a plausible cover story: completing a CAPTCHA, fixing a system error, or applying an update.
The defining trick is that the browser never downloads or executes anything. The victim carries the payload across the browser boundary with their own hands, so download scanning, macro blocking, and most web-based controls never fire. Common wrappers include the fake Cloudflare verification check and the fake Blue Screen of Death, and the pasted command typically fetches an infostealer, a loader, or a remote-access trojan.
Variants are named for where the victim pastes: the Run dialog in classic ClickFix, Windows Terminal or PowerShell in TerminalFix, and the File Explorer address bar in FileFix. MITRE ATT&CK tracks the whole family as T1204.004, Malicious Copy and Paste.
ClickFix lures run on the same infrastructure as credential phishing: freshly registered lookalike domains, compromised legitimate sites, and low-scrutiny TLDs. That makes them detectable and removable the same way, by catching the domains at registration time and filing takedowns against the hosts.
DomainGuard’s Owl tier monitors for the lookalike registrations ClickFix campaigns stage on and runs takedowns against active lure pages.
TerminalFix is a ClickFix variant that steers the victim into Windows Terminal or PowerShell, rather than the Run dialog, to paste and run an attacker’s command. Microsoft Threat Intelligence named it in August 2026 after tracking a campaign that ran fake Cloudflare verification overlays on compromised sites.
Routing the paste into a terminal matters for two reasons. A terminal runs long, multi-line scripts that the Run dialog cannot hold, and when the lure has the victim open it with Win+X then I, the command often runs with administrator rights. The campaign Microsoft documented used that foothold for a full intrusion: DLL sideloading, payloads hidden inside images, Active Directory reconnaissance, and a reverse tunnel back to the operators.
The defenses are the ClickFix ones plus two settings aimed at the terminal itself: Windows Terminal’s multi-line paste warning, and PowerShell restrictions such as Constrained Language Mode, AppLocker, or App Control for Business. Our fake Cloudflare verification entry documents the lure, every variant we have captured, and the indicators.
A lookalike domain is one registered to visually or semantically resemble a legitimate brand domain, with the intent to deceive customers, employees, or partners.
Common patterns include character substitution (acme.com to rn for m to acrne.com), punycode and IDN homoglyph variants (Cyrillic letters that render identically to Latin ones), additional words attached to the brand (acme-support.com, acme-helpdesk.org), or alternative top-level domains (acme.help, acme.jobs). Attackers also register domains based on common typing mistakes, known as typo squatting: swapping adjacent keys, doubling letters, or dropping characters.
Lookalike domains usually appear before a phishing campaign goes live, and the lead time is the defender’s window. Detecting registrations early lets you take down the infrastructure or block it at the corporate gateway before attackers turn it on. The lookalike domains entry in our threat catalog covers the registration patterns, the staging window, and the defenses in depth.
DomainGuard runs continuous lookalike-domain monitoring as part of the Owl tier, ingesting public domain data sources and proprietary feeds to surface impersonating registrations the day they happen.
A homoglyph is a character that looks identical or near-identical to another character despite being a different code point.
The classic examples are zero versus capital O, lowercase l versus uppercase I versus the digit 1, or Cyrillic а versus Latin a. In domain abuse, attackers exploit homoglyphs to register domains that read as the legitimate brand to a human eye but resolve to attacker-controlled infrastructure. A lowercase Cyrillic а in pаypal.com is invisible to the reader and indistinguishable in most fonts.
Detection requires unicode-aware comparison: encoding domain names as punycode (the xn-- form) reveals the underlying code points, and visual-similarity scoring at registration time catches near-misses that simple string equality misses.
Homoglyph attacks predate the IDN era but became dramatically easier when registries opened up internationalized domain names. Today most modern browsers display the punycode form of suspicious mixed-script domains as a defense, but users still encounter them in email and SMS where the rendering is less defensive.
DomainGuard’s lookalike-domain monitoring includes homoglyph and visual-similarity scoring across registered domains.
Brandjacking is the unauthorized use of a brand’s identity, content, or assets to deceive customers or extract value.
It overlaps with phishing and lookalike-domain abuse but extends further: fake mobile applications, copycat customer support handles on social media, sponsored search ads pointing at fraudulent support pages, malicious browser extensions claiming to be official, and dark-web mentions where stolen brand assets are bought and sold.
The damage from brandjacking is rarely concentrated in one venue. A typical campaign might include a lookalike domain hosting credential harvesting, a copycat Twitter or Telegram support handle handling the conversation, and a sponsored search ad driving traffic. Defending one venue without the others leaves the customer experience compromised and the brand’s reputation eroded.
Brand monitoring exists to catch the full picture: identity surfaces beyond the corporate domain, where attackers actually meet customers. Good brand monitoring tracks app stores, social media, search ads, dark-web forums, and key-employee accounts as a single program.
DomainGuard’s Shield tier monitors the brand and identity surface across all of those venues.
Prompt poaching is the theft of AI chat conversations by malicious browser extensions. An extension allowed to read the pages you visit scrapes the chatbot window as you use it, capturing your prompts, the model’s responses, and often session tokens, then sends them to its operators.
The campaigns behind the term disguise their extensions as AI productivity sidebars and have passed 900,000 installs, some carrying store badges that signal trust. The loot is valuable because of what people paste into chatbots: source code, internal plans, customer data, and credentials.
The defense is a deny-by-default extension policy on corporate browsers, plus keeping secrets out of prompts. The malicious AI Chrome extensions entry lists the known extension IDs and C2 domains.
An attack surface is the set of all externally accessible systems, services, and data an attacker could try to compromise.
For most organizations, the external attack surface is larger than the security team realizes. It includes the obvious (production web applications, mail servers, marketing sites) but also the less obvious (forgotten subdomains from a long-finished project, an inherited environment from an acquisition, a development server someone left exposed, an outdated API version still answering on a load balancer). Anything an attacker can reach over the public internet is part of the surface.
Attack-surface management means three things: discovery (finding what’s out there), inventory (knowing what’s yours and what runs on it), and monitoring (catching changes and exposures the day they appear). The first two are usually a one-time-but-recurring effort. The third is continuous.
Because attack surfaces grow on their own, the defensive question is not whether your surface is bounded, but whether you know about every change as it happens. External attack-surface monitoring answers that.
DomainGuard’s Guardian tier delivers attack-surface monitoring with continuous discovery, inventory, and alerting on exposed services and configuration changes.
Domain shadowing is the abuse of a legitimate domain’s DNS to create subdomains that point at attacker infrastructure. The attacker gets into the owner’s registrar or DNS account, usually with stolen credentials, and quietly adds records such as login.example.com or random-looking hostnames, leaving the main site untouched.
The shadowed subdomains inherit the parent domain’s age and reputation, so they slip past filters that distrust newly registered domains. Because few owners review their DNS zones, the records can serve phishing or malware for months before anyone notices.
Defenses start at the account: multi-factor authentication and registrar locks on every domain account, and an alert on any DNS change. Continuous discovery of your own subdomains then catches hosts nobody on your team created.
DomainGuard’s Guardian tier continuously discovers subdomains and alerts on new hosts and configuration changes across your external attack surface.
Vishing (voice phishing) is a fraud technique where threat actors use phone calls or voice messages to impersonate a trusted brand or person and trick the target into handing over credentials, money, or sensitive information.
The lure is typically delivered as a phone call from an apparent corporate number, a voicemail asking for a callback, or an in-progress video call where the attacker impersonates an executive or recruiter. Spoofed caller ID, free VoIP accounts, and now AI-generated voice make vishing much harder to spot than it used to be: an attacker can reproduce a CEO’s voice from a few seconds of public-speaking audio and place a convincing urgent-wire-transfer call to the finance team.
Automated voicemails can carry a link, too. In the FedEx voicemail campaign we documented, the recording reads out a lookalike domain, and the iPhone voicemail transcript turns it into a tappable link to a card-harvesting page.
Defenses are partly procedural (out-of-band verification of any sensitive request, no matter how authentic the voice sounds) and partly visibility-based (monitoring for impersonating phone numbers, lookalike call-center domains, and accounts on free conferencing platforms).
DomainGuard has documented several real-world vishing and video-call impersonation campaigns; the Shield tier monitors for the supporting infrastructure (lookalike domains, fraudulent video conferencing accounts, dark-web mentions of leaked credentials) that vishing campaigns rely on.
See Shield → · Read: Video call platforms as scammer tools →
Business Email Compromise (BEC) is a fraud technique where threat actors impersonate an executive, vendor, or trusted partner over email to trick a target into wiring money, changing payment instructions, or releasing sensitive data.
BEC differs from generic phishing in that it is highly targeted, often patient, and rarely involves malware. The attacker spends time observing email patterns, learns the typical language used between the impersonated party and the target, and times the lure to coincide with a real transaction or organizational event. The send usually arrives from a lookalike domain (acme-finance.com instead of acme.com), a free webmail account registered to resemble the company ([email protected]), a compromised legitimate mailbox, or a display-name spoof in a thread the target already trusts.
BEC drives one of the largest single categories of cyber-loss reported to the FBI’s Internet Crime Complaint Center year after year, with average per-incident losses in the hundreds of thousands of dollars.
Defenses are layered: domain monitoring for impersonating sender domains, DMARC, DKIM, and SPF enforcement on your own mail, payment workflows that require out-of-band verification of any change to payee details, and security awareness so the recipient pauses on a request that feels off.
DomainGuard’s Owl tier monitors for the lookalike domains BEC campaigns rely on, with takedowns when impersonating infrastructure goes live.
Domain monitoring is the continuous scanning of public domain data, new registrations, DNS records, and certificate transparency logs, to detect domains that imitate or threaten a brand before they are used in an attack.
A monitoring pipeline watches for three things. New registrations of lookalike domains: typosquats, homoglyphs, combosquats, and other variations on the protected name. Weaponization signals on domains that already exist: a parked lookalike suddenly growing MX records, a TLS certificate, or a login page. And the health of your own portfolio: expirations, transfers, and DNS changes nobody authorized.
The point of all three is lead time. Most phishing domains are registered days or weeks before the campaign that uses them goes live, and that staging window is when a defender can act cheaply: report the registration, prepare the takedown evidence, or block the domain at the gateway before the first victim ever sees it.
A monitoring service differs from a one-time scan in cadence and response. Sources refresh continuously rather than on demand, raw hits are triaged into alerts a security team can act on, and confirmed threats flow straight into a takedown process instead of a spreadsheet.
DomainGuard’s Owl tier runs domain monitoring as a managed service: continuous lookalike detection across public and proprietary feeds, certificate tracking, and analyst-driven takedowns when a threat turns active.
Threat intelligence is evidence-based knowledge about adversaries and their techniques, collected and published so defenders can make better decisions: what to detect, what to block, and what to tell users.
It comes in layers. Strategic intelligence covers who is targeting an industry and why. Operational and tactical intelligence describe how attacks work, often mapped to a shared framework such as MITRE ATT&CK. Technical intelligence is the machine-readable layer: indicators of compromise such as domains, file hashes, and extension IDs that security tools can match automatically.
Good threat intelligence is specific, sourced, and actionable. It says what was observed, when, and what a defender should do about it, and it is shared in a form that cannot be reused as an attack kit: indicators defanged, payloads withheld.
DomainGuard publishes defensive research on the phishing and impersonation techniques we see in real incidents, and delivers detection data machine-readably through the API Integration tier.
An indicator of compromise (IoC) is an observable artifact that points to malicious activity: a domain or IP address, a file hash, a URL path, a registry key, or a browser extension ID.
Defenders use IoCs to search logs for past contact, block known infrastructure going forward, and confirm whether an incident touched their environment. Their weakness is shelf life. Attackers rotate domains and rebuild files cheaply, so an IoC is most valuable in the days after it is published, while detections built on behavior (what a technique does, not which file it uses) age better.
Published IoCs are usually defanged so nobody clicks or resolves them by accident. Every entry in our Threat Intel catalog lists its indicators in plain, searchable text.
Defanging rewrites a malicious URL, domain, or IP address so it cannot be clicked, auto-linked, or resolved by accident, while staying readable to a person. The common conventions replace http with hxxp and wrap dots in brackets, so evil.example.com becomes evil[.]example[.]com.
Security teams defang indicators in reports, tickets, and chat so nobody lands on live attacker infrastructure by mistake, and so link previews never fetch it. Refanging, reversing the change, is a deliberate step taken only inside tools built to handle live indicators.
Every indicator in DomainGuard’s Threat Intel entries is defanged.
Domain Guard is the name several domain registrars use for a paid add-on that hardens a domain you already own against hijacking. Depending on the registrar, it bundles a transfer lock against unauthorized moves, DNSSEC to protect DNS responses from tampering, an extra authentication step on domain changes, or WHOIS privacy. IONOS, STRATO, and Crazy Domains all sell an add-on under this name.
Do you need it? If the domain carries revenue or reputation, it is cheap insurance: a transfer lock plus a second confirmation on domain changes closes off the most common hijacking paths. Just be clear about what it covers. It protects the registration itself, not your website, your email, or your visitors.
It is also a different thing from DomainGuard, the company behind this site. A registrar’s Domain Guard hardens the one domain you own. DomainGuard (guardyourdomain.com) monitors the rest of the internet for lookalike domains, phishing, and brand impersonation registered by other people, and takes the offending sites down. The two are complementary: one locks your front door, the other watches the street. The FAQ covers the distinction in more detail.
Talk to a Practitioner.
If you are scoping monitoring or an engagement and want to walk through one of these surfaces with the team, send us a note.
Contact our team