Several of the most effective impersonation techniques involve no lookalike domain at all, which means no permutation monitoring will ever find them.
The subdomain that reads as yours
https://northwind.example.com.secure-login.net/account
^^^^^^^^^^^^^^^^^^^^^^^^^^ ^^^^^^^^^^^^^^^^
looks like the brand the actual domain
The registrable domain is secure-login.net.
Everything to its left is a subdomain the attacker
created, for free, in seconds.- No registration of anything resembling your brand.
- Nothing for permutation monitoring to match on.
- Unlimited variants at zero marginal cost.
- On a narrow mobile screen, the beginning of the URL is what is visible.
The only defence that works is the reader knowing that the registrable domain is the part immediately left of the TLD, and nothing else. It is the single most useful thing to teach non-technical staff.
Path and parameter deception
https://cheap-hosting.example/northwind.example.com/login https://cdn-files.example/?redirect=northwind.example.com https://docs.google.example/view?brand=northwind
The brand appears in the URL and controls nothing. Anything after the domain is chosen freely by whoever operates the site.
The rest of the family
| Technique | Requires | Findable by domain monitoring? |
|---|---|---|
| Subdomain-shaped | Any domain the attacker controls | No |
| Path-based | Any domain at all | No |
| Display-name spoofing | A free mail account | No |
| Compromised legitimate site | A vulnerability in somebody else’s site | No |
| Lookalike domain | A registration | Yes — this is the only one |
Four of five are invisible to the programme you are building
That is not an argument against domain monitoring, which addresses the one technique that leaves a registration trail. It is an argument for saying so when reporting coverage, because a programme presented as catching brand impersonation will be judged against an incident it was never able to see.