{"id":6676,"date":"2021-07-22T13:27:59","date_gmt":"2021-07-22T20:27:59","guid":{"rendered":"https:\/\/blogs.infoblox.com\/?p=6676"},"modified":"2021-07-22T13:27:59","modified_gmt":"2021-07-22T20:27:59","slug":"bloxone-threat-defense-protects-against-attacks-that-leverage-lookalike-domains","status":"publish","type":"post","link":"https:\/\/www.infoblox.com\/blog\/security\/bloxone-threat-defense-protects-against-attacks-that-leverage-lookalike-domains\/","title":{"rendered":"BloxOne\u00ae Threat Defense Protects Against Attacks that Leverage Lookalike Domains"},"content":{"rendered":"<h2><span style=\"font-weight: 400;\">Introduction<\/span><\/h2>\n<p><span style=\"font-weight: 400;\">What do the URLs InfobIox(.)com and lnfoblox(.)com have in common? These are both URLs that are intended to look like the domain Infoblox(.)com. This is an example of a Lookalike domain, or LADs which are used in a variety of cyber attacks. By replacing the i with a lowercase l we can circumvent a user&#8217;s intended action of going to the correct URL. Are the previously mentioned URLs always malicious? No, but in a world where cyber attacks are frequent and come from many vectors, security teams should always do their best to cover all of their bases.\u00a0<\/span><\/p>\n<p><span style=\"font-weight: 400;\">Lookalike domains come in a wide variety of shapes and sizes. Like in the example earlier, they may attempt to confuse the user by replacing a letter or number with alternative text that looks similar. Or, they may change the top level domain to something different (Example: infoblox(.)badactor(.)org). Additionally lookalike domains may use an Internationalized Domain Name character set, or Punycode characters to confuse users. This can be both overwhelming and concerning. However, there is some hope. BloxOne Threat Defense offers the ability for security teams to monitor and protect against domains that could target their brand, or other sensitive domains. Thereby, increasing your security posture against attacks that may leverage LADs.<\/span><\/p>\n<h2><span style=\"font-weight: 400;\">Prerequisites\u00a0<\/span><\/h2>\n<ul>\n<li style=\"font-weight: 400;\" aria-level=\"1\"><span style=\"font-weight: 400;\">Access to a BloxOne Account via the Infoblox Cloud Services Portal (CSP)<\/span><\/li>\n<li style=\"font-weight: 400;\" aria-level=\"1\"><span style=\"font-weight: 400;\">A CSP Tenant with a BloxOne Threat Defense Advanced license<\/span><\/li>\n<\/ul>\n<h2><span style=\"font-weight: 400;\">Getting Started<\/span><\/h2>\n<p><span style=\"font-weight: 400;\">Log into the Infoblox CSP at csp.infoblox.com. Once logged into your account, highlight <\/span><b>Reports<\/b><span style=\"font-weight: 400;\"> in the left navigation panel and click on <\/span><b>Lookalike Domains<\/b><span style=\"font-weight: 400;\"> in the list that is revealed.<\/span><\/p>\n<p><img loading=\"lazy\" decoding=\"async\" class=\"aligncenter size-full wp-image-6677\" src=\"https:\/\/blogs.infoblox.com\/wp-content\/uploads\/lookalike-domains-1.png\" alt=\"\" width=\"563\" height=\"436\" srcset=\"https:\/\/www.infoblox.com\/blog\/wp-content\/uploads\/lookalike-domains-1.png 563w, https:\/\/www.infoblox.com\/blog\/wp-content\/uploads\/lookalike-domains-1-300x232.png 300w\" sizes=\"auto, (max-width: 563px) 100vw, 563px\" \/><\/p>\n<p><span style=\"font-weight: 400;\">On the Activity page you can find a list of indicators if you\u2019ve already added domains to your watched domains list. To add a domain to your watch list, click the <\/span><b>Watched Domains<\/b><span style=\"font-weight: 400;\"> tab located near the top of the infoblox CSP.<\/span><\/p>\n<p><img loading=\"lazy\" decoding=\"async\" class=\"aligncenter size-full wp-image-6678\" src=\"https:\/\/blogs.infoblox.com\/wp-content\/uploads\/lookalike-domains-2.png\" alt=\"\" width=\"667\" height=\"244\" srcset=\"https:\/\/www.infoblox.com\/blog\/wp-content\/uploads\/lookalike-domains-2.png 667w, https:\/\/www.infoblox.com\/blog\/wp-content\/uploads\/lookalike-domains-2-300x110.png 300w\" sizes=\"auto, (max-width: 667px) 100vw, 667px\" \/><\/p>\n<p><span style=\"font-weight: 400;\">On the Watched Domains tab you can add new domains to your watch list, import a csv list of domains, and edit or delete an existing watched domain. To add a domain click the <\/span><b>Create<\/b><span style=\"font-weight: 400;\"> button.<\/span><\/p>\n<p><img loading=\"lazy\" decoding=\"async\" class=\"aligncenter size-full wp-image-6679\" src=\"https:\/\/blogs.infoblox.com\/wp-content\/uploads\/lookalike-domains-3.png\" alt=\"\" width=\"639\" height=\"244\" srcset=\"https:\/\/www.infoblox.com\/blog\/wp-content\/uploads\/lookalike-domains-3.png 639w, https:\/\/www.infoblox.com\/blog\/wp-content\/uploads\/lookalike-domains-3-300x115.png 300w\" sizes=\"auto, (max-width: 639px) 100vw, 639px\" \/><\/p>\n<p><span style=\"font-weight: 400;\">Input the name of the domain you\u2019d like to watch in the <\/span><b>Domain-of-interest<\/b><span style=\"font-weight: 400;\"> text box, and if desired input a description. Then, click <\/span><b>Save &amp; Close<\/b><span style=\"font-weight: 400;\"> to confirm the addition of the domain to the watched domains list. <\/span><i><span style=\"font-weight: 400;\">Please note that you can only add up to 10 domains to the watched domains list.<\/span><\/i><\/p>\n<p><img loading=\"lazy\" decoding=\"async\" class=\"aligncenter size-full wp-image-6680\" src=\"https:\/\/blogs.infoblox.com\/wp-content\/uploads\/lookalike-domains-4.png\" alt=\"\" width=\"902\" height=\"596\" srcset=\"https:\/\/www.infoblox.com\/blog\/wp-content\/uploads\/lookalike-domains-4.png 902w, https:\/\/www.infoblox.com\/blog\/wp-content\/uploads\/lookalike-domains-4-300x198.png 300w, https:\/\/www.infoblox.com\/blog\/wp-content\/uploads\/lookalike-domains-4-768x507.png 768w\" sizes=\"auto, (max-width: 902px) 100vw, 902px\" \/><\/p>\n<p><span style=\"font-weight: 400;\">By navigating back to the <\/span><b>Activity <\/b><span style=\"font-weight: 400;\">page you can view lookalike domains that look like your watched domains.<\/span><\/p>\n<p><img loading=\"lazy\" decoding=\"async\" class=\"aligncenter size-full wp-image-6681\" src=\"https:\/\/blogs.infoblox.com\/wp-content\/uploads\/lookalike-domains-5.png\" alt=\"\" width=\"937\" height=\"443\" srcset=\"https:\/\/www.infoblox.com\/blog\/wp-content\/uploads\/lookalike-domains-5.png 937w, https:\/\/www.infoblox.com\/blog\/wp-content\/uploads\/lookalike-domains-5-300x142.png 300w, https:\/\/www.infoblox.com\/blog\/wp-content\/uploads\/lookalike-domains-5-768x363.png 768w\" sizes=\"auto, (max-width: 937px) 100vw, 937px\" \/><\/p>\n<p><span style=\"font-weight: 400;\">If desired, you can add one, or many, domains to a custom list that can be utilized with a security policy. To do this, click the checkbox on the domains you\u2019d like to add to a custom list. Then, click the <\/span><b>Add to custom list<\/b><span style=\"font-weight: 400;\"> button.<\/span><\/p>\n<p><img loading=\"lazy\" decoding=\"async\" class=\"aligncenter size-full wp-image-6682\" src=\"https:\/\/blogs.infoblox.com\/wp-content\/uploads\/lookalike-domains-6.png\" alt=\"\" width=\"742\" height=\"337\" srcset=\"https:\/\/www.infoblox.com\/blog\/wp-content\/uploads\/lookalike-domains-6.png 742w, https:\/\/www.infoblox.com\/blog\/wp-content\/uploads\/lookalike-domains-6-300x136.png 300w\" sizes=\"auto, (max-width: 742px) 100vw, 742px\" \/><\/p>\n<p><span style=\"font-weight: 400;\">Additionally, if a specific domain in the list interests you, you can easily navigate to that domain\u2019s Dossier page by clicking the icon located to the left of the Lookalike domain. This action will bring you right to the Dossier page of that domain.<\/span><\/p>\n<p><img loading=\"lazy\" decoding=\"async\" class=\"aligncenter size-full wp-image-6683\" src=\"https:\/\/blogs.infoblox.com\/wp-content\/uploads\/lookalike-domains-7.png\" alt=\"\" width=\"620\" height=\"238\" srcset=\"https:\/\/www.infoblox.com\/blog\/wp-content\/uploads\/lookalike-domains-7.png 620w, https:\/\/www.infoblox.com\/blog\/wp-content\/uploads\/lookalike-domains-7-300x115.png 300w\" sizes=\"auto, (max-width: 620px) 100vw, 620px\" \/><\/p>\n<p><img loading=\"lazy\" decoding=\"async\" class=\"aligncenter size-full wp-image-6684\" src=\"https:\/\/blogs.infoblox.com\/wp-content\/uploads\/lookalike-domains-8.png\" alt=\"\" width=\"1600\" height=\"564\" srcset=\"https:\/\/www.infoblox.com\/blog\/wp-content\/uploads\/lookalike-domains-8.png 1600w, https:\/\/www.infoblox.com\/blog\/wp-content\/uploads\/lookalike-domains-8-300x106.png 300w, https:\/\/www.infoblox.com\/blog\/wp-content\/uploads\/lookalike-domains-8-1024x361.png 1024w, https:\/\/www.infoblox.com\/blog\/wp-content\/uploads\/lookalike-domains-8-768x271.png 768w, https:\/\/www.infoblox.com\/blog\/wp-content\/uploads\/lookalike-domains-8-1536x541.png 1536w\" sizes=\"auto, (max-width: 1600px) 100vw, 1600px\" \/><\/p>\n<h2><span style=\"font-weight: 400;\">Summary<\/span><\/h2>\n<p><span style=\"font-weight: 400;\">Thanks to BloxOne Threat Defense, security teams now have a way to watch for, and protect against potentially malicious lookalike domains. With this tool in a network security professionals kit, potentially damaging cyber attacks that leverage lookalike domains can be prevented, the integrity of the brand can remain intact, the security posture is strengthened and the network security professional is able to get ahead of yet another form of zero day threats.<\/span><\/p>\n","protected":false},"excerpt":{"rendered":"<p>Introduction What do the URLs InfobIox(.)com and lnfoblox(.)com have in common? These are both URLs that are intended to look like the domain Infoblox(.)com. This is an example of a Lookalike domain, or LADs which are used in a variety of cyber attacks. By replacing the i with a lowercase l we can circumvent a [&hellip;]<\/p>\n","protected":false},"author":350,"featured_media":1914,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_acf_changed":false,"inline_featured_image":false,"_genesis_hide_title":false,"_genesis_hide_breadcrumbs":false,"_genesis_hide_singular_image":false,"_genesis_hide_footer_widgets":false,"_genesis_custom_body_class":"","_genesis_custom_post_class":"","_genesis_layout":"","footnotes":""},"categories":[2],"tags":[386,189],"class_list":{"0":"post-6676","1":"post","2":"type-post","3":"status-publish","4":"format-standard","5":"has-post-thumbnail","7":"category-security","8":"tag-lookalike-domains","9":"tag-cybersecurity","10":"entry"},"acf":[],"yoast_head":"<!-- This site is optimized with the Yoast SEO Premium plugin v27.3 (Yoast SEO v27.3) - https:\/\/yoast.com\/product\/yoast-seo-premium-wordpress\/ -->\n<title>BloxOne\u00ae Threat Defense Protects Against Attacks that Leverage Lookalike Domains<\/title>\n<meta name=\"description\" content=\"BloxOne\u00ae Threat Defense Protects Against Attacks that Leverage Lookalike Domains. What do the URLs InfobIox(.)com and lnfoblox(.)com have in common? These are both URLs that are intended to look like the domain Infoblox(.)com. This is an example of a Lookalike domain, or LADs which are used in a variety of cyber attacks. By replacing the i with a lowercase l we can circumvent a user&#039;s intended action of going to the correct URL. Are the previously mentioned URLs always malicious? No, but in a world where cyber attacks are frequent and come from many vectors, security teams should always do their best to cover all of their bases.\" \/>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/www.infoblox.com\/blog\/security\/bloxone-threat-defense-protects-against-attacks-that-leverage-lookalike-domains\/\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"BloxOne\u00ae Threat Defense Protects Against Attacks that Leverage Lookalike Domains\" \/>\n<meta property=\"og:description\" content=\"BloxOne\u00ae Threat Defense Protects Against Attacks that Leverage Lookalike Domains. What do the URLs InfobIox(.)com and lnfoblox(.)com have in common? These are both URLs that are intended to look like the domain Infoblox(.)com. This is an example of a Lookalike domain, or LADs which are used in a variety of cyber attacks. By replacing the i with a lowercase l we can circumvent a user&#039;s intended action of going to the correct URL. Are the previously mentioned URLs always malicious? No, but in a world where cyber attacks are frequent and come from many vectors, security teams should always do their best to cover all of their bases.\" \/>\n<meta property=\"og:url\" content=\"https:\/\/www.infoblox.com\/blog\/security\/bloxone-threat-defense-protects-against-attacks-that-leverage-lookalike-domains\/\" \/>\n<meta property=\"og:site_name\" content=\"Infoblox Blog\" \/>\n<meta property=\"article:published_time\" content=\"2021-07-22T20:27:59+00:00\" \/>\n<meta property=\"og:image\" content=\"https:\/\/www.infoblox.com\/blog\/wp-content\/uploads\/480288900-660x454-1.jpg\" \/>\n\t<meta property=\"og:image:width\" content=\"660\" \/>\n\t<meta property=\"og:image:height\" content=\"454\" \/>\n\t<meta property=\"og:image:type\" content=\"image\/jpeg\" \/>\n<meta name=\"author\" content=\"David Zenone\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:label1\" content=\"Written by\" \/>\n\t<meta name=\"twitter:data1\" content=\"David Zenone\" \/>\n\t<meta name=\"twitter:label2\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data2\" content=\"3 minutes\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\\\/\\\/schema.org\",\"@graph\":[{\"@type\":\"Article\",\"@id\":\"https:\\\/\\\/www.infoblox.com\\\/blog\\\/security\\\/bloxone-threat-defense-protects-against-attacks-that-leverage-lookalike-domains\\\/#article\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/www.infoblox.com\\\/blog\\\/security\\\/bloxone-threat-defense-protects-against-attacks-that-leverage-lookalike-domains\\\/\"},\"author\":{\"name\":\"David Zenone\",\"@id\":\"https:\\\/\\\/www.infoblox.com\\\/blog\\\/#\\\/schema\\\/person\\\/44f8c830b167b6fd384677b115cf9ec7\"},\"headline\":\"BloxOne\u00ae Threat Defense Protects Against Attacks that Leverage Lookalike Domains\",\"datePublished\":\"2021-07-22T20:27:59+00:00\",\"mainEntityOfPage\":{\"@id\":\"https:\\\/\\\/www.infoblox.com\\\/blog\\\/security\\\/bloxone-threat-defense-protects-against-attacks-that-leverage-lookalike-domains\\\/\"},\"wordCount\":600,\"publisher\":{\"@id\":\"https:\\\/\\\/www.infoblox.com\\\/blog\\\/#organization\"},\"image\":{\"@id\":\"https:\\\/\\\/www.infoblox.com\\\/blog\\\/security\\\/bloxone-threat-defense-protects-against-attacks-that-leverage-lookalike-domains\\\/#primaryimage\"},\"thumbnailUrl\":\"https:\\\/\\\/www.infoblox.com\\\/blog\\\/wp-content\\\/uploads\\\/480288900-660x454-1.jpg\",\"keywords\":[\"lookalike domains\",\"Cybersecurity\"],\"articleSection\":[\"Security\"],\"inLanguage\":\"en-US\"},{\"@type\":\"WebPage\",\"@id\":\"https:\\\/\\\/www.infoblox.com\\\/blog\\\/security\\\/bloxone-threat-defense-protects-against-attacks-that-leverage-lookalike-domains\\\/\",\"url\":\"https:\\\/\\\/www.infoblox.com\\\/blog\\\/security\\\/bloxone-threat-defense-protects-against-attacks-that-leverage-lookalike-domains\\\/\",\"name\":\"BloxOne\u00ae Threat Defense Protects Against Attacks that Leverage Lookalike Domains\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/www.infoblox.com\\\/blog\\\/#website\"},\"primaryImageOfPage\":{\"@id\":\"https:\\\/\\\/www.infoblox.com\\\/blog\\\/security\\\/bloxone-threat-defense-protects-against-attacks-that-leverage-lookalike-domains\\\/#primaryimage\"},\"image\":{\"@id\":\"https:\\\/\\\/www.infoblox.com\\\/blog\\\/security\\\/bloxone-threat-defense-protects-against-attacks-that-leverage-lookalike-domains\\\/#primaryimage\"},\"thumbnailUrl\":\"https:\\\/\\\/www.infoblox.com\\\/blog\\\/wp-content\\\/uploads\\\/480288900-660x454-1.jpg\",\"datePublished\":\"2021-07-22T20:27:59+00:00\",\"description\":\"BloxOne\u00ae Threat Defense Protects Against Attacks that Leverage Lookalike Domains. What do the URLs InfobIox(.)com and lnfoblox(.)com have in common? These are both URLs that are intended to look like the domain Infoblox(.)com. This is an example of a Lookalike domain, or LADs which are used in a variety of cyber attacks. By replacing the i with a lowercase l we can circumvent a user's intended action of going to the correct URL. Are the previously mentioned URLs always malicious? No, but in a world where cyber attacks are frequent and come from many vectors, security teams should always do their best to cover all of their bases.\",\"breadcrumb\":{\"@id\":\"https:\\\/\\\/www.infoblox.com\\\/blog\\\/security\\\/bloxone-threat-defense-protects-against-attacks-that-leverage-lookalike-domains\\\/#breadcrumb\"},\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\\\/\\\/www.infoblox.com\\\/blog\\\/security\\\/bloxone-threat-defense-protects-against-attacks-that-leverage-lookalike-domains\\\/\"]}]},{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/www.infoblox.com\\\/blog\\\/security\\\/bloxone-threat-defense-protects-against-attacks-that-leverage-lookalike-domains\\\/#primaryimage\",\"url\":\"https:\\\/\\\/www.infoblox.com\\\/blog\\\/wp-content\\\/uploads\\\/480288900-660x454-1.jpg\",\"contentUrl\":\"https:\\\/\\\/www.infoblox.com\\\/blog\\\/wp-content\\\/uploads\\\/480288900-660x454-1.jpg\",\"width\":660,\"height\":454,\"caption\":\"[Video] Changing Definition of Core Networking and Enterprise Expectations on Security\"},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\\\/\\\/www.infoblox.com\\\/blog\\\/security\\\/bloxone-threat-defense-protects-against-attacks-that-leverage-lookalike-domains\\\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\\\/\\\/www.infoblox.com\\\/blog\\\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"Security\",\"item\":\"https:\\\/\\\/www.infoblox.com\\\/blog\\\/category\\\/security\\\/\"},{\"@type\":\"ListItem\",\"position\":3,\"name\":\"BloxOne\u00ae Threat Defense Protects Against Attacks that Leverage Lookalike Domains\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\\\/\\\/www.infoblox.com\\\/blog\\\/#website\",\"url\":\"https:\\\/\\\/www.infoblox.com\\\/blog\\\/\",\"name\":\"infoblox.com\\\/blog\\\/\",\"description\":\"\",\"publisher\":{\"@id\":\"https:\\\/\\\/www.infoblox.com\\\/blog\\\/#organization\"},\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\\\/\\\/www.infoblox.com\\\/blog\\\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"en-US\"},{\"@type\":\"Organization\",\"@id\":\"https:\\\/\\\/www.infoblox.com\\\/blog\\\/#organization\",\"name\":\"Infoblox\",\"url\":\"https:\\\/\\\/www.infoblox.com\\\/blog\\\/\",\"logo\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/www.infoblox.com\\\/blog\\\/#\\\/schema\\\/logo\\\/image\\\/\",\"url\":\"https:\\\/\\\/www.infoblox.com\\\/blog\\\/wp-content\\\/uploads\\\/infoblox-logo-2.svg\",\"contentUrl\":\"https:\\\/\\\/www.infoblox.com\\\/blog\\\/wp-content\\\/uploads\\\/infoblox-logo-2.svg\",\"width\":137,\"height\":30,\"caption\":\"Infoblox\"},\"image\":{\"@id\":\"https:\\\/\\\/www.infoblox.com\\\/blog\\\/#\\\/schema\\\/logo\\\/image\\\/\"}},{\"@type\":\"Person\",\"@id\":\"https:\\\/\\\/www.infoblox.com\\\/blog\\\/#\\\/schema\\\/person\\\/44f8c830b167b6fd384677b115cf9ec7\",\"name\":\"David Zenone\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/blogs.infoblox.com\\\/wp-content\\\/uploads\\\/avatar_user_350_1611073681-96x96.jpg\",\"url\":\"https:\\\/\\\/blogs.infoblox.com\\\/wp-content\\\/uploads\\\/avatar_user_350_1611073681-96x96.jpg\",\"contentUrl\":\"https:\\\/\\\/blogs.infoblox.com\\\/wp-content\\\/uploads\\\/avatar_user_350_1611073681-96x96.jpg\",\"caption\":\"David Zenone\"},\"description\":\"David Zenone is a Technical Marketing Engineer. David joined Infoblox in late 2019 and has created multiple integrations with NIOS using Outbound Notifications. In addition to building Security Ecosystem integrations David has become a subject matter expert on Infoblox\u2019s SaaS offerings. In his free time he enjoys playing the Guitar, building and playing on PCs, and spending time with his family.\",\"url\":\"https:\\\/\\\/www.infoblox.com\\\/blog\\\/author\\\/david-zenone\\\/\"}]}<\/script>\n<!-- \/ Yoast SEO Premium plugin. -->","yoast_head_json":{"title":"BloxOne\u00ae Threat Defense Protects Against Attacks that Leverage Lookalike Domains","description":"BloxOne\u00ae Threat Defense Protects Against Attacks that Leverage Lookalike Domains. What do the URLs InfobIox(.)com and lnfoblox(.)com have in common? These are both URLs that are intended to look like the domain Infoblox(.)com. This is an example of a Lookalike domain, or LADs which are used in a variety of cyber attacks. By replacing the i with a lowercase l we can circumvent a user's intended action of going to the correct URL. Are the previously mentioned URLs always malicious? No, but in a world where cyber attacks are frequent and come from many vectors, security teams should always do their best to cover all of their bases.","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/www.infoblox.com\/blog\/security\/bloxone-threat-defense-protects-against-attacks-that-leverage-lookalike-domains\/","og_locale":"en_US","og_type":"article","og_title":"BloxOne\u00ae Threat Defense Protects Against Attacks that Leverage Lookalike Domains","og_description":"BloxOne\u00ae Threat Defense Protects Against Attacks that Leverage Lookalike Domains. What do the URLs InfobIox(.)com and lnfoblox(.)com have in common? These are both URLs that are intended to look like the domain Infoblox(.)com. This is an example of a Lookalike domain, or LADs which are used in a variety of cyber attacks. By replacing the i with a lowercase l we can circumvent a user's intended action of going to the correct URL. Are the previously mentioned URLs always malicious? No, but in a world where cyber attacks are frequent and come from many vectors, security teams should always do their best to cover all of their bases.","og_url":"https:\/\/www.infoblox.com\/blog\/security\/bloxone-threat-defense-protects-against-attacks-that-leverage-lookalike-domains\/","og_site_name":"Infoblox Blog","article_published_time":"2021-07-22T20:27:59+00:00","og_image":[{"width":660,"height":454,"url":"https:\/\/www.infoblox.com\/blog\/wp-content\/uploads\/480288900-660x454-1.jpg","type":"image\/jpeg"}],"author":"David Zenone","twitter_card":"summary_large_image","twitter_misc":{"Written by":"David Zenone","Est. reading time":"3 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"Article","@id":"https:\/\/www.infoblox.com\/blog\/security\/bloxone-threat-defense-protects-against-attacks-that-leverage-lookalike-domains\/#article","isPartOf":{"@id":"https:\/\/www.infoblox.com\/blog\/security\/bloxone-threat-defense-protects-against-attacks-that-leverage-lookalike-domains\/"},"author":{"name":"David Zenone","@id":"https:\/\/www.infoblox.com\/blog\/#\/schema\/person\/44f8c830b167b6fd384677b115cf9ec7"},"headline":"BloxOne\u00ae Threat Defense Protects Against Attacks that Leverage Lookalike Domains","datePublished":"2021-07-22T20:27:59+00:00","mainEntityOfPage":{"@id":"https:\/\/www.infoblox.com\/blog\/security\/bloxone-threat-defense-protects-against-attacks-that-leverage-lookalike-domains\/"},"wordCount":600,"publisher":{"@id":"https:\/\/www.infoblox.com\/blog\/#organization"},"image":{"@id":"https:\/\/www.infoblox.com\/blog\/security\/bloxone-threat-defense-protects-against-attacks-that-leverage-lookalike-domains\/#primaryimage"},"thumbnailUrl":"https:\/\/www.infoblox.com\/blog\/wp-content\/uploads\/480288900-660x454-1.jpg","keywords":["lookalike domains","Cybersecurity"],"articleSection":["Security"],"inLanguage":"en-US"},{"@type":"WebPage","@id":"https:\/\/www.infoblox.com\/blog\/security\/bloxone-threat-defense-protects-against-attacks-that-leverage-lookalike-domains\/","url":"https:\/\/www.infoblox.com\/blog\/security\/bloxone-threat-defense-protects-against-attacks-that-leverage-lookalike-domains\/","name":"BloxOne\u00ae Threat Defense Protects Against Attacks that Leverage Lookalike Domains","isPartOf":{"@id":"https:\/\/www.infoblox.com\/blog\/#website"},"primaryImageOfPage":{"@id":"https:\/\/www.infoblox.com\/blog\/security\/bloxone-threat-defense-protects-against-attacks-that-leverage-lookalike-domains\/#primaryimage"},"image":{"@id":"https:\/\/www.infoblox.com\/blog\/security\/bloxone-threat-defense-protects-against-attacks-that-leverage-lookalike-domains\/#primaryimage"},"thumbnailUrl":"https:\/\/www.infoblox.com\/blog\/wp-content\/uploads\/480288900-660x454-1.jpg","datePublished":"2021-07-22T20:27:59+00:00","description":"BloxOne\u00ae Threat Defense Protects Against Attacks that Leverage Lookalike Domains. What do the URLs InfobIox(.)com and lnfoblox(.)com have in common? These are both URLs that are intended to look like the domain Infoblox(.)com. This is an example of a Lookalike domain, or LADs which are used in a variety of cyber attacks. By replacing the i with a lowercase l we can circumvent a user's intended action of going to the correct URL. Are the previously mentioned URLs always malicious? No, but in a world where cyber attacks are frequent and come from many vectors, security teams should always do their best to cover all of their bases.","breadcrumb":{"@id":"https:\/\/www.infoblox.com\/blog\/security\/bloxone-threat-defense-protects-against-attacks-that-leverage-lookalike-domains\/#breadcrumb"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/www.infoblox.com\/blog\/security\/bloxone-threat-defense-protects-against-attacks-that-leverage-lookalike-domains\/"]}]},{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/www.infoblox.com\/blog\/security\/bloxone-threat-defense-protects-against-attacks-that-leverage-lookalike-domains\/#primaryimage","url":"https:\/\/www.infoblox.com\/blog\/wp-content\/uploads\/480288900-660x454-1.jpg","contentUrl":"https:\/\/www.infoblox.com\/blog\/wp-content\/uploads\/480288900-660x454-1.jpg","width":660,"height":454,"caption":"[Video] Changing Definition of Core Networking and Enterprise Expectations on Security"},{"@type":"BreadcrumbList","@id":"https:\/\/www.infoblox.com\/blog\/security\/bloxone-threat-defense-protects-against-attacks-that-leverage-lookalike-domains\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/www.infoblox.com\/blog\/"},{"@type":"ListItem","position":2,"name":"Security","item":"https:\/\/www.infoblox.com\/blog\/category\/security\/"},{"@type":"ListItem","position":3,"name":"BloxOne\u00ae Threat Defense Protects Against Attacks that Leverage Lookalike Domains"}]},{"@type":"WebSite","@id":"https:\/\/www.infoblox.com\/blog\/#website","url":"https:\/\/www.infoblox.com\/blog\/","name":"infoblox.com\/blog\/","description":"","publisher":{"@id":"https:\/\/www.infoblox.com\/blog\/#organization"},"potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/www.infoblox.com\/blog\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"en-US"},{"@type":"Organization","@id":"https:\/\/www.infoblox.com\/blog\/#organization","name":"Infoblox","url":"https:\/\/www.infoblox.com\/blog\/","logo":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/www.infoblox.com\/blog\/#\/schema\/logo\/image\/","url":"https:\/\/www.infoblox.com\/blog\/wp-content\/uploads\/infoblox-logo-2.svg","contentUrl":"https:\/\/www.infoblox.com\/blog\/wp-content\/uploads\/infoblox-logo-2.svg","width":137,"height":30,"caption":"Infoblox"},"image":{"@id":"https:\/\/www.infoblox.com\/blog\/#\/schema\/logo\/image\/"}},{"@type":"Person","@id":"https:\/\/www.infoblox.com\/blog\/#\/schema\/person\/44f8c830b167b6fd384677b115cf9ec7","name":"David Zenone","image":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/blogs.infoblox.com\/wp-content\/uploads\/avatar_user_350_1611073681-96x96.jpg","url":"https:\/\/blogs.infoblox.com\/wp-content\/uploads\/avatar_user_350_1611073681-96x96.jpg","contentUrl":"https:\/\/blogs.infoblox.com\/wp-content\/uploads\/avatar_user_350_1611073681-96x96.jpg","caption":"David Zenone"},"description":"David Zenone is a Technical Marketing Engineer. David joined Infoblox in late 2019 and has created multiple integrations with NIOS using Outbound Notifications. In addition to building Security Ecosystem integrations David has become a subject matter expert on Infoblox\u2019s SaaS offerings. In his free time he enjoys playing the Guitar, building and playing on PCs, and spending time with his family.","url":"https:\/\/www.infoblox.com\/blog\/author\/david-zenone\/"}]}},"_links":{"self":[{"href":"https:\/\/www.infoblox.com\/blog\/wp-json\/wp\/v2\/posts\/6676","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.infoblox.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.infoblox.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.infoblox.com\/blog\/wp-json\/wp\/v2\/users\/350"}],"replies":[{"embeddable":true,"href":"https:\/\/www.infoblox.com\/blog\/wp-json\/wp\/v2\/comments?post=6676"}],"version-history":[{"count":1,"href":"https:\/\/www.infoblox.com\/blog\/wp-json\/wp\/v2\/posts\/6676\/revisions"}],"predecessor-version":[{"id":6685,"href":"https:\/\/www.infoblox.com\/blog\/wp-json\/wp\/v2\/posts\/6676\/revisions\/6685"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.infoblox.com\/blog\/wp-json\/wp\/v2\/media\/1914"}],"wp:attachment":[{"href":"https:\/\/www.infoblox.com\/blog\/wp-json\/wp\/v2\/media?parent=6676"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.infoblox.com\/blog\/wp-json\/wp\/v2\/categories?post=6676"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.infoblox.com\/blog\/wp-json\/wp\/v2\/tags?post=6676"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}