Cybersquatting Domains Mimicking Major Brands Used for Phishing, Malware and Scams

Palo Alto Networks reported widespread abuse of cybersquatting domains that imitate major brands including Facebook, Apple, Amazon, Netflix, Microsoft, Samsung, Walmart, and Wells Fargo to conduct phishing, malware delivery, command-and-control, technical support fraud, reward scams, re-bill scams, and parked-domain monetization. In one month of observation, researchers identified 13,857 squatting domains—about 450 per day—with 2,595 classified as malicious and 5,104 as suspicious or high risk, showing how frequently newly registered lookalike domains are weaponized against consumers.

The activity used multiple squatting techniques, including typosquatting, combosquatting, homograph-squatting, soundsquatting, bitsquatting, and level-squatting, and often targeted profitable sectors such as search, social media, shopping, finance, and banking. Examples included secure-wellsfargo[.]org for phishing, samsungeblyaiphone[.]com for Azorult malware distribution, microsoft-store-drm-server[.]com for C2 activity, microsoft-alert[.]club for a technical support scam, and netflixbrazilcovid[.]com for a re-bill scam; researchers also found that more than half of the malicious or high-risk domains were not detected by any VirusTotal vendors during the comparison window, underscoring significant detection gaps and the need for continuous monitoring of newly registered domains and passive DNS data.