Typosquatting
DNS Twister
Enter the target’s website and see if any similiar domains have been registered, or exist, that could be used by an adversary.
In a red team or social engineering engagement it may be possible to register one of these domains and rely on typosquatting (where users accidentally misspell the organisation’s legitimate website) to capture valid credentials. However, it should be known that this type of activity is not typically conducted in an External Penetration Test.
However, we can use this tool as a part of passive reconnaissance to identify if the organisation has registered similiar domains themselves which could be pointing to other infrastructure.