The ThreatNG Domain Name Permutations capability proactively detects and analyzes potential domain variations to uncover hidden threats and identify look-alike domains. It automatically generates and analyzes a wide range of domain manipulations, such as homoglyphs, bitsquatting, insertions, omissions, and TLD-swaps. The tool can identify and group both available and taken domain permutations, and for those that are taken, it provides the associated IP address and mail record.

This capability is important because it helps organizations proactively defend against digital risks like phishing attacks, brand abuse, and counterfeiting. By identifying potential threats before they can be exploited, it strengthens an organization's overall security posture. ThreatNG's Domain Name Permutations capability provides a complete view of an organization's digital footprint and helps you respond swiftly to threats with actionable intelligence.

This capability is also known by terms like domain squatting detection, typosquatting analysis, or look-alike domain monitoring. Other approaches often involve manual searches or reactive monitoring, where threats are only identified after they have become active, requiring a more resource-intensive and often less effective response.

ThreatNG's Domain Name Permutations capability is different because it offers a customizable and comprehensive approach. It uses a packaged set of Top-Level Domains (TLDs) and Targeted Keywords, but also allows users to add their own to ensure the analysis is always relevant to their unique digital footprint and risk tolerance. This contrasts with solutions that may rely on static or limited lists. The platform's ability to provide IP addresses and mail records for taken domains also offers critical, actionable intelligence for immediate response.

Categorizing domain name permutations is critical because it helps you understand the specific methods attackers use to create fraudulent domains, allowing for more targeted and efficient threat detection and response. This prioritization is vital for allocating resources effectively and addressing the most critical risks first. A Homoglyph or Bitsquatting domain, for instance, may pose a higher risk due to its use in sophisticated phishing attacks, while a simple Dictionary Addition might be used for a fake support site. Categorization helps differentiate between these types of threats so you can respond accordingly.

The categorization of permutations is useful because it provides greater context and actionable intelligence. It allows a business to quickly differentiate a minor typo from a deliberate and malicious attempt at brand impersonation. This categorization provides a more proactive and nuanced approach to security. For example, a security team can use the categories to prioritize which threats to address first based on the known tactics of attackers. The classification of a fraudulent domain provides immediate insight into the potential purpose behind the manipulation, such as a Subdomain Impersonation used to mimic a legitimate service or a TLD-Swap for a fake login page.

An organization can use these categorizations to create automated workflows and targeted responses.

Brand Protection & Marketing: A brand protection team can use the Homoglyphs and TLD-Swaps categories to set up alerts for new domains that visually mimic their brand. When a new domain is flagged, the system can automatically send an alert to the legal team to begin a takedown process, protecting brand integrity and customer trust. Marketing can use the Available domains to register them proactively to prevent an attacker from using them in the future.

Security Operations (SecOps) & Incident Response: A SecOps team can prioritize new threats by the permutation category. A newly registered domain found in th Bitsquatting category might trigger an automated investigation via a SOAR platform, which would immediately check the IP address and mail record provided by ThreatNG to see if the domain is hosting a malicious site. If it is, the system could automatically push an alert to an incident response team, allowing for a swift and targeted defense before a phishing campaign is even launched.

Third-Party Risk Management: When vetting a new vendor, a due diligence team can use the domain permutation categorization to assess the third party’s digital footprint. By searching for permutations in categories like Subdomain Impersonation or Replacements related to the vendor's brand, the team can uncover hidden risks or past security incidents that the vendor might not have disclosed. This provides objective data to validate the third party's security claims and informs your decision on whether to partner with them.

This capability is crucial for a variety of roles within an organization. It's vital for External Attack Surface Management by helping to identify look-alike domains and potential threats before they become active attacks, which helps shrink the attack surface. For Digital Risk Protection and Brand Protection, it defends against brand impersonation and helps prevent phishing and counterfeiting. It's also important for Due Diligence and Third-Party Risk Management by helping you vet potential partners, assess their digital footprint, and monitor them for new threats.

The Domain Name Permutations capability is a critical part of the overall ThreatNG solution because it feeds into several key risk assessments and intelligence modules, enhancing the platform's ability to provide a comprehensive security posture evaluation. It's a core component of Domain Intelligence which in turn helps derive scores for BEC & Phishing Susceptibility, Brand Damage Susceptibility, and Data Leak Susceptibility. This capability also contributes to ThreatNG's overall mission of providing an all-in-one solution for external attack surface management, digital risk protection, and security ratings.

This capability complements other security solutions by providing proactive, external intelligence that helps identify threats before they are used in an attack. It can feed information to a SIEM or SOAR platform, allowing for automated investigation and response to a newly registered look-alike domain. For Incident Response teams, it provides actionable intelligence like IP addresses and mail records to accelerate their investigations. The solution also enhances Brand Protection services by identifying a broader range of complex domain manipulations, such as homoglyphs and bitsquatting, that may be missed by other tools. Additionally, it can benefit Vulnerability and Penetration Testing by identifying a client’s unknown or forgotten domains, expanding the scope of their work.