Which technique does an attacker use to maintain a persistent foothold in a network by registering a domain that closely resembles a legitimate organization's domain (e.g., 'g00gle.com' vs 'google.com')?
Select an answer to reveal the explanation.
Short Explanation and Infographic
Here's the deal — b is correct because typosquatting involves registering domains that closely resemble legitimate domains using character substitution, misspellings, or homoglyphs; these domains are used for phishing or C2 infrastructure that blends with expected traffic. A is wrong because domain shadowing involves compromising the account of a legitimate domain registrant and creating malicious subdomains under their legitimate domain.
Full explanation below image
Full Explanation
B is correct because typosquatting involves registering domains that closely resemble legitimate domains using character substitution, misspellings, or homoglyphs; these domains are used for phishing or C2 infrastructure that blends with expected traffic. A is wrong because domain shadowing involves compromising the account of a legitimate domain registrant and creating malicious subdomains under their legitimate domain. C is wrong because DNS cache poisoning corrupts resolver caches to redirect legitimate domain queries to attacker IPs without registering a new domain. D is wrong because BGP hijacking reroutes internet traffic at the routing protocol level, not through domain registration.