Which technique does an attacker use to maintain a persistent foothold in a network by registering a domain that closely resembles a legitimate organization's domain (e.g., 'g00gle.com' vs 'google.com')?
Select an answer to reveal the explanation.
Short Explanation
Here's the deal — you're looking at typosquatting when an attacker registers a look-alike domain like g00gle.com to keep a foothold. It uses character substitution, misspellings, or homoglyphs to blend into expected traffic for phishing or C2. Domain shadowing, DNS cache poisoning, and BGP hijacking don't match the registered look-alike domain described.
Full Explanation
Typosquatting, including homoglyph or look-alike domain registration, is correct because it involves registering domains that closely resemble legitimate domains using character substitution, misspellings, or homoglyphs; these domains are used for phishing or C2 infrastructure that blends with expected traffic. Domain shadowing is wrong because it involves compromising the account of a legitimate domain registrant and creating malicious subdomains under their legitimate domain. DNS cache poisoning is wrong because it corrupts resolver caches to redirect legitimate domain queries to attacker IPs without registering a new domain. BGP hijacking is wrong because it reroutes internet traffic at the routing protocol level, not through domain registration.