Verifying an email sender's domain against typosquatting variants

Inboxes across Sydney, Melbourne and Brisbane stay full of messages pretending to come from well-known organisations. The Australian Cyber Security Centre lists business email compromise and brand impersonation among the most reported cyber threats each year, often arriving as an ATO notice, a myGov alert or an Australia Post delivery issue. Knowing how to tell a genuine sender domain from a carefully crafted typosquat is the first line of defence.

A typosquatting variant is a domain that looks almost identical to a real brand but swaps, drops or adds a single character. Attackers register these near-twins to host lookalike login pages, harvest MFA codes or ride the trust an inbox gives a familiar name. Quick sorting protects both individuals checking email on the train and security teams triaging a suspicious report.

Reading the visible parts of the domain

Before diving into DNS records, look closely at what sits after the @ symbol. Real Australian businesses usually send from their primary .com.au or .com domain, while typosquats rely on cheaper TLDs such as .top, .click or .xyz. A genuine CBA notice will not originate from commbank-secure-login.top, and Telstra billing will not arrive from telstraaustralia-online.co. Single character swaps, doubled letters or hyphen insertions are classic giveaways.

Australians regularly see brand names ending in .com.au, so a stray .com alone in an email claiming to be from Bunnings, Coles or Woolworths should raise immediate suspicion. Likewise, country-code variants that look right but read strangely, such as .comau or .c0m.au, are not legitimate second-level domains. Treat any mismatch between the sender's domain and the brand's known web presence as a reason to slow down before clicking.

Checking SPF, DKIM and DMARC alignment

Authentication records are the next layer of evidence. SPF tells receiving mail servers which IPs are allowed to send on behalf of a domain, DKIM adds a cryptographic signature to each message, and DMARC ties those checks together with a policy for handling failures. A legitimate brand publishes all three; a typosquat usually publishes none, or only a permissive DMARC record with a low percentage.

When a phishing report lands in Perth or Adelaide, running the sender domain through a DNS lookup returns these records in seconds. A missing DMARC record, or a p=none policy with no reporting address, tells receiving servers nothing should be enforced. The guide on https://trustedsenderscore.com/guides/how-to-analyze-email-authentication-failure-reports-for-your-team-review walks through parsing aggregate reports and spotting spoofing patterns across a team.

Inspecting domain age, registrar and hosting footprint

Typosquats are typically registered in bulk, often days or weeks before a campaign launches. A WHOIS lookup reveals the creation date, registrar and sometimes the registrant country. A domain registered last Tuesday in a country unrelated to the brand's operations, hosted on a cheap VPS, is a strong negative signal. Established Australian brands usually have registration histories stretching back many years with consistent hosting.

This is where bulk reputation tools earn their keep. Uploading a list of suspect sender domains lets a security team compare age, TLD spread and hosting patterns against known legitimate infrastructure in seconds. Trusted Sender Score runs these bulk checks and pulls a domain reputation summary alongside authentication results, which is useful when triaging the dozens of lookalike domains that appear around tax time each year.

Cross-referencing brand assets and behaviour

Authentication confirms whether the technical setup matches, but it does not prove the brand is real. Typosquatting kits usually copy logos, colour palettes and legal disclaimers from the brand they impersonate. Look for low-resolution images, slightly off colours, generic footers or legal text that references the wrong entity. A genuine ATO message will reference Australian legislation correctly and use the official ato.gov.au address, not a misspelled mirror.

Behaviour matters too. Real organisations do not ask recipients to pay fines in gift cards, transfer money to release a parcel or click a link to avoid a myGov suspension. The ACCC's Scamwatch regularly flags these patterns, particularly around parcel redelivery and government impersonation. If the message creates urgency or pressures you to bypass normal channels, treat the domain as suspicious.

Reporting typosquats and triggering takedown

Once a typosquat is confirmed, fast reporting shortens the window during which it can hurt anyone. Most registries and large hosting providers publish abuse contacts that respond within 24 to 48 hours when given clean evidence, including suspicious email headers, screenshots of the fraudulent page and a timestamp. Forwarding the original email as an attachment preserves those headers, which a plain forward usually strips.

In Australia, individuals can lodge a report with Scamwatch, while organisations should notify the ACSC through ReportCyber. Persistence matters because takedowns rarely succeed on the first request. Pairing each report with a note in your internal knowledge base helps the next analyst recognise the same kit faster.

Locking down your own brand against typosquatters

Verification work extends beyond catching incoming threats. Defensive registration of common misspellings, homoglyph variants and adjacent TLDs stops attackers setting up shop in the first place. Register your brand .com.au, .com, .net and the most likely typosquats before someone else does, then monitor the remaining space with alerts and use the full authentication stack so receiving systems have a strong signal to reject lookalikes.

Any DNS plan should also include a rollback path. If you migrate nameservers, an attacker who briefly slips into your gap can impersonate you convincingly. The structured https://trustedsenderscore.com/guides/how-to-protect-your-domain-during-a-dns-migration-guide keeps TTLs, DS records and registrar locks aligned so a window never opens for spoofing. Pair this with annual DMARC reviews, moving from p=none to p=quarantine and eventually p=reject.

Australia's Notifiable Data Breaches scheme under the Privacy Act 1988 makes impersonation risk more than a nuisance. A successful spoof that captures a staff credential can quickly escalate into a reportable incident with the Office of the Australian Information Commissioner, so proactive verification keeps your brand out of both the Scamwatch feed and the breach register.