One letter
too many

None of these domains was hacked. They were bought.

Three years before the Surfside Beach wire transfer, the Government of Canada had described the technique in two sentences, on its public awareness website.

The important word is not "hack". It is "resembles".

The Surfside Beach emails came from a domain owned by the fraudster, ordinarily registered, paid for with a few dollars. The independent review found no intrusion into the town's systems. Which side had an email account compromised, nobody has established: the review covered the town, not its contractor. What is certain is that the name used to deceive was stolen from no one.

And the victim is almost never who you'd expect. Surfside Beach's fake domain was used to deceive a supplier. The L'Oréal domains targeted job applicants. The third case targeted employees themselves, by imitating the VPN portal or the help desk. Your domain is an asset you only half control: the exact name is yours, everything that resembles it belongs to whoever registers it first.

The problem isn't blocking these domains. It's knowing they exist.

This isn't a hunch. The two figures below explain why an annual check can't work.

This isn't negligence, it's a question of pace. An SMB has an IT provider paid to keep things running, not to query the domain name registry every morning. Nobody has a reason to type their own name with a typo.

The analysis is entirely external: no software on your servers, no access to your systems, no interruption. It starts from a domain name and looks at what resembles it, exactly the way someone drafting a fraudulent email in your name would.

They require no technical knowledge. They are put to your IT lead, to your service provider, or to both in the same meeting.

One minute to find out, without us.

These few lines paste as-is into a terminal: PowerShell on Windows, Bash on macOS and Linux. They generate the most common typos on your own domain name, then ask the DNS which ones answer. Nothing is installed, nothing is sent anywhere, and none of the sites found are visited.

# Replace cyberazimut.com with your own full domain name.
domain=cyberazimut.com
name=${domain%%.*}
exts=$(printf '%s\n' "${domain#*.}" com ca net org | sort -u)

awk -v s=$name 'BEGIN{ n = length(s); print s
  for (i=1;i<=n;i++) print substr(s,1,i-1) substr(s,i+1)             # one letter short
  for (i=1;i<=n;i++) print substr(s,1,i) substr(s,i,1) substr(s,i+1) # doubled letter
  for (i=1;i<n;i++)  print substr(s,1,i-1) substr(s,i+1,1) substr(s,i,1) substr(s,i+2)
}' | sort -u | while read v; do
  for ext in $exts; do
    ip=$(dig +short +time=2 +tries=1 "$v.$ext" A | grep -m1 '^[0-9]')
    [ -n "$ip" ] && echo "$v.$ext  ->  $ip"
  done
done
echo "Done. A domain that responds isn't necessarily hostile."

# Replace cyberazimut.com with your own full domain name.
$ErrorActionPreference = 'SilentlyContinue'
$domain = "cyberazimut.com"
$name = $domain.Substring(0, $domain.IndexOf('.'))
$exts = @($domain.Substring($domain.IndexOf('.') + 1), 'com', 'ca', 'net', 'org') | Select-Object -Unique

$variants = [System.Collections.Generic.HashSet[string]]::new()
$variants.Add($name) | Out-Null
for ($i = 0; $i -lt $name.Length; $i++) {
  $variants.Add($name.Remove($i,1)) | Out-Null                            # one letter short
  $variants.Add($name.Insert($i+1, $name[$i])) | Out-Null                 # doubled letter
}
for ($i = 0; $i -lt $name.Length - 1; $i++) {
  $chars = $name.ToCharArray()
  $tmp = $chars[$i]; $chars[$i] = $chars[$i+1]; $chars[$i+1] = $tmp
  $variants.Add(-join $chars) | Out-Null                                  # swapped letters
}

foreach ($v in ($variants | Sort-Object)) {
  foreach ($ext in $exts) {
    try {
      $task = [System.Net.Dns]::GetHostAddressesAsync("$v.$ext")
      if ($task.Wait(1500) -and $task.Status -eq 'RanToCompletion') {
        $ip = $task.Result | Where-Object AddressFamily -eq 'InterNetwork' | Select-Object -First 1
        if ($ip) { Write-Output "$v.$ext  ->  $ip" }
      }
    } catch {}
  }
}
Write-Output "Done. A domain that responds isn't necessarily hostile."

The first domain you recognise in the list should be your own: that's the sign everything works. The rest are domains that exist, that respond, and that you never registered.