---
sourceDocument: Yokohama Security Management
sourceDocumentLink: https://www.servicenow.com/docs/r/yokohama/security-management

 Release :

    - yokohama

ft:locale :

    - en-US

ft:publication_title :

    - Yokohama Security Management

ft:clusterId :

    - security

bundleId :

    - security

workflow :

    - Technology


---

# Playbook for Typo Squatted Domain

# Playbook for Typo Squatted Domain {#ariaid-title1}

* Release version: Yokohama
* 
* Updated January 30, 2025
* 
* ![](https://www.servicenow.com/docs/portal-asset/ico-clock) 1 minute to read

This playbook provides systematic procedures for investigating misspelled domains and collaborating with the organization's legal department for take-downs. Typo Squatted domains are intentionally misspelled domain names that
closely resemble legitimate ones. Attackers take advantage of spelling errors to lead them to an ill-intended website for financial exploitation or other malicious activities.

The Typo Squatted Domains are reported to the Security Operations Team from different sources like Digital risk protection solutions (Digital Shadows) and Threat intelligence platforms (Anomali Threatstream). After a security incident
is created, this solution helps identify whether the domain is indeed a Typo Squatted Domain. If it's a Typo Squatted Domain, the analyst can report it to the legal team so that further actions can be taken.

The workflow is created based on an existing playbook, which provides a consistent and efficient approach for incident investigation. Each decision point in the playbook has been converted into an outcome-driven task and the flow
changes direction based on the outcome of such tasks.
* **[Set up the Typo Squatted Domain playbook](https://www.servicenow.com/docs/PCeH0pLtWBFl604PeugJWA)**   
  Use the following steps to set up the Typo Squatted Domain playbook.
* **[Use the Typo Squatted Domain playbook](https://www.servicenow.com/docs/7FU3iPS_04EUUdCYbKAmgg)**   
  Use this playbook to investigate misspelled domains and collaborating with the organization's legal department for take-downs. The following steps give you a walkthrough of the actions, tasks, and subflows that are available in the Typo Squatted Domain playbook.