Protocol-impersonator domain registered (typosquat)
A threat intelligence & recon factor in the v1.7.0 rubric. Measured per protocol on a e cadence.
Methodology how we score #
**What this measures** This episodic signal fires when a domain that is a typosquat or visual lookalike of the protocol's official domain has been registered within the trailing 90 days. Typosquat detection covers common substitution patterns (transposed characters, homoglyph substitutions, TLD variants, subdomain spoofing) against a monitored list of known protocol domains. Detection uses domain monitoring feeds (e.g., DNSTwist-class analysis) run at configurable intervals against the protocol's official domain. Category 11 context: typosquat domains are the infrastructure layer for phishing attacks targeting protocol users — they precede attacks by days to weeks.
**Why it matters** Typosquat domains targeting DeFi protocols are documented across five in-sample hack precedents in the T-01 database. The Curve Finance DNS hijack ($575K, 2022) showed that frontend attacks can be executed via legitimate-looking domains. Badger DAO's Cloudflare compromise exploited user trust in the official frontend. Protocol-impersonator domains targeting users of high-TVL protocols typically serve fake wallet-connection prompts, seed-phrase phishing, or malicious approval requests. A newly registered lookalike domain is often registered one to four weeks before a phishing campaign launches, providing an actionable lead time.
**Green / Yellow / Red** Green is the baseline when no typosquat domains matching the protocol's official domain patterns have been registered in the trailing 90 days per the domain monitoring feed. Yellow fires when a domain with moderate similarity (e.g., protocol-app.xyz vs protocolapp.xyz) is registered — could be a legitimate user registering a fan site or a minor variant. Red fires when a high-similarity typosquat (e.g., prrotocol.app, pr0tocol.finance) targeting the protocol's exact brand is registered within the trailing 90 days.
**Common gray cases** Gray applies when the domain monitoring feed has incomplete TLD coverage, or when the protocol operates without a traditional domain (e.g., IPFS-only frontend with ENS access), making typosquat detection inapplicable.
**Notable historical examples** No cross-hacked incidents currently linked in database for this factor.
Measurement what to look for #
Determine whether a typosquat of the official protocol domain has been registered in the last 90 days.