9/2/25, 9:40 PM

Darktrace’s Inside the SOC blog reports that researchers at Cado Security Labs (now part of Darktrace) detected a typosquatting domain that closely resembled Cadosecurity[.]com and redirected visitors to the legitimate site, with an accompanying fake X (Twitter) account created in an attempt to impersonate the brand.

The researchers note that the threat actor also established a fake account for Cado and even purchased a Gold Checkmark to enhance authenticity, signalling a broader spoofing effort against tech companies. Cado responded by informing staff, blocking emails from the malicious domain, and reporting the domain to the DNS registrar, which subsequently suspended it; the domain was registered through Apiname and resolved to 94.154.35[.]15.

The post highlights the use of a domain-generation and lookup tool, dnstwist, which generated nearly 9,000 permutations of the Cado domain to probe potential phishing opportunities. Published on 21 August 2024, the piece emphasises proactive monitoring of domain registrations and swift, staff-enabled responses as key defences against typosquatting campaigns.