Malware
Brand squat
Brand squat is a domain, subdomain, or package that borrows a trusted product name to look official. It exists to be mistaken for the real thing, then used for phishing, fake downloads, or injected scripts.
How it is measured
You spot a brand squat by comparing the hostname with the real one. Registration age, registrar, TLS certificate issuer, and whether the host appears in the real vendor's docs tell you more than the look of the page. A site claiming to be Stripe that was registered three days ago is not.
For scripts, list every third-party host on a page and read each one aloud. `js.stripe.com` is real. `stripe-js.cdn-assets.top` is a squat. Unknown names that contain a famous brand are the target.
Worked example
A store's checkout loads `https://cdn.shopify-assets.help/checkout.js`. It reads like Shopify, but Shopify serves from `cdn.shopify.com`, and the `.help` domain was registered 11 days ago. The script reads card fields and posts them elsewhere.
The merchant removes the injected tag from the theme footer, checks the theme editor for other lines, and finds a second one added in the 404 template.
How it differs
A brand squat wears a famous name; typosquatting relies on a misspelling of one, like `gooogle.com`. A squat can be spelled perfectly and still be fake, because it adds words such as `-support` or `-cdn`. A typosquat needs the victim to mistype. A compromised CDN is different again: the host is genuine but now serves bad files.
Common errors
Trusting a page because the logo is right. Checking only for a padlock, which a squat also has. Assuming a hostname that contains the brand belongs to the brand. Reading just the start of a long hostname on a phone. Allowlisting `*.stripe` style patterns that also match attacker-owned names.
In practice
Compare every script host on your checkout and login pages with the vendor's documentation. Pin exact hostnames in your CSP rather than patterns. Register the obvious lookalike domains of your own brand if you can afford to, and tell customers which exact domain you send email from.