Add Guidance About Typosquatting or lookalike domain phishing in relevant CheatSheet

[sujalavnelavai]

I have reviewed many Cheat Sheets whether this topic is present elsewhere in Phishing Cheat Sheet and other cheat sheets related to this like Authentication cheat sheet, MFA cheat sheet, credential stuffing, user privacy protection, TLS cheat sheet and some cheat sheets but I did not find any guidance about this topic.

I would like to propose adding a concised section about Typosquatting or look-alike domains which can lead to credential theft, session compromise, or supply chain compromise, and then refer readers to authoritative external guidance.

References include:

CISA guidance on software supply chain security and typosquatting.
Other authoritative industry guidance where appropriate.

The goal is to improve awareness while keeping the Cheat Sheet focused and avoiding duplication of existing content.

It seems Phishing cheat sheet would be a better fit to add but I would appreciate feedback from the maintainers on whether this would be an appropriate enhancement, and if so, which cheat sheet(s) would be the most suitable location before I prepare a pull request.

                           Thank you.

[mackowski]

Thanks for the thoughtful write-up, @sujalavnelavai - and for checking existing sheets before proposing this rather than just opening a PR. That's exactly the right process. After looking into it, I'm going to decline this one, and I want to explain the reasoning so it's useful for future proposals.
Scope. The Cheat Sheet Series is aimed at developers building an application, and each piece of guidance should map to a concrete control a developer implements in their own code or infrastructure. Typosquatting / look-alike domain phishing is mostly an end-user-awareness, brand-protection, DNS-monitoring, and domain-takedown problem — it sits largely outside the app-developer threat model. A section that raises awareness and refers out to CISA, while well-intentioned, would be closer to user-education than to an actionable developer control, which isn't a good fit for the series.

Existing coverage. The developer-relevant pieces of this topic are already in the series:

• Package typosquatting/slopsquatting (the supply-chain angle) is covered in the NPM Security Cheat Sheet (https://cheatsheetseries.owasp.org/cheatsheets/NPM_Security_Cheat_Sheet.html) (section 10), and touched in the CI/CD Security, MCP Security, and Secure Coding with AI sheets.
• The look-alike domain angle a developer can actually act on — punycode normalization and homoglyph/confusable characters (e.g. Latin vs Cyrillic) in user-supplied domains and email addresses — is in the Email Validation and Verification Cheat Sheet (https://cheatsheetseries.owasp.org/cheatsheets/Email_Validation_and_Verification_Cheat_Sheet.html).

@jmanico what do you think?

[sujalavnelavai]

Thank you for the detailed explanation and guidance. Henceforth I will focus on areas that map directly to developer‑implemented controls. Thanks again for the thoughtful review.