Can my firm's name appear inside someone else's address?

How can my name sit inside another address?

threat actors take control of a subdomain that is no longer actively used by its legitimate owner or create subdomains that mimic legitimate ones

A domain owner can create any number of names under their domain, such as login, invoices, or a copy of your whole domain name followed by theirs.

RFC 1034 says the labels of a domain name are read from the most specific on the left to the least specific on the right. The part that decides who controls the address is at the right-hand end.

Why does this fool people?

By convention, the labels that compose a domain name are printed or read left to right, from the most specific (lowest, farthest from the root) to the least specific (highest, closest to the root).

Readers look for a familiar name and find it at the start of the address. On a phone, the end of a long address is often cut off, which hides the part that matters.

How do I read an address safely?

1. Find the end of the host name: the point before the first single slash in a link, or the part after the @ in an email address.
2. Read the last two parts before that point, such as yourfirm.example.That is who controls the address.
3. Remove subdomains your firm no longer uses so nobody can take them over.
4. Tell clients your exact domain, so a longer address with your name in it stands out.