Definition
Typosquatting is a social engineering attack that registers domain names similar to popular websites, exploiting common typing errors to redirect users to malicious sites for phishing, malware distribution, or ad fraud.
People Also Ask
Common questions about Typosquatting answered by our security experts.
Typosquatting in Practice
Typosquatting is the registration of domain names resembling a legitimate one — misspellings, character substitutions, additional or omitted words, alternative top-level domains — to intercept traffic or lend credibility to fraud.
It differs from domain spoofing, which forges the sender of a message. Here the domain is genuinely registered and genuinely controlled by the attacker, which makes every technical authentication check pass.
The common patterns
Character omission or duplication. Adjacent-key substitution. Visually similar characters, including letters from other scripts that render almost identically. Added or removed hyphens and words. Different top-level domains against the same name.
Also subdomain construction, where your brand appears as a subdomain of the attacker's domain — which reads correctly at a glance and is entirely theirs.
What it is used for
Credential harvesting, through a sign-in page at a plausible address. Supporting business email compromise, where correspondence from a nearly correct domain survives scrutiny.
Malware distribution to people mistyping a software download address. And brand damage or extortion, where the registrant wants payment for the name.
Why it defeats technical controls
The domain is legitimately registered, so mail authentication passes for it. Certificates are freely available, so it has working encryption and a padlock. It has no bad reputation, because it is new and has done nothing yet.
Every automated check that a defender relies on returns a clean result. The only thing wrong with the domain is that it is not yours, and that requires knowing what yours is.
Monitoring is the practical defence
Certificate transparency logs record every certificate issued, which makes new lookalike domains visible shortly after they become usable. Registration monitoring services watch for variations on your name.
Detection matters because registration frequently precedes the attack by days or weeks. A lookalike appearing is a warning that something is being prepared, and it is one of the few genuinely predictive signals available.
Defensive registration, within reason
Registering the most obvious variants and the common alternative top-level domains is cheap and worthwhile. Registering every possible permutation is not, because the space is effectively unbounded.
The sensible boundary is the variants a person might plausibly mistype or misread, plus anything targeting a payment or login subdomain. Beyond that, monitoring is the better investment than registration.
The same technique against package registries
Software dependency registries are targeted the same way: a package named almost identically to a popular one, waiting for a mistyped install command. The consequence is worse than a web visit, because installation frequently executes code at build time with whatever rights the pipeline holds.
The controls are different from the domain case: pinned dependency versions, a lockfile committed and reviewed, an internal package mirror, and review of newly added dependencies. A typo in a dependency name is far easier to miss in a pull request than in a browser address bar.
Where to start
Set up certificate transparency monitoring for your domain names. It is free, it takes minutes, and it turns lookalike registration into advance warning.
See domain spoofing. GuardsArm runs security risk assessments.
Related Terms
Phishing
Phishing is a social engineering attack where cybercriminals send fraudulent communications, typically emails, that appear to come from a trusted source. The goal is to trick recipients into revealing sensitive information, clicking malicious links, or downloading malware.
Domain Spoofing
Domain Spoofing is a technique where attackers forge or impersonate a legitimate domain name in emails or websites to deceive users into believing they are interacting with a trusted entity.
Social Engineering
Social engineering is a manipulation technique that exploits human psychology to trick people into making security mistakes or giving away sensitive information. It is the human element of cybersecurity attacks and often serves as the initial vector for more complex attacks.
Related Reading
The $4.5 Million Email: How Phishing Still Owns Healthcare
Phishing remains healthcare's most expensive attack vector, not because staff are careless but because the attacks are sophisticated and the…
MFA Won't Save You: Why Token Theft Is Healthcare's Next Crisis
Attackers don't need your password anymore. They're stealing session tokens after MFA approval, and healthcare organizations running Microsoft 365…
Deepfake Voice Fraud: Defending Approvals Against a Convincing Call
Voice cloning removed the last reason to trust a familiar voice. The process changes that work, and the awareness training that does not.
Speak With an Expert
Book a free consultation to discuss typosquatting for your organization.
Related Services
Need Help With Typosquatting?
Our certified security professionals can help you implement the right typosquatting strategy for your organization. Get a free assessment today.
Book a Free Consultation