Typosquatting
Registering domains with common misspellings of popular websites to capture traffic from users who mistype URLs in their browser.
Typosquatting, also known as URL hijacking, is a form of cybersquatting where attackers register domain names that are slight misspellings or typographical variations of popular, legitimate websites. When users accidentally mistype a URL — a common occurrence given the speed of modern browsing — they are directed to the attacker's site instead of their intended destination. These fraudulent domains are then used for phishing, malware distribution, advertising revenue generation, or brand impersonation.
Typosquatters employ various strategies to anticipate common errors. These include missing letters (gogle.com), adjacent key substitutions (goofle.com), transposed characters (googel.com), wrong top-level domains (google.cm), and added characters (googles.com). Sophisticated typosquatters register dozens or hundreds of variations for a single target domain, creating a wide net to capture misdirected traffic. Some also target domains likely to be misremembered or confused, such as registering a .com version of a .org site.
The threat from typosquatting extends beyond individual users. In software development, dependency confusion attacks exploit typosquatting in package managers — attackers publish malicious packages with names similar to popular libraries, and developers accidentally install the wrong one. For organizations, typosquatted domains can intercept sensitive communications, harvest employee credentials, and damage brand reputation. Proactive defense includes registering defensive domain variations, monitoring for typosquat registrations, and implementing browser-based protections that warn users about potentially deceptive URLs.
Typosquatters employ various strategies to anticipate common errors. These include missing letters (gogle.com), adjacent key substitutions (goofle.com), transposed characters (googel.com), wrong top-level domains (google.cm), and added characters (googles.com). Sophisticated typosquatters register dozens or hundreds of variations for a single target domain, creating a wide net to capture misdirected traffic. Some also target domains likely to be misremembered or confused, such as registering a .com version of a .org site.
The threat from typosquatting extends beyond individual users. In software development, dependency confusion attacks exploit typosquatting in package managers — attackers publish malicious packages with names similar to popular libraries, and developers accidentally install the wrong one. For organizations, typosquatted domains can intercept sensitive communications, harvest employee credentials, and damage brand reputation. Proactive defense includes registering defensive domain variations, monitoring for typosquat registrations, and implementing browser-based protections that warn users about potentially deceptive URLs.
Examples
- A user types "gooogle.com" and lands on a malicious site that mimics Google's login page.
- An attacker registers "microsfot.com" to distribute fake software updates containing malware.
- A malicious npm package named "lodahs" (misspelling of "lodash") is downloaded by developers and executes a crypto miner.
Prevention
- Register common misspellings and typo variations of your organization's domain names.
- Use domain monitoring services to detect and take down typosquatted domains targeting your brand.
- Encourage users to bookmark frequently visited sites rather than typing URLs manually.
- Implement browser extensions or DNS-level protections that warn about known typosquatting domains.