Typosquatting

Typosquatting, also called URL hijacking, relies on ordinary human error. A user types the wrong address, or reads a link too quickly, and lands on a site the attacker controls. The attacker chooses names that are easy to confuse with the real one: a transposed pair of letters, an omitted letter, a doubled letter, a hyphen, or the same name under a different top-level domain.

The sites behind these domains are used for several purposes. Common ones are credential phishing pages that copy the real login screen, malware downloads, advertising revenue from misdirected traffic, and email sent from the lookalike domain to impersonate the organisation to its customers and suppliers.

A lookalike domain is the wider category. It includes typosquats, but also homoglyph domains that swap characters for visually similar ones, and domains that add a trusted word such as login or support to a brand name. Typosquatting is the subset that depends on a mistyped address rather than on a deceptive one.

Typosquatting is related to cybersquatting but is not the same. Cybersquatting is registering a name that matches a brand in order to sell it back or profit from it, while a typosquat targets a misspelling. In the UK, a brand owner can pursue both through trade mark claims, passing off and the Nominet dispute resolution service for .uk names, although none of these routes is quick.

Defence starts with knowing which lookalikes exist. Organisations register the most obvious variants of their own domain, publish strict email authentication (SPF, DKIM and DMARC) so the real domain cannot be spoofed, and monitor for new registrations that resemble their brand. When a live malicious domain is found, the usual steps are to preserve evidence and send abuse reports to the registrar and the host.

EdgeProtect, Precursor Security’s platform, runs continuous lookalike-domain discovery for the domains you add: it finds likely variants of your name and records whether each is registered and can receive email.