Typosquatting is registering domains that differ from a brand's real domain by a typing error, so mistyped visits and careless clicks reach the attacker.
Typosquatting is the registration of domain names that copy a legitimate domain with a small typing mistake, such as a missing, doubled or swapped letter. These domains catch people who mistype an address, and they make phishing links harder to notice at a glance. They are used for phishing, ad revenue, malware and attempts to sell the domain back to the brand.
How it works
Using the fictional domain examplebank[.]com, common patterns are:
- Omission: exmplebank[.]com
- Doubling: examplebbank[.]com
- Transposition: exmaplebank[.]com
- Adjacent key: examplebsnk[.]com
- Missing dot: wwwexamplebank[.]com
- Different top-level domain: examplebank[.]co
Character swaps such as rn for m overlap with homograph attacks. Attackers generate variants automatically, register the ones still available, often with privacy protection, and frequently configure mail servers so the domain also receives misdirected email.
Example
An illustrative case: a fictional bank uses examplebank[.]com. An attacker registers examplbank[.]com, places a copy of the bank's login page on it and sends emails with that link. Readers who glance at the address see what they expect. The same domain also collects any email that customers or partners send to a mistyped address.
How to spot it
- The domain is one character away from the real one.
- The top-level domain differs from the one the brand normally uses.
- The domain was registered recently and hides its owner details.
- The site has a valid HTTPS certificate but no history.
- The domain has mail (MX) records although it has no business reason to receive mail.
What brands can do
- Generate and monitor typo variants of your main domains, and watch new registrations and certificates.
- Register the most obvious variants defensively and redirect them to your real site.
- Report variants used for phishing to the registrar and host for takedown; for parked domains that infringe your trademark, consider UDRP.
- Enforce DMARC on your own domains; it does not stop typo domains, but it closes the easier route of exact spoofing.
Phishvoid monitors and verifies typo domains aimed at your brand and handles takedowns where they are abused; contact the team to learn more. A longer explanation is in Typosquatting and homoglyph domains explained.
Read more: Typosquatting and Homoglyph Domains Explained
Seeing this against your brand?
We find and take down phishing and impersonation sites. Tell us what you are seeing.