Typosquatting

Typosquatting is the practice of registering a domain name that closely resembles a legitimate brand's domain, exploiting common typing mistakes, visually similar characters, or alternate top-level domains to trick users into visiting a fraudulent site. Common patterns include swapping adjacent keyboard letters, adding or removing a hyphen, substituting the letter O for a zero, using a different top-level domain such as .cm instead of .com, or using internationalized characters that render nearly identically to the original.

The motivations behind typosquatting range from opportunistic ad-revenue capture on mistyped traffic to targeted, high-effort phishing campaigns designed to harvest employee or customer credentials. In a corporate context, the more damaging pattern is deliberate brand impersonation: an attacker registers a lookalike domain, builds a convincing clone of a company's login page or invoice portal, and uses it in phishing emails sent to employees, customers or partners. Because the domain looks close enough to the real one at a glance, even security-aware users can be fooled, especially on mobile devices where the full URL is often truncated or hidden.

Typosquatting is also used to support business email compromise. An attacker registers a domain that differs from a real vendor's domain by a single character, then uses it to send fraudulent invoice or payment-redirect emails that appear to come from a trusted supplier. Because the visual difference is subtle, these attacks frequently succeed even against finance teams trained to be cautious.

Detecting typosquatting requires continuously monitoring newly registered domains and certificate transparency logs for names that are visually or phonetically similar to an organization's own brand and known partner brands, then checking whether those domains are actively hosting content, resolving mail servers, or otherwise being prepared for use in a campaign. Because thousands of new domains are registered every day, effective monitoring needs to be automated and continuous rather than a manual, periodic search.

Once a malicious lookalike domain is identified, the typical response is a takedown request to the registrar or hosting provider, combined with internal alerting so that security teams can watch for phishing emails referencing the domain and, where relevant, notify customers or partners who might be targeted. Because typosquatting campaigns are often set up well before they are used, early detection of a newly registered lookalike domain, even before it hosts any content, gives defenders a meaningful head start over waiting for the first phishing email to be reported.