Skip to content
SecTepeMit Sicherheit gut aufgestellt!
DE
Glossary

Typosquatting: Meaning, Methods, Examples and Protection

What is typosquatting? How fraudsters use typo domains, methods such as homographs and combosquatting, examples, legal options and protection for companies.

Definition: Typosquatting is the registration of domains that look confusingly similar to well-known addresses, usually through common typos or similar-looking characters. Attackers use these domains to lure users to fake websites, steal login data, spread malware or intercept email.

What Is Typosquatting?

A "typo" is a typing mistake, and "squatting" means occupying something without the right to it. Typosquatters grab domains that come from typos. They count on people mistyping or not seeing the difference.

An example: anyone who types "samplebnak.com" in a hurry instead of "samplebank.com" may land on a copy of the bank's site that looks real. If they enter their login data there, the fraudsters have it.

Typosquatting is a form of cybersquatting, which means grabbing other people's names on the internet.

Methods Used by Typosquatters

  • Typos: a missing, doubled or swapped letter, such as "exaample" or "exmaple".
  • Neighboring keys: a letter that sits next to the right one on the keyboard, such as "exsmple", because "s" is next to "a".
  • Missing dot: "wwwexample.com" instead of "www.example.com".
  • Different ending: ".co", ".cm" or ".net" instead of ".com".
  • Similar characters: "rn" instead of "m" or the digit "0" instead of the letter "O".
  • Homographs: letters from other alphabets that look the same, such as a Cyrillic "а".
  • Combosquatting: an extra word added to the real name, such as "example-login.com" or "example-support.com".
  • Bitsquatting: domains that can come from a single flipped bit in hardware. Rare, but it does happen.

What Attackers Use Typo Domains For

  • Phishing: a fake login page collects passwords and credit card data. See phishing.
  • Fake email: senders like "accounts@examp1e.com" are easy to miss in an inbox. Many cases of spear phishing and CEO fraud start this way.
  • Catching mail sent by mistake: anyone who mistypes the address sends private data straight to the typosquatter.
  • Malware: the site offers a fake update or download.
  • Ads and redirects: less harmful, but annoying: the domain shows ads or redirects to a competitor.
  • Extortion: the owner offers the domain to the real company at a high price.

Typosquatting in Software Packages

Typosquatting is not just about domains. In public stores for code packages, attackers publish packages with names that look like popular ones. A developer mistypes when installing and pulls bad code into the project.

A well-known example is the "crossenv" package, which appeared in the npm registry in 2017. It copied the name of the popular "cross-env" package and stole settings that held login data. Such attacks are a form of supply chain attack.

Impact on Companies

  • Stolen login data: from customers and staff.
  • Financial loss: for example through fake invoices with changed bank details.
  • Data leaks: through email sent to typo domains by mistake.
  • Damage to reputation: customers link the fraud to your brand.
  • Effort: for support, legal steps and getting the domains taken down.

Detecting Typosquatting

  • Read the address carefully: letter by letter, especially for links in email.
  • Watch new domains: services tell you when someone registers a domain that looks like your brand.
  • Check certificate logs: public certificate logs show when someone requests a TLS certificate for a similar domain.
  • Check email: an email gateway can spot sender domains that look almost like real ones.

Protective Measures for Companies

  • Register them yourself: buy the most likely typo versions and endings of your main domain.
  • Monitor your brand: keep watching for new domains and certificates with your name.
  • Secure your email: set up SPF, DKIM and DMARC for your own domain. This does not stop lookalike domains, but it stops misuse of your real one.
  • Filter incoming mail: the SecTepe Mail Security Gateway spots domains that look almost like real ones, even with letters from other alphabets. Its recipient check also spots typos in the domains of outgoing mail and can hold a message until the sender confirms it.
  • Train staff: check links and senders carefully, and ask if in doubt.
  • Use password managers: they only fill in login data on the real domain. On a typo domain, the field stays empty, which is a good warning sign.
  • Check packages: spell package names in code projects exactly and check that they are real.

Legal Steps

Typosquatting can break trademark and name rights. Anyone who uses a domain for fraud commits a crime. Owners of a brand have several options:

  • Report to the registrar or host: many quickly take down domains that are clearly used for phishing.
  • Arbitration: for many international endings such as .com, there is the UDRP procedure, for example at WIPO.
  • .de domains: a dispute entry at DENIC prevents the domain from being passed on during a dispute.
  • Court action: for example a cease-and-desist claim based on trademark or name rights.

Conclusion

Typosquatting uses small typos and similar-looking characters to lure users to the wrong sites or to intercept email. Companies protect themselves best by registering typo domains themselves, watching their brand, using an email gateway that spots lookalike domains and training staff.

FAQ about Typosquatting

What is typosquatting in simple terms?

In typosquatting, fraudsters register domains that differ from real addresses by just a typo, such as exmaple.com instead of example.com. Anyone who mistypes lands on their site. There, phishing, malware or ads are waiting.

Where does the term typosquatting come from?

A "typo" is a typing mistake. "Squatting" means occupying a place without the right to it. Typosquatters "occupy" addresses that come about through typos. The general term for occupying other people's names is cybersquatting or domain squatting.

What is the difference between typosquatting and cybersquatting?

Cybersquatting generally means registering a domain with someone else's brand or company name, often to sell it on at a high price. Typosquatting is one form of it. It deliberately uses typos and similar-looking spellings.

What is a homograph attack?

Here, letters are replaced by characters from other alphabets that look the same. A Cyrillic "а" looks like a Latin "a", but to a computer it is a different character. This creates a domain that looks almost identical to the real one in the browser.

Is typosquatting illegal?

Registering such a domain is not automatically a crime. But it can infringe trademark and name rights. Anyone who uses the domain for phishing or fraud commits a crime. Rights holders can reclaim the domain, for example through an arbitration procedure at WIPO or a dispute entry at DENIC for .de domains.

How do companies protect themselves against typosquatting?

With a mix of measures: register key typo domains themselves, watch for new registrations of similar domains, check incoming email for lookalike sender domains and train staff. Fraudulent domains that are found can be reported to the registrar or host and taken down.

More terms in “Awareness & Social Engineering”

All terms in “Awareness & Social Engineering” →