typosquatting

Typosquatting, also known as URL hijacking, is a form of cybersquatting in which attackers register domain names that closely resemble those of legitimate brands or trademarks. The goal is to capture traffic from users who mistype a URL, misplace a letter, or rely on visual similarities, and to exploit trust or confusion for fraudulent purposes.

Common variants include simple misspellings (for example, missing or extra letters), transpositions, substitutions with nearby keyboard keys, and homoglyph substitutions where letters look alike. More sophisticated forms may involve bit-level variations (bitsquatting) or registrar-level strategies that target search results or brand terms. Some actors operate multiple near-miss domains to maximize exposure.

Risks include brand damage, consumer confusion, phishing, malware distribution, and revenue loss. Visitors may be redirected to counterfeit storefronts, credential-stealing pages, or deceptive ads, undermining user trust and harming the original brand’s reputation.

Defenses combine technical, legal, and operational measures. Organizations monitor for misspellings of their domains, register common variants, and use DNS security extensions, HTTPS, and content-security policies. Search engines and registrars may suspend suspicious domains or issue warnings. Legal remedies under trademark law or statutes such as anti-cybersquatting provisions can be pursued in some jurisdictions. User education and incident response planning also reduce risk by enabling faster detection and remediation.

Detection typically relies on domain surveillance, WHOIS analysis, and machine learning to identify suspicious registrations and traffic patterns. Typosquatting remains a persistent challenge in brand protection and cybersecurity, requiring ongoing vigilance and multi-layered defense.