Term
Typosquatting
Registering domains that differ from a known brand by a small typo or a different extension to catch mistyped visits or deceive in phishing. A company can defend itself by registering similar domains and monitoring new registrations.
Updated
What it means
Typosquatting is registering domain names that differ from a well-known brand by a small typo, swapped letters or a different extension. The aim is to catch visitors who mistype the address or to deceive people in phishing e-mails, where the difference is easy to miss.
Examples include a missing or doubled letter, look-alike characters, an added hyphen or the same name registered under another extension, such as .com instead of .sk. More advanced variants use characters from other alphabets that look almost identical to Latin ones.
Typosquatting is often part of spoofing. On a look-alike domain the fraudster sets up a fake website or an e-mail address that appears to be the company's and obtains login details, payments or sensitive information from customers or employees.
How it works in practice
A company can defend itself by pre-emptively registering the most common typos and variants of its domain under different extensions and redirecting them to the main site. It need not register everything but should cover the variants most likely to confuse customers.
Monitoring new registrations of domains similar to the company name is useful. Domain monitoring services alert the company when someone registers a suspicious variant, so it can warn clients in time or take steps to have it blocked. Setting up SPF, DKIM and DMARC also helps.
A company with a registered trademark is in a stronger position in domain disputes. For some extensions there are out-of-court dispute resolution procedures that make it possible to recover an abused domain faster and more cheaply than through ordinary litigation.
What to watch out for
Staff should be trained to check the exact sender address and domain in e-mails and links, especially with requests for payment or login. A single click on a fraudulent link can leak access credentials to company systems.
Typosquatting can also damage the company's reputation if customers lose money on a fake site and associate it with the real brand. When a fraudulent domain is discovered, it is wise to warn customers quickly, report the domain to the registrar and, if necessary, to the police.
Need the term explained on your own situation? Consulting from €55 / hour excl. VAT, depending on topic and complexity.