What is Typosquatting?
Typosquatting, also known as “URL hijacking,” is a form of cybersquatting where someone registers domain names that are misspellings of popular websites, hoping visitors who mistype an address will land on the fake site. Typosquatters use these look-alike domains to steal traffic, phish for personal information, spread malware, or earn ad revenue.
More About Typosquatting
Typosquatting is a form of cybersquatting that occurs when a bad actor registers a domain name that’s a near-miss spelling of a popular one, counting on visitors to mistype the address and land on the fake site instead of the real one.
Typosquatters register these domains for several reasons: to siphon traffic from the legitimate site, to phish visitors for passwords or payment details, to install malware or adware, to earn ad or affiliate revenue from the mistyped traffic, to harvest misaddressed email, or to sell the typo domain back to the brand owner.
Common typosquatting patterns
Almost every typo domain uses one of a few patterns, all documented in real registrations:
- Character omission: gogle.com instead of google.com
- Doubled or added letters: gooogle.com and faacebook.com
- Transposed letters: micrsoft.com instead of microsoft.com
- Character substitution: paypa1.com, with the number 1 standing in for the letter “l”
- Added or dropped hyphens: face-book.com
- A different domain extension: the same name ending in .co, .cm, or .om instead of .com
What sits at those addresses varies. Many are lookalike login pages that copy a brand’s design to steal credentials: in February 2026, researchers at the monitoring service Have I Been Squatted reported a phishing campaign that used lookalike domains impersonating logistics services to steal more than 1,600 credentials. Others push software. Goggle.com, the one-letter typo of google.com, was serving malware through drive-by downloads when security firm McAfee featured it in a 2006 web safety campaign, and it drifted through adware and redirect phases for years afterward; as of August 2026 the domain is no longer operational, per Wikipedia’s typosquatting entry. The rest simply run ads or affiliate links and collect money from every mistyped visit.
Typosquatting vs. cybersquatting
Cybersquatting is the umbrella term, and typosquatting is one technique inside it:
- Cybersquatting: registering a domain that matches someone else’s brand or trademark in bad faith, whether to resell it, block it, or trade on its reputation.
- Typosquatting: the subtype that targets typing mistakes by registering misspellings of the brand’s domain rather than the name itself.
The dividing line is the typing mistake. Registering your exact brand under some unrelated extension is generally plain cybersquatting, but an extension chosen to catch a predictable slip, like .co or .cm in place of .com, counts as typosquatting too.
Is typosquatting illegal?
In the United States, yes, when it’s done in bad faith against a trademark. Courts have interpreted the Anticybersquatting Consumer Protection Act (ACPA) as prohibiting typosquatting, and the law lets trademark owners claim statutory damages of $1,000 to $100,000 per domain name.
Brand owners can also file a UDRP complaint instead of going to court. Under ICANN’s Uniform Domain-Name Dispute-Resolution Policy (UDRP), in force since October 1999, you file with an approved provider such as the World Intellectual Property Organization, and if you win, the registrar cancels or transfers the domain. The same Wikipedia entry credits Lego alone with spending roughly $500,000 to take 309 cases through UDRP proceedings. One scope limit: the UDRP binds registrars for generic TLDs like .com, while country-code TLDs set their own dispute rules.
How to protect your domain
You can’t buy every possible typo, and you don’t need to. Cover the likely ones and make the rest easy to fight:
- Register the highest-risk variants of your domain: single-letter omissions, doubled letters, adjacent-key typos, and the most common alternate extensions. Apple, Google, Facebook, and Microsoft all register typo variations of their domains or block them through ICANN services, and building a domain portfolio is the same play at any scale.
- Point every defensive domain at your real site with a 301 redirect. A parked defensive domain may still catch mistyped visits, but it won’t send those visitors to your real site; the redirect is what turns a mistake into a normal visit.
- Monitor for lookalike registrations you don’t own, so a squatted variant shows up before your customers find it.
- If a squatter beat you to a name, file a UDRP complaint or an ACPA claim instead of paying their asking price.
The domain itself is a defense, too. A short name with no hyphens or sound-alike spellings gives typosquatters fewer mistakes to work with, so weigh typo risk when you choose a domain, not just branding.
Protecting yourself as a visitor
Bookmark the sites you sign in to and use the bookmarks instead of retyping addresses. Let a password manager fill your logins; it matches the exact domain and won’t autofill on a lookalike. And check the address bar before entering payment or personal details, because one letter is the entire disguise.
Frequently Asked Questions
How do I find out if someone is typosquatting my domain?
Generate the likely typo variants of your domain (omissions, doubled letters, swapped keys) and look up each one’s WHOIS record, or run your domain through a lookalike-domain monitor such as Have I Been Squatted. Pay closest attention to variants that resolve to live sites or accept email.
What’s the difference between typosquatting and combosquatting?
Combosquatting doesn’t rely on a typo: it appends an extra, plausible-looking word to the real brand name and waits for phishing links to do the work. Typosquatting counts on you mistyping the address yourself. A related trick, the doppelganger domain, just drops a period from a subdomain address.
How many typo domains should I register?
There’s no magic number. Cover single-letter omissions, doubled letters, and adjacent-key errors for your main name, plus 1 or 2 common alternate extensions. Google, for example, bought googel.com and gooogle.com. A few extra registrations cost far less than a dispute proceeding.
Can typosquatters intercept my email?
Yes. A typo domain set up with a mail server receives any message whose address was mistyped, and harvesting misaddressed email is a documented typosquatter motive. Double-check recipients before sending sensitive attachments, and consider registering the common typos of your own email domain.
