Typosquatting.

What is typosquatting?

Typosquatting means registering a domain that is close to a real one. The attacker hopes that a person will mistype the address, or will not notice the difference when they click a link. The name comes from the typing mistakes it relies on, but the same idea covers other kinds of look-alike names.

How does it work?

MITRE ATT&CK describes attackers choosing domains that are similar to legitimate domains. It names two ways of doing this: look-alike characters, called homoglyphs, and a different top-level domain, which is the ending of the address, such as .com or .net. MITRE also describes internationalized domain name homograph attacks. These use characters from other writing systems, such as Cyrillic or Greek, to build names that look the same to the eye.

Common patterns include:

• A missing, doubled or swapped letter.
• A different ending in place of the real one.
• A letter replaced by a similar-looking character.
• Extra words added to the name, such as login or support.

Once the domain exists, it can be used for different goals. MITRE places this behavior in the stage where attackers prepare their tools, before the attack itself. A simple illustration: a fake page that copies a real login page, on an address that differs from the real one by one letter.

Why does it matter?

People trust a name they recognize and rarely read an address letter by letter. A convincing look-alike can turn a small typing mistake or a quick glance into a lost password, and it can be used to deliver malware. The domain belongs to the attacker, so your own network tools may never see it. MITRE notes that this activity happens outside the reach of enterprise defenses, which is why it is hard to prevent with ordinary controls. The harm can land on your customers and on trust in your brand.

How can you detect and reduce it?

MITRE lists one mitigation for this technique: organizations may register similar domains to their own on purpose, to discourage attackers from taking them. You cannot register every variant, so detection matters too. MITRE says detection can rely on watching DNS registration data and public WHOIS records to find newly registered domains that look like legitimate ones. It also warns that reputation or category based detection may be difficult until the new domain has been categorized.

A practical routine can include these steps:

• List the names you want to protect, including product and brand names.
• Check new registrations for names close to them.
• Look at what each suspicious domain hosts.
• Report harmful ones to the registrar or the hosting provider.

Is typosquatting the same as phishing?

No. Typosquatting is the registering of a look-alike domain. Phishing is the message or page that tries to trick a person into giving up information. A typosquatted domain is often used to host a phishing page, but the two can exist apart: a look-alike domain may sit unused, and phishing can use other addresses.

Is typosquatting the same as brand impersonation?

Not quite. Brand impersonation is the wider problem of pretending to be a company, including fake social media accounts and fake apps. A look-alike domain is one way to do it.

Brandefense Phishing Monitoring & Domain Abuse monitors for look-alike domains.

Related pages in the Knowledge Hub

• Phishing and lookalike domains
• Brand impersonation takedown