What is typosquatting?
Typosquatting, also called URL hijacking, is registering a domain name that differs from a real one by a small error, then using it to catch people who mistype the address or don't read it closely. Someone who types exmaple.com instead of example.com lands on the attacker's site, and an email from examp1e.com can pass a quick glance. The same trick works in software repositories, where a malicious package takes a name one keystroke away from a popular library.
Typosquatting doesn't change DNS or break into anything. The attacker simply owns a name that looks like yours, which is why it pairs so well with phishing and business email compromise.
Common typosquatting patterns
| Pattern | Example |
|---|---|
| Missing letter | exmple.com |
| Swapped letters | exmaple.com |
| Look-alike character | examp1e.com, with the digit 1 in place of l |
| Doubled letter | exammple.com |
| Different top-level domain | example.co, example.cm |
| Missing dot | wwwexample.com |
| Added word or hyphen | example-support.com, example-login.com |
Letter pairs can also stand in for a single letter, as in rnicrosoft.com, where r and n read as m. A related technique, the homograph attack, uses characters from other alphabets, such as a Cyrillic letter identical to the Latin a, which the domain system encodes as a name beginning with xn--. Domains that add a word, like the last row, are sometimes called combosquatting.
How attackers use typosquatted names
- Phishing pages: a cloned sign-in page on a look-alike domain harvests credentials from people who clicked or mistyped.
- Business email compromise: an email from
elena.brooks@examp1e.comasks accounts payable to change a supplier's bank details. Because the attacker ownsexamp1e.com, the message can pass SPF, DKIM and DMARC; those checks prove only that it came from the look-alike domain. - Malware downloads: a fake download site for a popular tool serves a trojanized installer.
- Misdirected email: a missing-dot or wrong-TLD domain with a mail server quietly receives messages meant for the real company.
- Malicious packages: in 2017 an npm package named crossenv imitated the popular cross-env and sent developers' environment variables, often full of credentials, to its author.
- Ad revenue and resale: parking ads on the domain or selling it back to the brand owner.
Defending against typosquatting
- Defensive registration: register common misspellings and key top-level domains of your own name and redirect them to the real site.
- Brand and domain monitoring: watch new domain registrations and certificate transparency logs for names close to yours, then pursue takedown through the registrar or ICANN's Uniform Domain-Name Dispute-Resolution Policy (UDRP).
- Filtering: DNS and web filters that block newly registered and low-reputation domains, and mail gateways that flag look-alike sender domains and tag external mail.
- User habits: read the registered domain from the right, use bookmarks, and let a password manager fill credentials, since it won't autofill on a domain it doesn't recognize.
- Phishing-resistant MFA: FIDO2 security keys and passkeys are bound to the real domain and won't sign in to a look-alike.
- Developers: copy package names from official documentation, pin dependencies and use a vetted internal registry.
Typosquatting vs. DNS attacks
DNS hijacking changes where a real domain points, by taking over the registrar account, the name server records or a device's resolver setting. DNS cache poisoning plants false records in a resolver. Both send users who typed the correct name to the wrong place. Typosquatting leaves DNS untouched: the attacker's domain is real and resolves correctly, and the victim's mistake does the redirecting. Cybersquatting is the broader practice of registering a domain that matches someone else's trademark, often to sell it back.
Typosquatting on the CompTIA Security+ exam
SY0-801 no longer lists typosquatting by name, but the technique still shows up in two places: look-alike sender or link domains as signs of phishing or business email compromise under objective 2.5, and malicious packages named one typo away from a popular one under the public-repository risks in objective 2.4. Scenario wording such as "a domain one character off", "registered a misspelled version of the company's domain" or "users who mistyped the address" points to typosquatting. Distractors include DNS poisoning and DNS hijacking, which alter how the real name resolves, and domain spoofing, which forges the real domain in the From header and fails DMARC where it is enforced. The best defenses are defensive registration, domain monitoring and user awareness.