Definition
Typosquatting is a cyberattack where criminals deliberately register deceptive web addresses that closely mimic popular sites, waiting for users to make typing errors. When someone accidentally miskeys a URL, they are funneled into a look-alike fake site designed to harvest banking credentials, steal passwords, or install malware.
Traps Sprung by a Single Keystroke
Almost everyone has rushed to type a favorite search portal or shopping site only to drop a letter or strike an adjacent key. On a standard keyboard, aiming for 'o' and accidentally hitting 'p' or 'i' instantly creates a completely unintended web address.
Attackers carefully study these predictable slip-ups. They purchase common misspelled domain variations ahead of time and dress them up with fraudulent pages that look identical to the real ones.
Visitors often never realize they mistyped the URL, willingly typing sensitive passwords into a spoofed login prompt. This practice of buying up misspelled web addresses to ambush careless typists is called typosquatting.
Three Targets Behind the Fake Page
Cybercriminals buy misspelled brand domains with a few clear goals in mind. The most dangerous is phishing—luring users into fake banking or payment portals to swipe account numbers and passwords.
Another goal is malware distribution. Stumbling onto the wrong page can trigger drive-by downloads, silently planting spyware on your computer or encrypting your files with ransomware until you pay a bounty.
Finally, some attackers aim to profit from hijacked traffic or sell the domain back to the real company at an inflated price (cybersquatting). By siphoning off visitors bound for a popular site, they can bombard them with intrusive ads and pocket the ad revenue.
Look-Alikes and Deceptive Tricks
Beyond accidental keystrokes, attackers also rely on visual trickery using look-alike domains. Instead of relying on manual typing errors, these attacks trick users into clicking deceiving links. They swap characters that look identical at a glance, such as swapping lowercase 'l' with the number '1', 'rn' for 'm', or 'o' for the number '0'.
Some even launch IDN homograph attacks, which mix in foreign alphabets that look identical to Latin letters but represent completely different computer codes. While modern browsers filter many of these by displaying raw 'xn--' Punycode strings, some can still slip by or look legitimate in phishing emails, making visual detection nearly impossible.
To steer clear of these traps, avoid typing web addresses by hand for banking or critical portals. Instead, rely on trusted bookmarks or favorites. Never click unverified links, double-check the exact domain in your address bar before entering credentials, and use verified official apps whenever possible.
Common misconceptions
Typosquatting is just an accidental user typo, not an actual cyberattack.
It is a deliberate, premeditated attack where criminals register deceptive domains and build clone sites in advance to exploit human error.
Carefully double-checking the spelling in your address bar is 100% foolproof.
Some attacks use look-alike characters from other alphabets (homographs) that appear identical to the naked eye, making visual inspection alone insufficient.
Where you meet it
Hitting an adjacent key on your keyboard and accidentally typing 'goolge.com' or 'amazn.com' instead of the intended destination
Swapping letters with visual twins, such as replacing the letter 'o' with the number '0' in 'paypa1.com' or 'g00gle.com' to deceive users clicking links
In one sentence
A cyber trap that pre-registers misspelled web addresses to snatch users' personal information, credentials, or money when they mistype a URL.