Menu

Typosquatting

Typosquatting

Typosquatting: How One Wrong Letter Can Send Customers to a Scam

< BLOG

Typosquatting Attacks: How One Wrong Letter Enables Phishing

The human brain associates quickly so it’s not too hard to mistakenly think you are dealing with a business you know and trust. This is where typosquatting lives and it’s a growing issue.

Typosquatting: One small typo. One big problem

A customer says they received an email from your business. A supplier has been asked to change bank details. Someone has found a website that uses your logo, colours, and company name, but the address is slightly wrong.

You look at the domain and see the difference immediately. Your customer did not.

That is the point of typosquatting. The attacker does not need to perfectly copy your website address. They only need an address close enough to exploit a hurried click, a mobile screen, an autocomplete mistake, or one letter typed in the wrong order.

Understanding the term helps, but it does not protect your brand or remove the fraudulent domain. That is why we built The TLD Project: to help businesses identify suspicious brand-related domains and take professional action.

The DNA of Typosquatting

Typosquatting is a domain impersonation technique in which an attacker registers a web address that closely resembles a genuine one. It relies on people making a typographical error when entering a website address, often directing them to an alternative and potentially malicious site.

The simplest example is a transposed letter:

  • Genuine domain: yourcompany.com
  • Typosquatted domain: yourcompnay.com

But attackers have many other variations available:

  • A missing letter: yourcompny.com
  • An added letter: yourccompany.com
  • A repeated letter: yourcompanyy.com
  • A substituted letter: yourcompanv.com
  • A hyphenated version: your-company.com
  • A different ending: yourcompany.co, yourcompany.shop, or yourcompany.site
  • A keyboard-neighbour error: yourcompany.com becoming a domain with an adjacent-key substitution

Some variations are obvious when you compare them side by side. Others are not. A customer reading an email quickly, especially on a phone, may see your business name and assume the link is genuine.

What can a typosquatted domain do?

A typosquatted domain can be used in several ways. It may simply redirect visitors elsewhere, display adverts, or remain inactive while the attacker prepares a campaign. More serious cases involve a cloned website or a fake login page built to capture passwords, card details, personal information, or payment data.

An attacker may also use the domain to send emails that appear to come from your business. For example, accounts@yourcompnay.com looks close enough to accounts@yourcompany.com to fool a busy recipient. The email might request payment, ask a supplier to update bank details, or direct a customer to a fraudulent sign-in page.

This is where typosquatting overlaps with phishing. Phishing is the act of deceiving someone into revealing sensitive personal, corporate, or financial information through fraudulent messages or copycat websites.

A fraudulent domain does not have to show an obvious scam page to be dangerous. It could be configured for email only, redirect visitors based on location, or display harmless content until the attacker begins sending messages.

Why businesses should care

Typosquatting turns normal human error into a business risk. The consequences can include:

  • Customers giving passwords or payment details to criminals.
  • Fake invoices, payment-diversion fraud, and supplier impersonation.
  • Lost sales when customers reach a fake or competing website.
  • Complaints and reputational damage linked to an attack you did not create.
  • Staff accounts being targeted through fake Microsoft 365, Google Workspace, payroll, or customer portal pages.
  • More than one fraudulent domain registered around the same brand.

The threat is not limited to large household names. Any business with a recognisable name, customer base, payment process, login area, or supplier network can be imitated.

What to do

If you identify a possible typosquatting domain, preserve evidence before it changes. Record the full address, take screenshots, save suspicious emails with their headers, and note dates, redirects, copied content, and any branding used.

Do not enter credentials, payment details, or other information into the suspicious site to test it. Instead, assess whether the domain is being used for a website, email, redirect, phishing page, or another form of impersonation.

Then monitor related variations. Attackers commonly register more than one domain because they are testing several ways customers might mistype, misread, or trust your name.

The TLD Project helps businesses monitor domain variations across TLDs, identify potential impersonation risks, gather evidence, and begin the takedown process.

Typosquatting
The TLD Project: Empowering everyone to take professional action.

Typosquatting Impersonation Phishing

Typosquatting Impersonation Phishing

< BLOG

Typosquatting Impersonation Phishing?

Confused is an Understatement.

All you know is that someone has copied your website under a similar address and sending out emails to target your customers and other unsuspecting people. Now you’re getting tech language you don’t understand and cannot begin to learn.

Sure we can try to explain this, but that’s not going to solve the issue of typosquatting impersonation phishing right now – that is why we built The TLD Project – to let everyday businesses take action.

Typosquatting Impersonation Phishing

Typosquatting is when someone deliberately buys a web address that is extremely similar to a well-known, trusted website, hoping people will make a small typing mistake and land there instead.

Imagine you want to visit examplebank.co.uk, but accidentally type exampelbank.co.uk, example-bank.co.uk, or perhaps the right name with the wrong ending, such as .com rather than .co.uk. A criminal may have registered one or more of those near-identical addresses. That is Typosquatting: taking advantage of ordinary human typing errors.

It is similar to opening a fake shop next door to a popular high-street retailer, using a nearly identical sign. From a quick glance, customers might assume they are in the right place. Online, the “sign” is the web address, also called a domain name or URL. A Typosquatting Impersonation Phishing site may copy the real company’s logo, colours, page layout, product names, and even login screen. It can look professional and convincing while being entirely fraudulent. Attackers commonly use omitted, repeated, swapped, or visually similar characters, as well as different domain endings, to create these misleading web addresses.

For example, a criminal might register a version of a business name with one letter repeated, a letter missing, two letters transposed, or a hyphen inserted. They may also choose a letter from another alphabet that looks almost identical to an English letter. To a busy customer reading quickly on a mobile phone, the difference may be almost invisible.

The aim of Typosquatting Impersonation Phishing varies. Sometimes the attacker wants a visitor to enter a username, password, card number, or other private information into a convincing fake website. In that case, Typosquatting supports Phishing. In other cases, the website may show misleading adverts, promote counterfeit goods, install harmful software, redirect people elsewhere, or simply collect information about visitors. A domain may even be held for commercial pressure: someone registers a close match to a brand’s name and later tries to sell it to the legitimate business.

Typosquatting Impersonation Phishing is not exactly the same as Impersonation, although the two often overlap. Typosquatting refers specifically to the deceptive web address. Impersonation is broader: it means pretending to be a person, company, or service that one is not. A Typosquatting domain becomes part of an Impersonation attack when it is used to imitate the genuine organisation.

The practical lesson is simple: do not rely only on a familiar logo or a polished-looking page. Check the full web address, particularly before signing in, paying, downloading something, or sharing personal information. If an email or text asks you to act urgently, avoid using its link; instead, open a new browser tab and visit the company through a saved bookmark, a trusted search result, or an address you know is correct. That small pause can stop a Typosquatting Impersonation Phishing mistake becoming a Phishing incident.

Typosquatting Impersonation Phishing
The TLD Project: Empowering everyone to take professional action.