What is Typosquatting? Everything you need to know and how to prevent it

Cybercriminals are getting more sophisticated with their approach to attempting phishing attacks. Typosquatting is one such technique where they make clever spelling alterations or typos to create lookalike domains to deceive visitors into believing they have landed on the official page.

What is Typosquatting?

Typosquatting is a social engineering tactic that targets internet users who unintentionally type incorrect URLs into their web browsers. This phishing technique tricks users into visiting cloned and fraudulent websites with URLs that are common misspellings of legitimate websites. 

Cybercriminals register these domains and emulate the look and feel of the original website whose clone they have created so that users don’t hesitate in sharing details or making financial transactions. The typosquat method is sometimes referred to as URL hijacking, domain mimicry, sting sites, etc. 

Real-Life Example of Typosquatting

In 1995, Michael Doughney grabbed the domain name PETA.org and registered it as a website for selling meats and leather goods. This, in fact, was the exact opposite of what PETA propagates, thus, the organization sued the domain owner over alleged trademark infringement, unfair competition, and cybersquatting.

The jurisdiction ruled in PETA’s favour and turned the name over to them. It’s since then registered as a .org site, and PETA.com redirects to the same.

Typosquatting Methods

Typosquatting domains are created using different forms of spelling alterations, with a range of techniques used by cybercriminals.

Typographical Errors

This means mistyping web addresses of common websites. For example, typing amazin.com instead of amazon.com.

Spelling Errors

Whenever you’re directed to a fake website, it’s not always a typing error. Some domain names are wrongly spelt. For example, ferarri.com instead of ferrari.com.

Alternative Spellings

Fake websites often use alternate spellings of popular brands to trick users into visiting their sites. For example; color.com instead of colour.com

False Domain Endings

You can choose to register from multiple top-level domains (TLDs) but unfortunately, so can cybercriminals. They take advantage of users’ commonly mistaken domain extensions to direct them to a cloned website. For example, using ‘.com’ instead of ‘.biz’.

Alternating the Country Code

Another typosquat technique involves changing a country code top-level domain from ‘.uk’ to ‘.us’ or from ‘.com’ to ‘.cm’. 

Typosquatting and Cybersquatting – What’s the Difference?

People often use the terms typosquatting and cybersquatting interchangeably, however, they aren’t the same. Typosquatting is buying a lookalike domain of a genuine website’s domain. For example, faecbook.com instead of facebook.com

On the other hand, cybersquatting involves purchasing domains of pre-established businesses that don’t own related websites. This is done so that buyers can sell these domains at higher prices in the future.

For example, if Red Sift doesn’t own the domain www.redsift2023.com, and it’s owned by a cybersquatter, we’ll have to pay them an amount to transfer the ownership to us.

What are the Dangers of Typosquatting?

Cybercriminals use domain finder tools to register for typographical error variations. Not all typosquatting efforts have criminal intentions, but most of them are attempted in bad faith. They create malicious websites and misdirect traffic towards them to install malware, steal credit/debit card details, phish confidential details, etc. 

Some of the common goals of developing typosquat websites include:

  • Bait and Switch: The fraudulent website claims to sell the same products and services as the original one, but customers never receive them on placing orders.
  • Domain Parking: Typosquatters register domains of popular brands and businesses only to resell them at higher prices.
  • Imitators: Cybercriminals develop cloned websites that look exactly like genuine ones. These mirror websites are used to attempt phishing attacks where users are asked to share sensitive details, make online transactions, or download malicious links. 
  • Joke Site: These are created to dampen targeted brands’ reputations by mocking them.
  • Related Search Results Listing: Owners drive traffic meant for a particular site to a competitor site and charge them on a pay-per-click basis.
  • Surveys and Giveaways: Such fake websites invite users by luring them in the name of exciting giveaways and cashback. They are asked to fill out participation forms armed to steal personal details.
  • Monetize Traffic: Typosquatters put up online advertisements and popups to make money from webpage visitors.
  • Affiliate Links: These are generally legal affiliate programs where traffic on the fake website is redirected to the official page. Typosquat domain owners earn a commission from all purchases made through this. 
  • Install Malware: Malware and adware are installed on visitors’ devices. They contain malicious codes that steal, intercept, and transfer data.

Is Typosquatting Illegal?

Typosquatting is illegal in the US under the 1999 Trademark Cyberpiracy Prevention Act. It’s regarded as an unlawful act to misdirect consumers to fraudulent websites or engage in typosquatting if the original website name is linked to a trademarked business. This allows official domain registrars to appeal to take down any website that meets typosquatting or cybersquatting criteria.

How to Prevent Typosquatting?

It’s vital to detect and take down lookalike domains as these can infect visitors’ devices with viruses that track keyboard strokes, intercept data or spy on your messages. Luckily, we’ve put together some basic measures to help you prevent being a victim of typosquatting.

Avoid Typos

Secure yourself from being a phishing attack victim by correctly entering the website name in the URL field. Recheck what you’ve typed before hitting the enter key. Also, double-check the address bar once you’ve landed on the website to ensure it isn’t a fraudulent one.

SSL Certificates

A website with an SSL certificate is indicated by a padlock sign. Refrain from visiting websites with no SSL certificate which means URLs beginning with HTTP instead of HTTPS. Never submit any confidential details or download links on unsecured websites. 

Spread Awareness

Combat typosquatting by raising awareness among your team members. Train them to utilize search engine or voice control and bookmark pages to avoid typos. Encourage them to trust websites with SSL certificates only. 

Register Your Website and Trademark

By registering your website and trademark, you get the power to file a Uniform Rapid Suspension (URS) lawsuit and take down websites fooling users away from your pages onto cloned pages. Moreover, you can register different spelling versions of your website like singular, plural, UK English, US English, hyphenated variants, etc.

Automate Domain Discovery and Takedown Fraudulent Websites

OnDOMAIN by Red Sift monitors 150 million newly registered domains and subdomains every day, allowing you to uncover any parked and forgotten domains, as well as impersonation sites. Once discovered, OnDOMAIN leverages existing relations with registrars and hosting providers to offer a phishing takedown service, drastically reducing the risk of typosquatting damaging your brand reputation.

PUBLISHED BY

Faisal Misle

19 May. 2023

SHARE ARTICLE:

Categories

Recent Posts

VIEW ALL
Email

The best tools to protect yourself from SubdoMailing

Francesca Rünger-Field

In late February 2024, ‘SubdoMailing’ became a trending search term overnight. Research by Guardio Labs uncovered a massive-scale phishing campaign that had been going on since at least 2022. At the time of reporting, the campaign had sent 5 million emails a day from more than 8,000 compromised domains and 13,000 subdomains with several…

Read more
Product Release

Red Sift’s Spring 2024 Quarterly Product Release

Francesca Rünger-Field

This early into 2024, the cybersecurity space is already buzzing with activity. Emerging standards, such as Google and Yahoo’s bulk sender requirements, mark a new era of compliance for businesses reliant on email communication. At the same time, the prevalence of sophisticated cyber threats, such as the SubdoMailing campaign, emphasizes the continual hurdles posed…

Read more
Email

Navigating the “SubdoMailing” attack: How Red Sift proactively identified and remediated a…

Rebecca Warren

In the world of cybersecurity, a new threat has emerged. Known as “SubdoMailing,” this new attack cunningly bypasses some of the safeguards that DMARC sets up to protect email integrity.  In this blog we will focus on how the strategic investments we have made at Red Sift allowed us to discover and protect against…

Read more
Email

Where are we now? One month of Google and Yahoo’s new requirements…

Rebecca Warren

As of March 1, 2024, we are one month into Google and Yahoo’s new requirements for bulk senders. Before these requirements went live, we used Red Sift’s BIMI Radar to understand global readiness, and the picture wasn’t pretty.  At the end of January 2024, one-third of global enterprises were bound to fail the new…

Read more