Typosquatting explained: how it works, examples, and how to prevent it

If you’ve ever typed a web address slightly wrong and ended up somewhere unexpected, you’ve likely encountered a cyberattack known as typosquatting.

The goal of typosquatting is to trick people who mistype a web address or don’t notice small errors into landing on a fake website instead of the real one. Such domains rely entirely on human error rather than a technical vulnerability, which is exactly why they’re so effective.

This guide covers how typosquatting works, its most common types, and how to avoid being fooled by it.

Typosquatting is a social engineering attack where cybercriminals register domain names that closely mimic legitimate websites, often by including a common typo or misspelling. For example, a legitimate domain is “amazon.com,” but its typosquatted variation could look like “amaz0n.com,” with a “zero” replacing the letter “o.”

Malicious actors register these lookalike domains, hoping internet users will visit them by mistake, most often due to a simple spelling slip or typing error, such as hitting an extra letter or missing one. Webpage visitors rarely double-check the address bar, so a fake domain that looks close enough to the real one is easy to miss, especially when you’re typing fast. 

This tactic is also known as URL hijacking. Its main aim is to intercept traffic meant for a legitimate domain name and redirect it elsewhere.

A typosquatting attack works in three steps:

Criminals create typosquatting sites through a handful of common techniques:

Not every typosquatting website exists for the same reason:

A few real cases show how pervasive typosquatting can be.

Typosquatting and cybersquatting are often used interchangeably, but they’re not quite the same thing. Typosquatting involves domains that closely resemble a legitimate website but specifically have a typo or misspelling. These domains target users who land on them by mistake, tricking them into installing malware or falling for phishing scams.

Cybersquatting, on the other hand, means registering a domain tied to an existing brand or trademark. No typo or misspelling needs to be present.

An example of a cybersquatting domain can be amazon-2.com. No typo is present — it’s just difficult for users to tell if it’s a suspicious page or a genuine alternative website that’s still run by Amazon. The goal of cybersquatting can still be to deceive users, but it’s often also to profit off the brand’s reputation and simply resell the domain to its rightful owner.

Typosquatting is a type of cybersquatting that specifically relies on typos and misspellings. Typosquatting domains target user mistakes, while cybersquatting largely targets general brand confusion.

Visiting malicious websites can put your funds, accounts, and devices at risk, depending on what the site is built to do. Here are the biggest risks:

Many typosquatted sites look like login pages for services you already use, such as a bank, social media platform, or online shopping site. 

If you type in your username and password, that information goes straight to the attacker instead of the real company. From there, they can log into your account. If you rarely change your password or reuse the same password across multiple sites, the risk might extend beyond a single account. 

Typosquatting helps some fake sites spoof real checkout or payment pages. If you enter a credit card number or bank details thinking you’re paying for something real, that data can be used to make unauthorized charges or drain your account. 

And this spoofing can lead to sizable losses. FBI crime statistics on spoofing indicate that cybercriminals have stolen over $777 million in spoofing attacks since 2018. Because these pages often look legitimate, people don’t always realize anything’s wrong until they see a strange transaction later.

Instead of asking for information directly, some typosquatting domains try to trick you into clicking malicious links and downloading something like a mandatory update or a file disguised as something you were looking for. 

Once installed, that software can do anything from logging your keystrokes to opening the door to identity theft, giving an attacker enough personal data to cause real damage.

A typosquatting site is often the first step in a bigger phishing attack. It can steal personal information you enter, like your email address or phone number, and then send fake alerts warning that your account is locked, tricking you into sharing more info or giving up access to your account. Scammers can even rely on individualized spear phishing campaigns to specifically target the sites you’re most likely to visit.

Since it all starts with a familiar-looking domain, people think they’re on a genuine site and tend to let their guard down until it’s too late. And the numbers highlight just how dangerous phishing has become. FBI crime data on phishing shows that over $326 million has been lost to these attacks since 2015. 

Fake domains also leave a mark on the legitimate brand they’re copying.

If a customer gets scammed on a lookalike site, they usually remember having a bad experience with that company and not the random domain that actually tricked them. That memory sticks around, even though the business never controlled the fake site to begin with.

You can’t stop someone from registering a lookalike domain, but you can make it a lot harder for one to fool you.

Here’s how: 

If you’re already on a typosquatted website, do the following:

Typosquatting relies on victims rushing as they type, but a couple of small habits can help protect you from it. Bookmark the sites you use most and check the URL before you type anything into it, especially when a link arrives in your inbox and asks you to act fast. 

For additional security, Surfshark’s scam protection tools can catch what gets missed, flagging suspicious links and blocking harmful websites across your inbox, texts, and browser before you ever interact with them.