Glossary
Typosquatting
Type 'gooogle.com' instead of 'google.com' and you might land on a fake site. Typosquatters register domain names that are common misspellings, then use them to steal credentials, serve malware, or make money from your mistake. Check URLs carefully before entering passwords.
What is Typosquatting?
A form of cybersquatting that relies on mistakes made when typing website addresses, using domains that are misspellings of popular sites to deceive users.
Why Should You Care?
Typosquatting attacks directly compromise employee credentials and circumvent email security controls, since attackers register domains one character away from legitimate services (e.g., 'rn' for 'm'). Security teams face cascading risks: compromised corporate accounts enable lateral movement, phishing from trusted-looking sources increases user trust in malicious links, and attackers can intercept sensitive communications or deploy malware under the guise of legitimate vendors. Organizations must train staff to verify URLs before authentication and monitor for domain registration of common misspellings of critical business services.
Is your business exposed?
Real-World Example
An employee mistypes a familiar domain—entering something like 'gihub.com' instead of 'github.com'—and lands on a lookalike login page that captures their credentials. Attackers then use those credentials to access private repositories, steal source code, or inject malicious code into production systems. Similar lookalike domains (such as substituting the digit '1' for the letter 'l') are used to harvest credentials for banking, payment, and corporate services, and have contributed to supply-chain compromises.
How to Protect Against Typosquatting
- 1.
Use bookmarks for important websites
- 2.
Register common misspellings of your company domain
- 3.
Train employees to verify URLs before entering credentials
Related Terms
Is your business exposed?
Check if your company data is circulating on the dark web
Free scan • No credit card required