# Typosquatting Also called **URL hijacking** or a **look-alike domain attack**, typosquatting is the registration of domain names that are intentional misspellings or close variants of legitimate websites, in order to harvest the traffic of users who mistype an address or fail to scrutinize a link. Because people routinely prioritize speed over accuracy when typing — especially on phones — a steady trickle of mistaken visits flows to whoever owns the look-alike domain. The technique is a sibling of *cybersquatting* (registering a brand's domain to ransom it back) but is aimed at intercepting traffic rather than holding a name hostage. ## How it works Typosquatters exploit predictable human and keyboard errors: - **Omissions** — *gogle.com* for *google.com* - **Transpositions** — *gogole.com* - **Adjacent-key slips** — *facebok.com* / *facebokk.com* - **Wrong or look-alike TLDs** — *.cm* or *.co* instead of *.com* - **Homoglyphs** — visually similar characters (a Cyrillic "а" for a Latin "a"), the basis of internationalized-domain "homograph" attacks - **Added/dropped words or hyphens** — *paypal-secure.com*, *amazon-support.com* Once a visitor lands, the squatted domain may run pay-per-click ad pages, redirect to affiliate or scam offers, install malware via drive-by download, present a pixel-perfect fake login page to steal credentials and session tokens, or simply impersonate the brand. Classic documented examples include *goggle.com* (used in a 2006 McAfee demonstration of drive-by malware) and *yuube.com* (redirecting [[YouTube]] mistypers toward a malicious "security extension"). ## Why it belongs in this knowledge base Typosquatting is a building block of the broader phishing, disinformation, and influence-operation toolkit this vault tracks. Look-alike domains are used to spoof news outlets, government sites, campaign and donation pages, and login portals — making typosquatting a low-cost infrastructure layer for credential theft, financial fraud, and the seeding of fake or impersonated content. It complements other delivery vectors like the [[Watering Hole]] attack (compromising a site the target already trusts) and [[Spearphishing]] (a tailored lure pointing the victim at exactly such a look-alike domain). State and partisan actors have registered deceptive look-alike domains to impersonate media and official sources during election cycles, which is where this otherwise-generic cybercrime technique intersects directly with information warfare. ## Distinct from neighbors - **Cybersquatting** — registering a brand's *correct* domain to extort or block it; typosquatting targets the *misspelling* to intercept traffic. - **[[Watering Hole]]** — compromises a legitimate site the target visits; typosquatting builds a fake site and waits for the typo. - **[[Spearphishing]]** — the social-engineering lure; a typosquatted domain is often the destination the lure points to. - **Homograph / IDN attack** — a specialized typosquatting subtype using look-alike Unicode characters rather than misspellings. ## See Also - [[Cybersecurity Lexicon]] - [[Watering Hole]] - [[Spearphishing]] - [[Surveillance Lexicon]]