What is Typosquatting?
Typosquatting is registering domain names, or publishing software packages, whose names are one small mistake away from a legitimate one: a swapped letter, a missing character, a different top-level domain. Attackers use these lookalikes to catch mistyped visits, host phishing pages, deliver malware or trick developers into installing a malicious package.
Definition
- Typosquatting
- Typosquatting is registering domain names, or publishing software packages, whose names are one small mistake away from a legitimate one: a swapped letter, a missing character, a different top-level domain. Attackers use these lookalikes to catch mistyped visits, host phishing pages, deliver malware or trick developers into installing a malicious package.
How Typosquatting Works
The variations follow predictable rules:
- omission (
gogle), - insertion (
gooogle), - transposition (
googel), - a neighboring key on the keyboard (
googke), - an added hyphen,
- a different top-level domain,
- and homoglyphs where a Cyrillic or Greek character looks identical to a Latin one.
MITRE ATT&CK lists this under Acquire Infrastructure: Domains (T1583.001), noting that adversaries pick domains similar to legitimate ones through homoglyphs or a different TLD, and that internationalized domain names enable homograph attacks. Because the rules are mechanical, defenders can generate the same list. Tools such as dnstwist produce plausible permutations of a domain and check which are registered, which have mail servers and which serve live pages.
Once registered, a lookalike domain serves several purposes.
- Some catch people who mistype the real address and show them ads, fake login pages or malware downloads.
- Others are used to send mail: a message from a domain one character off the company's real domain can pass SPF, DKIM and DMARC, because the attacker controls that domain properly, so the authentication checks succeed while the reader sees a familiar name.
- A third use runs the other way: emails that employees mistype toward the lookalike land in the attacker's mailbox, attachments included.
The same idea moved into software supply chains. Public package registries regularly have to remove malicious packages named like popular libraries with a letter changed, aimed at developers who mistype an install command. The payload runs at install time through package scripts, on a developer laptop or a build server, which is a far more valuable foothold than one browser session.
Typosquatting in SOC Operations
A SOC handles typosquatting on two clocks. Proactively, run permutation checks against the company's own domains and those of key vendors, and push newly registered lookalikes into email and proxy blocklists before a campaign starts; a lookalike that suddenly gains an MX record is about to send mail. Reactively, when a phishing report arrives, compare the sender domain with the real one character by character and check its registration date, since these domains are often only days old. In developer environments, alert on package installs whose names sit a small edit distance from a popular package but are missing from the approved list, and look at what the install scripts executed.
Practice Typosquatting in a Real SOC
SOCSimulator provides hands-on training with realistic SIEM, XDR, and Firewall interfaces. Build real analyst skills investigating typosquatting scenarios with zero consequences, free.
Frequently Asked Questions
- What is cybersquatting and how does it impact cybersecurity?
- Cybersquatting is registering a domain that matches or imitates someone else's brand, often to resell it or profit from its traffic. Typosquatting is the subset built on misspellings. The security impact comes when those domains are used for phishing, malware delivery or to collect misdirected email, because people and some filters trust names that look familiar.
- Why is typosquatting illegal?
- Registering a misspelled domain is not automatically illegal, but registering and using it in bad faith against someone's trademark can be challenged. Under ICANN's Uniform Domain Name Dispute Resolution Policy, a trademark owner can win a domain that is identical or confusingly similar to its mark when the holder has no legitimate interest and registered and used it in bad faith. Using the lookalike to steal credentials or money adds fraud on top.
- How to protect yourself from typosquatting?
- Open important sites from bookmarks rather than typing them, check the exact domain before entering a password, and use a password manager, which will not autofill credentials on a lookalike site. Organizations should also register the obvious misspellings of their own domains and monitor for new ones.
Sources
Related Terms
Phishing is a social engineering attack delivered via email, SMS, voice calls, or other channels tha...
A supply chain attack compromises a trusted third-party vendor, software build process, open-source ...
Threat intelligence is analyzed, contextualized information about current and emerging cyber threats...
In cyber security, the attack surface is every point where an attacker could get into your environme...
In cyber security, social engineering means manipulating a person into handing an attacker access, i...
More Threats Terms
Related SOC Training Resources
Threat Hunter Career Guide: Salary & Skills
Threat Hunters do not wait for alerts. You develop hypotheses based on threat intelligence and adversary behavior models…
Read more Career PathIncident Responder Career Guide: Salary & Skills
Incident Responders lead the technical response when confirmed breaches happen. You coordinate containment, run forensic…
Read more Career PathSOC Analyst (Tier 2) Career Guide: Salary & Skills
Tier 2 SOC Analysts handle the investigations that Tier 1 escalates. You dig into multi-stage attacks, coordinate contai…
Read more ComparisonSOCSimulator vs Hack The Box: Comparison
Different tools for different career paths. SOCSimulator trains defensive analysts. Hack The Box trains offensive securi…
Read more ToolFirewall Training Console: SOCSimulator
The Firewall console in SOCSimulator replicates the log analysis experience of enterprise platforms like Palo Alto Netwo…
Read more ToolSIEM Training Console: SOCSimulator
The SIEM console in SOCSimulator replicates the workflow of enterprise platforms like Splunk Enterprise Security, Micros…
Read more TechniqueMITRE ATT&CK® Techniques: Detection Training Library
Browse all MITRE ATT&CK® techniques with detection strategies and example alerts.
Read more Career PathCybersecurity Career Paths: 2026 Guide
Explore SOC analyst career paths with salary data, required skills, and certification roadmaps.
Read more PlaybookSOC Investigation Playbooks: Step-by-Step Guides
Practitioner investigation playbooks with decision trees and real SIEM queries.
Read more FeatureShift Mode: Real-Time SOC Simulation
Practice alert triage under realistic time pressure with SLA timers and noise injection.
Read more FeatureOperations: Guided Training Operations
Structured CTF-style investigation operations covering real-world attack scenarios.
Read more BlogSOCSimulator Blog: Security Training Insights
Articles on SOC analyst skills, detection engineering, and career development.
Read more