Typosquatting
A common method of brand fraud that relies on users mistyping a URL.
What is Typosquatting?
Typosquatting is a form of cybercrime that relies on users making a mistake when typing in a URL. Fraudsters will register misspelled variations of domain names, usually of popular websites, to take advantage of human error.
The goal of typosquatting is to lure users onto fraudulent websites where cybercriminals will then execute phishing attacks, sell counterfeit goods, install malware/ransomware, or even increase traffic to a site to boost ad revenue.
How Does Typosquatting Work?
Typosquatters will often set up their fake websites to mimic the look and feel of the original website. They may use the same graphics, layout, fonts, and even logos as the original. In some cases, these fake websites could be almost identical to the original, except for one letter in the domain.
Example: a fraudster might register the domain name “apple.co” instead of “apple.com”. When a user mistakenly types “apple.co” into their web browser, they will be redirected to the typosquatter’s website instead of the legitimate Apple website.
Typosquatting to a large extent relies on confusion or human error such as:
- Typos
- Spelling errors
- Alternative spelling: web addresses with words that are spelled differently in different countries. Example favoritetea.com for Americans vs. favouritetea.com for the Brits
- Hyphenated domains: forgetting to add or adding a hyphen where not required. For example facebook.com vs. face-book.com
Examples of Typosquatting
Some of the most well-known companies in the world have had to deal with cybersquatters at one point or another. For example, in 2000 BBC news won a cybersquatting case in a US court against a company which registered bbcnews.com. eBay has been the victim of cybersquatting multiple times, with thousands of domains being registered by cybersquatters. Microsoft and Apple have also had to deal with a fair share of cybersquatters.
In 2006, Google became a victim of a typosquatting attack when typosquatters registered the site Goggle.com which was believed to be a phishing/fraud site.
In 2009, Apple Inc. sued an Australian man named Thomas Rasmussen for registering the domain name www.appleiphone5.com . Rasmussen had created a website that looked very similar to Apple’s official website, except that the phone pictured on the website was not actually an iPhone 5.
In 2020, towards the US presidential elections, a report revealed several candidates had typosquatting domains set up in their name by cybercriminals. According to the report at least 550 typosquatting sites were up at the time.
What are Some of the Risks Associated with Typosquatting?
Phishing attacks
Hackers can send phishing emails using a typosquat variation of your business’ web address to trick employees or customers to click on attached malicious links. Once they click on the links they can end up infecting their devices with malware or having their data stolen.
Brand reputation
Fake typosquat sites expose internet users to various unpleasant experiences that could be detrimental to your brand reputation.
For example, some fake typosquat sites are full of ads to boost ad revenue. A user who visits such a site believing it is your business site might quickly leave the site and never come back. Your business unfairly loses a potential client who might not refer other people to it due to the ads.
People who lose funds or data due to revealing sensitive information on malicious typosquat sites can easily blame your business. It is always up to the business to protect its customers against such attacks. Several popular businesses including Google and Microsoft have registered typo versions of their domains and redirected them to their sites to avoid typosquatters taking advantage.
Revenue reduction
If a typosquatting site sells counterfeit goods, unsuspecting customers may purchase these fake goods, diverting revenue from the real company. The fake site can also cost your website its much-deserved traffic. By directing your traffic to the fake site, you may lose potential customers.
What Can You do to Protect Your Business From Typosquatting Risks?
Register possible typo domain names
Take time to register predictable typo domains and redirect them to your website. Also consider registering other ccTLD’s, different variations of your domain name, including with or without hyphens, and alternative spellings of the domain name.
Use ICANN to curb typosquatting
ICANN or Internet Corporation for Assigned Names and Numbers’ Trademark ClearingHouse helps you find out how your business name is being used within different domains. It can help you ensure unauthorized domain registrations are blocked for the safety of your business.
Use SSL Certificates to prove site legitimacy
SSL certificates tell internet users who they are connected to and protect their data transfer. The certificates are an excellent way to prove to users your site is legitimate.
Listed above are a few preventative ways to protect your business against typosquatting risks, however, if you believe your business site is already being impersonated by someone some of the best actions to take include:
Notifying stakeholders
Your employees, customers, and other relevant parties should know that someone is impersonating your business site and should be on the lookout for any suspicious website activities or emails.
Get the fake sites taken down
Different jurisdictions provide different ways to get a website taken down. Regardless of the varying processes, once you know a fake site is up, take the necessary steps to have it taken down. Learn more about this on our blog: How to Take a Malicious Website Down – The Easy Way
Start Protecting Your Business Today
Typosquatting is a sleek form of cyber-attack that takes advantage of people’s lack of attentiveness when keying in a web address.
Its risks cut across internet users and business owners. Users risk being infected with malware, getting their credentials stolen with phishing attacks, being scammed with counterfeit goods, and more. Business owners risk their brand reputation, potential customers, and revenue.Is is crucial to guard against and quickly resolve issues involving typosquatting attacks.
Bolster offers protection against malicious typosquatting domains.