Cybersecurity glossary
What is Typosquatting?
Learn what typosquatting is, how attackers register lookalike domains and packages, risks to users and developers, and how to detect and defend against typosquatting.
Definition
Typosquatting is the practice of registering domain names, packages, or other identifiers that closely resemble popular brands or projects—often via typos, alternate TLDs, or confusing characters—to trick users into visiting malicious sites or installing malicious software.
Why typosquatting works
Humans mistype URLs. Autocomplete fails. Developers copy package names from memory. Attackers register the near-misses and wait.
Typosquatting monetizes that error—via phishing pages, malware downloads, or malicious libraries that ride into CI pipelines.
Common typosquat patterns
Character edits
Missing letters, swapped characters, or extra hyphens in brand names.
Alternate TLDs
example.com vs example.net / .co / cheap new gTLDs.
Homographs
Lookalike Unicode characters that fool visual inspection.
Package name twins
npm/PyPI names one character off from popular libraries.
Typical attack flow
Pick a high-traffic brand or package
Attackers choose names users type often under time pressure.
Register lookalikes
Domains or packages are created to mimic the real target.
Host malicious content
Phishing, drive-by downloads, or trojaned libraries.
Harvest victims
Organic typos, phishing lures, or careless installs deliver traffic.
Defenses by audience
| Audience | Controls |
|---|---|
| Brand owners | Monitoring, UDRP/takedowns, defensive regs, CT/phishing feeds |
| End users | Bookmarks, password managers (fill only on exact hosts), caution on links |
| Developers | Lockfiles, publisher verification, private registries, install allowlists |
| Enterprises | DNS/web filtering, package firewalls, secure browser policies |
- Monitor lookalike domains and certs for your key brands.
- Encourage password managers so credentials do not autofill on fakes.
- Pin dependencies and review new package names carefully.
- Use organization allowlists for critical open-source libraries.
- Train staff on homograph and TLD lookalike tricks.
- Prepare takedown and legal playbooks for active phishing domains.
- Publish clear official URL lists for customers and partners.
- Instrument web filters for known typosquat patterns where feasible.
The practical takeaway
Typosquatting turns small naming mistakes into phishing and supply-chain incidents. Defend brands, educate users, and verify package identity—not just “almost the right name.”
If a URL or dependency is one character off, assume hostile until proven otherwise.
Related security terms
Domain Hijacking
Taking over a legitimate domain rather than registering a lookalike.
Top-Level Domain (TLD)
Attackers often abuse alternate TLDs for lookalike names.
WHOIS
Used in investigations of suspicious registrations.
Phishing-related session risks
Credentials stolen via typosquat phishing often fuel stuffing attacks.
Frequently asked questions
What is typosquatting in simple terms?
Attackers buy names that look like popular brands—gogle.com style mistakes—so people land on fake sites or pull the wrong software package.
Is typosquatting only about websites?
No. It also appears in npm/PyPI package names, container images, and mobile apps that mimic trusted publishers.
What is a homograph attack?
A lookalike that uses characters from other scripts (for example Cyrillic “а”) that visually resemble Latin letters in domain names.
How do companies defend domains?
Defensive registrations, brand monitoring, rapid takedowns, user education, and bookmarking official URLs.
How do developers avoid package typosquatting?
Pin exact package names and versions, verify publishers, use lockfiles, and prefer private registries or allowlists for critical deps.
Is typosquatting illegal?
Often it violates trademark and anti-phishing laws, but enforcement varies. Technical monitoring remains essential.
References
Explore authoritative guidance and frameworks related to typosquatting.
Explore every security definition
Return to the glossary to search by term, alias, starting letter, or security category.