What is Typosquatting?
Typosquatting (or URL hijacking) is a form of brand impersonation where attackers register domain names that are slight variations of a legitimate target brand. When users make a typographical error or click a deceptive link in an email, they are taken to a credential-harvesting phishing page.
The 5 Core Techniques
1. Omission
Attackers simply remove one letter from your domain. Users typing fast often miss a character.
- Target:
facebook.com - Squat:
facebok.com
2. Repetition (Doubling)
Adding an extra letter, usually a vowel or a double consonant, which is easily overlooked in the address bar.
- Target:
netflix.com - Squat:
netfflix.com
3. Transposition (Swapping)
Swapping two adjacent characters. Because human brains read words as a whole rather than letter-by-letter, this is highly effective.
- Target:
linkedin.com - Squat:
linedkin.com
4. Replacement (Keyboard Adjacency)
Replacing a letter with another letter that sits right next to it on a QWERTY keyboard.
- Target:
amazon.com - Squat:
snazon.com(A and S are adjacent)
5. TLD Squatting
Registering the exact brand name on a different Top Level Domain. If you own the .com, attackers will register the .co, .net, or .security version.
How to Defend Your Brand
You cannot buy every possible typo variation of your brand—there are thousands of permutations. Defensive registration is expensive and inefficient. Instead, modern Security Operations Centers (SOCs) use proactive monitoring.
Tetik.NET automatically generates thousands of permutations of your brand name using our proprietary algorithm, and actively monitors global DNS and SSL logs 24/7 to alert you the second an attacker registers a squatted domain.