Product Code Database
Typosquatting, also called URL hijacking, a sting site, a cousin domain, or a fake URL, is a form of cybersquatting, and possibly brandjacking which relies on mistakes such as typos made by Internet users when inputting a URL into a web browser. A user accidentally entering an incorrect website address may be led to any URL, including an alternative website owned by a cybersquatter.
The typosquatter's URL will usually be similar to the victim's site address; the typosquatting site could be in the form of:
Similar abuses:
Once on the typosquatter's site, the user may also be tricked into thinking that they are actually on the real site through the use of copied or similar logos, website layouts, or content. Spam emails sometimes make use of typosquatting URLs to trick users into visiting malicious sites that look like a given bank's site, for instance.
Celebrities have also pursued their domain names. Prominent examples include basketball player Dirk Nowitzki UDRP of DirkSwish.com and actress Eva Longoria UDRP of EvaLongoria.org.
Goggle, a typosquatted version of Google, was the subject of a 2006 web safety promotion by McAfee, a computer security company, which depicted the significant amounts of malware installed through drive-by downloads upon accessing the site at the time. Goggle installed SpySheriff. Later, the URL was redirected to google.com; a 2018 check revealed it to redirect users to adware pages, and a 2020 attempt to access the site through a private DNS resolver hosted by AdGuard resulted in the page being identified as malware and blocked for the user's security. By mid-2022, it had been turned into a political blog. As of April 2025, goggle.com is not operational.
Another example of corporate typosquatting is yuube.com, targeting YouTube users by programming that URL to URL redirection to a malicious website or page that asks users to add a malware "security check extension". Similarly, www.airfrance.com has been typosquatted by www.arifrance.com, diverting users to a website peddling discount travel (although it now redirects to a warning from Air France about malware). Other examples are equifacks.com (Equifax.com), experianne.com (Experian.com), and tramsonion.com (TransUnion.com); these three typosquatted sites were registered by comedian John Oliver for his show Last Week Tonight. Over 550 typosquats related to the 2020 U.S. presidential election were detected in 2019.
The Magniber ransomware is being distributed in a typosquatting method that exploits typos made when entering domains, targeting mainly Chrome and Edge users.
A 2024 peer-reviewed study provides the first large-scale measurement of typosquatting in blockchain-based naming systems, such as Ethereum Name Service, Unstoppable Domains, and ADAHandles. The researchers observed thousands of cryptocurrency transactions mistakenly sent to squatting addresses, with targets including both popular domain names and identities linked to social media accounts.
On April 17, 2006, evangelist Jerry Falwell failed to get the U.S Supreme Court to review a decision allowing Christopher Lamparello to use www.fallwell.com. Relying on a plausible misspelling of Falwell's name, Lamparello's gripe site presents misdirected visitors with scriptural references that are intended to counter the fundamentalist preacher's scathing rebukes against homosexuality. In Lamparello v. Falwell, the high court let stand a 2005 Fourth Circuit opinion that "the use of a mark in a domain name for a gripe site criticizing the markholder does not constitute cybersquatting."
|
|
