What is typosquatting and how to protect your brand

Typosquatting targets the gap between what a person means to type and what they end up typing. Every day, people misspell URLs in their browser's address bar. They hit the wrong key, skip a letter, or type .co instead of .com. Typosquatters know this. They register those misspelled versions of well-known domains and wait for traffic to arrive on its own.

The concept is simple, but the damage can be serious. Visitors who land on a typosquatted domain might see ads, get tricked into entering personal information, or download malware without realizing the site is fake. For the brand that was copied, it means lost traffic, lost trust, and a problem that grows the longer it goes unnoticed.

How is typosquatting different from cybersquatting?

Both typosquatting and cybersquatting involve registering someone else's brand as a domain in bad faith. The difference is in the method.

Cybersquatting uses the exact brand name. A cybersquatter might register yourbrand.net or yourbrand.org, banking on the fact that visitors will try different extensions. The domain itself is spelled correctly.

Typosquatting relies on misspellings. A typosquatter registers yorubrand.com, youbrand.com, or yourbrand.cm. The goal is not to trick someone who is browsing around. It is to catch people who make a small mistake while typing. Both are harmful, but typosquatting targets a different vulnerability. Cybersquatting exploits brand recognition. Typosquatting exploits human error.

What are the most common typosquatting patterns?

Typosquatters do not register random misspellings. They study which typing mistakes happen the most and target those specific errors. Here are the patterns that account for the majority of typosquatting cases.

Missing letters

The simplest pattern is dropping a single letter from the domain. A visitor typing "yourbrand.com" might accidentally type "yourbrand.com" without the "r" and land on "youband.com" instead. Shorter words and double letters make this mistake more likely. If your brand name contains repeated letters, like "google" becoming "gogle," this type of typosquatting is a real risk.

Swapped letters

When someone types quickly, letters can come out in the wrong order. "Example.com" becomes "exmaple.com." This is one of the hardest typos to catch because the word still looks close to correct at a glance. Typosquatters register the most common letter swaps for high-traffic domains.

Wrong domain extension

Typing .co instead of .com or .og instead of .org is an easy mistake to make, especially on a phone keyboard where the keys are small. Some country-code extensions sit right next to popular ones on auto-complete lists, making the error even more common. A brand that only owns the .com version of their name is exposed to this pattern.

Extra characters

Adding a letter is just as common as dropping one. "Yourbrand.com" becomes "yourbrands.com" or "yourbrandd.com." Typosquatters also add hyphens or insert common prefixes and suffixes to create domains that look almost right. The extra character is easy to overlook, especially when the URL is embedded in a link.

Adjacent key errors

Look at your keyboard. The letters "g" and "h" are right next to each other. So are "n" and "m," "s" and "d," and "o" and "p." Typosquatters map out which keys sit beside each other and register domains based on the most likely keyboard slip. If your brand starts with "g," they register versions starting with "f" or "h." This is a calculated play based on keyboard layout, not random guessing.

What do typosquatters do with the traffic?

Typosquatters are not collecting domains as a hobby. Every misspelled domain they register is built to generate money or cause harm. Here is how they use the visitors who land on their pages.

Display pay-per-click ads. The most common play is parking the domain with a page full of ads. Every visitor who arrives and clicks an ad generates revenue for the typosquatter. The page often displays ads related to the brand being imitated, which increases the chance visitors will click.

Run phishing pages. Some typosquatters build pages that look like the real brand's website. The design copies the logo, colors, and layout. Visitors who do not notice the misspelled URL may enter login credentials, credit card numbers, or other personal information. This is one of the most damaging forms of typosquatting because it directly harms both the visitor and the brand's reputation.

Distribute malware. A typosquatted domain can serve as a delivery point for malicious software. Visitors who land on the page might be prompted to download something disguised as a software update or plugin. Once installed, the malware can steal data, monitor activity, or take control of the device.

Redirect to a competitor. Some typosquatters sell their traffic to a competing brand. Every time someone mistypes your URL, they get redirected to a competitor's website. You lose the visitor, and your competitor gains one without spending a dollar on advertising.

Sell the domain back to you. Typosquatters sometimes approach the brand owner and offer to sell the misspelled domain. The asking price is always far more than what they paid to register it. This is similar to what cybersquatters do, but with a misspelled domain instead of the exact brand name.

How can you protect your brand from typosquatting?

Typosquatting protection starts before anyone registers a misspelled version of your domain. The more proactive you are, the less damage a typosquatter can do.

Register the most common misspellings yourself. Sit down and type your domain name quickly ten times. Note every mistake you make. Those are the same mistakes your visitors will make. Register those misspelled versions and redirect them to your real domain. This is the single most effective defense against typosquatting. If you already manage multiple domains, adding a few protective registrations is straightforward.

Secure your brand across popular extensions. If you own yourbrand.com, also register yourbrand.net, yourbrand.org, and any country-code extensions relevant to your audience. This closes the wrong-extension pattern that typosquatters exploit. The chapter on how to register a domain covers the process step by step.

Set up domain monitoring. Domain monitoring services watch for new registrations that match or closely resemble your brand name. When a suspicious domain appears, you get an alert. Early detection gives you time to act before the typosquatter has a chance to build a phishing page or generate ad revenue from your visitors.

Use your trademark to file complaints. If you hold a registered trademark, you have legal tools available to reclaim typosquatted domains. The UDRP (Uniform Domain-Name Dispute-Resolution Policy) process allows you to file a complaint without going to court. If the panel agrees that the domain was registered in bad faith using your trademark, the domain gets transferred to you. Having a trademark on file makes this process significantly faster and stronger.

What should you do if you find a typosquatter?

If you find that someone has registered a misspelled version of your domain, do not ignore it. The problem does not go away on its own, and delaying action gives the typosquatter more time to profit from your visitors.

Start by documenting everything. Take screenshots of the typosquatted domain, note what it displays, and run a WHOIS lookup to find out who registered it. Save this evidence because you will need it if you decide to file a complaint or take legal action.

If you have a registered trademark, file a UDRP complaint. The process typically takes about 60 days and costs between $1,500 and $5,000 depending on the provider. It is faster and less expensive than going to court.

If you do not have a trademark, or if the UDRP route is not practical for your situation, you can try negotiating a direct purchase. Use a broker rather than contacting the typosquatter yourself. When a brand owner reaches out directly, the asking price tends to go up.

For brands in the United States, the Anticybersquatting Consumer Protection Act (ACPA) allows you to take typosquatters to federal court. This path is slower and more expensive, but it also allows you to claim financial damages, which the UDRP process does not.

The most important thing is to act quickly. The longer the typosquatted domain stays active, the more traffic it captures and the more harm it can do. Protecting your domain name is an ongoing effort, and responding to typosquatting is part of that.

How does WEMASY help with domain protection?

WEMASY includes a custom domain with every website plan, along with SSL, hosting, and domain configuration managed through a single dashboard. If you register additional domains to protect your brand against typosquatting, you can connect and manage them all under one WEMASY account. Redirects from misspelled domains to your primary site can be set up without switching between multiple tools. See what is included with each plan at WEMASY pricing.

Frequently asked questions

The next chapter covers domain renewal scams and how to spot them, another threat that targets domain owners through deceptive emails and fake invoices.