Typosquatting is when an attacker registers a domain name designed to catch people who mistype a real one — paypa1.com instead of paypal.com, or rnicrosoft.com where the 'rn' reads as an 'm' at a glance. The fake site looks like the real one, and everything typed into it — passwords, card numbers, personal details — goes straight to the attacker. This guide covers how typosquatting works, how it is used against businesses and customers, and the controls that reduce the risk in 2026.
TL;DR
- Typosquatting is domain-name squatting: fake domains built from common typos of a real brand or domain.
- It drives two attack types: credential capture on fake login pages, and fake invoices and payment redirection on fake "supplier" domains.
- Businesses are hit both as victims and as the brand being impersonated, so staff and customers both need the defence.
- The trained reflex is the same as phishing: check the actual sender/domain, not the logo.
- Cyber Aware's phishing simulations train staff on lookalike-domain lures directly.
How typosquatting works
Domains cost a few dollars a year and registration is automated, so an attacker registers dozens of near-miss variants around a target brand: swapped characters, doubled letters, hyphen insertion, alternate top-level domains. When enough people mistype, the fake site receives a steady trickle of visitors — and every form field they fill is harvested.
The fake sites are convincing because they are copies: the attacker clones the real login page or store front, so the only difference is the domain in the address bar — the detail most people never check. Combined with a phishing email that provides the link, the victim never even types a typo: they click a link to a domain that looks right and reads right, and the lookalike-domain lures in the best anti-phishing software for lookalike domain detection guide are exactly this attack in commercial form.
The attack patterns built on typosquatting
| Pattern | How it works | Typical target |
|---|---|---|
| Credential capture | Fake login page on a mistyped/lookalike domain | Staff and customers logging in to any portal |
| Payment redirection | A "supplier" domain one letter off from the real one emails updated bank details | Finance and accounts payable teams |
| Fake stores | A lookalike store selling counterfeit or never-delivered goods | Customers of the real brand |
| Executive impersonation | A lookalike of the CEO's domain requesting an urgent payment or gift cards | Staff who trust internal authority cues |
| Malware delivery | A fake software-update site hosting the real product's installer with malware bundled | Anyone downloading common tools |
The payment redirection pattern is the expensive one for businesses. A supplier's domain one character different from the real one sends an "updated banking details" email; if the domain is checked at all, it is checked with the eye, which is exactly what typosquatting defeats.
How to spot a typosquatted domain
- Read character by character. The defence is deliberately unglamorous: read the domain letter by letter, especially before a payment or a login. "paypa1" uses a digit; "rnicrosoft" reads as "microsoft" at a glance but is not.
- Check the sender domain, not the display name. In any suspicious email, the address behind the friendly name is the fact that matters.
- Hover before you click. In desktop mail clients the link target preview shows the real destination; a mismatch with the visible text is the tell.
- Treat urgency as a trigger. "Pay this today or service stops" is the standard pressure cue in every payment-redirection email.
- Verify changes through a second channel. Any change of bank details is confirmed by phone, on the number already on file — never through the email itself.
How to protect your business
- Train the domain-checking reflex. This is a trainable behaviour, and it is the one that catches every variant. Monthly security awareness training with lookalike-domain simulations rehearses it under realistic conditions.
- Protect your own brand's typos. Register the common misspellings of your domain (and key product names) and redirect them to the real site — the standard defensive-registration practice.
- Turn on email authentication checks. DMARC, DKIM and SPF make spoofing your domain harder and give staff an additional signal that a message came from outside.
- Use a browser that flags lookalike domains. Modern browsers warn on known phishing and deceptive sites; keep them current.
- Run a gap check. A security gap assessment shows whether email authentication, payments controls and training are in place as a set — attackers only need one gap.
Why this matters for Australian businesses
The Australian Signals Directorate's Annual Cyber Threat Report 2024-25 recorded more than 84,700 cybercrime reports in 2024-25 — one every six minutes — with the average self-reported cost for a small business at $56,600 per incident, up 14 per cent. Payment redirection and business email compromise are among the highest-loss categories, and typosquatting is the infrastructure behind many of them.
Training changes the odds measurably. KnowBe4's 2026 Phishing by Industry Benchmarking Report, built on 67.7 million simulated phishing tests, measured susceptibility falling from 33.2% to 4.2% over twelve months of monthly training. The lookalike-domain lures behind typosquatting attacks are exactly the lure families simulated in those programmes.
FAQ
What is typosquatting in simple terms? Registering a fake domain built from common typos of a real one — and using the lookalike site to capture passwords, card details or redirect payments.
What is the difference between typosquatting and phishing? Phishing is the message that lures you in; typosquatting is the infrastructure the lure points to. Many phishing emails deliver victims to typosquatted or lookalike domains.
Can I get my own domain's typos taken down? Yes — registrars and brand-protection services handle takedown requests for clear impersonation, but registering the common variants yourself first is faster and cheaper.
Do browsers protect against typosquatting? Partly. Current browsers warn on known-deceptive sites, but a freshly registered lookalike may not be flagged for days. The trained reflex to read the domain remains the primary defence.
What is the single best control against payment redirection scams? Out-of-band verification: confirm any change of bank details by phone on the number already on file, never through the email that carried the change.
Does MFA help against typosquatting? It helps: a password captured on a fake page is less useful without the second factor. But MFA does not protect payments from "verified" supplier emails with new bank details — that needs the phone-call habit.
One last thing
Check two things today: whether your organisation's common domain typos are registered (they cost a few dollars a year to hold), and whether your finance team has a written rule to phone-verify any change of supplier bank details. Both are small; together they close the two most expensive typosquatting paths.