How a single misplaced keystroke can lead you to a digital trap
In short: Typosquatting turns simple human error into a lucrative or malicious opportunity. By registering domains that mimic legitimate websites through misspellings, extra periods, or different top-level domains, bad actors can hijack unsuspecting traffic to steal credentials, install malware, or even express dissenting opinions.
Typosquatting, also known as URL hijacking or cousin domains, exploits the common typographical errors made when users manually type web addresses. These deceptive URLs can take many forms: a simple misspelling, a different top-level domain like .org instead of .com, or even 'combosquatting,' where an arbitrary word is appended to a legitimate brand name. Some variations, known as doppelganger domains, rely on the omission or insertion of a period to trick the eye.
The motivations for registering these domains vary widely. While some are used for malicious phishing schemes to intercept passwords or distribute malware—such as the Magniber ransomware which targets Chrome and Edge users—others are purely commercial. Some owners aim to sell the domain back to the brand, monetize it through advertising, or earn affiliate commissions by redirecting traffic. In some cases, the goal is simply to host a 'gripe site' to express a different opinion than the original brand.
The legal landscape is complex. The 1999 Anticybersquatting Consumer Protection Act (ACPA) features measures designed to fight such methods within the United States. Trademark holders can also use the Uniform Domain-Name Dispute-Resolution Policy (UDRP) through the World Intellectual Property Organization (WIPO). Winning a UDRP claim requires a complainant to demonstrate the domain's confusing similarity to their trademark, the registrant's lack of legitimate interest, and bad faith usage. However, legal victories are not guaranteed; in 2006, the U.S. Supreme Court declined to review a case involving fallwell.com, leaving a decision standing that allowed a gripe site to use a plausible misspelling of a preacher's name.
The threat has evolved alongside technology. In 2024, researchers identified typosquatting in blockchain-based naming systems like Ethereum Name Service, observing thousands of cryptocurrency transactions mistakenly sent to squatting addresses. Even high-profile entities are not immune; Lego has spent approximately US$500,000 through UDRP proceedings to resolve 309 cases of name disputes.
Opens the Intellect+ feed with this card first. Swipe up for the next one.
Sources
- Summary by Intellect · source: Typosquatting
To cite this card, link to https://intellectplus.co.uk/app/design-typosquatting.
How we source, check and correct cards: Editorial standards.
General information, not professional advice. Spotted an error? Flag the card or see corrections and complaints.
Intellect Plus is a visual educational discovery platform for exploring fascinating facts and ideas. Brain Food, Not Brain Rot. What is Intellect Plus?
Related
More in Typography · More in Design · Latest · A–Z · All topics
