What is typosquatting?

You get an email from "support@amaz0n.com" or "payapl.com" and, at a quick glance, it looks totally real. That's typosquatting in action.

Typosquatting is when someone registers a domain that mimics a legitimate brand by swapping, dropping, or rearranging letters in a way that's easy to miss. Think "gogle.com", "amazn.com", or "microsofft.com". The attacker is betting on your fingers slipping or your eyes skimming too fast.

In email, it's a core phishing tactic. The attacker sends messages from a typosquatted domain hoping the recipient doesn't look closely at the sender address. "support@paypa1.com" can fool a lot of people, especially on mobile where the full address is often hidden.

The threat goes both ways. Your customers can be targeted by someone impersonating your brand this way (and they'll blame you, not the attacker). And your own staff can be targeted if attackers register typosquats of your suppliers or partners.

Here's how to defend yourself and your brand:

• Register your own typos defensively. Buy the most obvious misspellings of your domain before someone else does. It's cheaper than you think and far cheaper than a brand crisis.
• Set up domain monitoring. You can't buy every variation, so monitoring services alert you when new lookalike domains are registered.
• Use DMARC on your domain. It won't stop attackers registering typosquats, but it makes it much harder for them to fake your exact domain and helps mail providers identify that a typosquat is not the real you. A proper DMARC policy is your strongest shield here.
• Tell your audience what to expect. Let subscribers know which domain your emails actually come from. People who know the real thing are quicker to spot a fake.

Typosquatting is closely related to other lookalike domain tactics, but it relies specifically on human error rather than visual trickery. If you're worried someone might already be impersonating your brand this way, our free blocklist checker is a good starting point, and our SOS team can walk you through a fuller domain audit if you're not sure where to look.