View source for Typosquatting

{{Use mdy dates|date=May 2024}}{{short description|Form of cybersquatting which relies on mistakes when inputting a website address}}
[[File:Typosquatting (Firefox 74).svg|thumb|right|240px|An incorrectly entered URL could lead to a website operated by a cybersquatter.]]
'''Typosquatting''', also called '''URL hijacking''', a '''sting site''', a '''cousin domain''', or a '''fake URL''', is a form of [[cybersquatting]], and possibly [[brandjacking]] which relies on mistakes such as [[typographical error|typos]] made by Internet users when inputting a [[URL|website address]] into a [[web browser]]. A user accidentally entering an incorrect website address may be led to any URL, including an alternative website owned by a cybersquatter.

The typosquatter's [[Uniform Resource Locator|URL]] will usually be ''similar'' to the victim's site address; the typosquatting site could be in the form of:
<!-- Do NOT give any examples of misspelled  domain names. "examlpe.com"  currently leads to a site that tries to load malware on your computer. -->
*A misspelling, or foreign language spelling, of the intended site
*A misspelling based on a typographical error
*A plural of a singular domain name
*A different [[top-level domain]] (e.g., .com instead of .org)
*An abuse of the [[country code top-level domain|Country Code Top-Level Domain]] (ccTLD) ([[.cm]], [[.co]], or [[.om]] instead of .com)

Similar abuses:
<!-- Do NOT give any examples of misspelled  domain names. "examlpe.com"  currently leads to a site that tries to load malware on your computer. -->
*Combosquatting – no misspelling, but appending an arbitrary word that appears legitimate, but that anyone could register.
*[[Doppelganger domain]] – omitting a period or inserting an extra period
*Appending terms such as ''sucks'' or -''{{Not a typo|suckes}}'' to a domain name

Once on the typosquatter's site, the user may also be tricked into thinking that they are actually on the real site through the use of copied or similar logos, website layouts, or content. Spam emails sometimes make use of typosquatting URLs to trick users into visiting malicious sites that look like a given bank's site, for instance.

==Motivation==
There are several different reasons for typosquatters buying a typo domain:
*To try to sell the typo domain back to the brand owner
*To [[monetization|monetize]] the domain through [[advertising]] revenues from direct navigation misspellings of the intended domain
*To redirect the typo-traffic to a competitor
*To redirect the typo-traffic back to the brand itself, but through an affiliate link, thus earning commissions from the brand owner's affiliate program
*As a [[phishing]] scheme to mimic the brand's site, while intercepting passwords which the visitor enters unsuspectingly<ref>{{Cite web|title='Typosquatting': How 1 Mistyped Letter Could Lead to ID Theft|url=https://www.bankrate.com/finance/credit/typosquatting-identity-theft.aspx|date=17 August 2015|last=Claes|first=Bell|work=Bankrate|archive-url=https://web.archive.org/web/20150820232605/http://www.bankrate.com/finance/credit/typosquatting-identity-theft.aspx|archive-date=20 August 2015|url-status=live}}</ref>
*To install drive-by [[malware]] or revenue generating [[adware]] onto the visitors' devices
*To harvest misaddressed e-mail messages mistakenly sent to the typo domain
*To express an opinion that is different from the intended website's opinion
*By legitimate site owners, to block malevolent use of the typo domain by others
*To annoy users of the intended site

==Examples==
Many companies, including [[Verizon]], [[Lufthansa]], and [[The Lego Group|Lego]], have gained reputations for aggressively chasing down typosquatted names. Lego, for example, has spent roughly {{Currency|500,000|USD}} on taking 309 cases through [[Uniform Domain-Name Dispute-Resolution Policy|UDRP]] proceedings.<ref>{{Cite web|title=Has Lego's $500k Spent on URDP Been a Waste?|url=https://domainnamewire.com/2011/11/01/has-legos-500k-spent-on-urdp-been-a-waste/|date=1 November 2011 |last=Allemann |first=Andrew |work=Domain Name Wire |archive-url=https://web.archive.org/web/20111102165431/http://domainnamewire.com/2011/11/01/has-legos-500k-spent-on-urdp-been-a-waste/|archive-date=2 November 2011|url-status=live}}</ref>

Celebrities have also pursued their domain names. Prominent examples include basketball player [[Dirk Nowitzki|Dirk Nowitzki's]] UDRP of DirkSwish.com<ref>{{Cite web|title=Dallas Mavericks Star Dirk Nowitzki Wins Dispute Over Domain Name|url=https://domainnamewire.com/2011/09/12/dallas-mavericks-dirk-nowitzki-domain/|date=12 September 2011|last=Allemann|first=Andrew|work=Domain Name Wire|archive-url=https://web.archive.org/web/20110927065945/http://domainnamewire.com/2011/09/12/dallas-mavericks-dirk-nowitzki-domain/|archive-date=27 September 2011|url-status=live}}</ref> and actress [[Eva Longoria|Eva Longoria's]] UDRP of EvaLongoria.org.<ref>{{Cite web|title=Eva Longoria Adds .Org to Her Collection |url=https://domainnamewire.com/2011/05/05/eva-longoria-adds-org-to-her-collection/|date=5 May 2011 |last=Allemann |first=Andrew |work=Domain Name Wire |archive-url=https://web.archive.org/web/20110507065210/http://domainnamewire.com/2011/05/05/eva-longoria-adds-org-to-her-collection/|archive-date=7 May 2011|url-status=live}}</ref>

Goggle, a typosquatted version of [[Google]], was the subject of a 2006 web safety promotion by [[McAfee]], a computer security company, which depicted the significant amounts of malware installed through [[Drive-by download|drive-by downloads]] upon accessing the site at the time. Goggle installed [[SpySheriff]]. Later, the URL was redirected to google.com;<ref>{{Cite web|title=Google Wants to Take Down Goggle.com Web Site|url=https://domainnamewire.com/2011/08/23/google-wants-to-take-down-goggle-com-web-site/|date=23 August 2011|last=Allemann|first=Andrew|work=Domain Name Wire|archive-url=https://web.archive.org/web/20110825075404/http://domainnamewire.com/2011/08/23/google-wants-to-take-down-goggle-com-web-site/|archive-date=25 August 2011|url-status=live}}</ref> a 2018 check revealed it to redirect users to [[adware]] pages, and a 2020 attempt to access the site through a private [[Domain Name System|DNS]] resolver hosted by [[AdGuard]] resulted in the page being identified as [[malware]] and blocked for the user's [[Internet security|security]]. By mid-2022, it had been turned into a political blog.{{Citation needed|date=February 2025}} As of April 2025, goggle.com is not operational.

Another example of corporate typosquatting is yuube.com, targeting [[YouTube]] users by programming that URL to [[URL redirection|redirect]] to a malicious website or page that asks users to add a malware "security check extension".<ref>{{Cite web|title=Your Spelling Errors Can Help Typosquatters Make Big Bucks|url=https://economictimes.indiatimes.com/tech/internet/your-spelling-errors-can-help-typosquatters-make-big-bucks/articleshow/5884936.cms|date=5 May 2010|last=Gopalakrishnan|first=Chandu|work=The Economic Times|archive-url=https://web.archive.org/web/20110812034737/http://articles.economictimes.indiatimes.com/2010-05-05/news/28413792_1_domain-anti-cybersquatting-consumer-protection-act-website|archive-date=12 August 2011|url-status=live}}</ref> Similarly, www.airfrance.com has been typosquatted by www.arifrance.com, diverting users to a website peddling discount travel (although it now redirects to a warning from [[Air France]] about malware).<ref name=slavitt>{{Cite web|title=Protecting Your Intellectual Property from Domain Name Typosquatters|url=https://corporate.findlaw.com/intellectual-property/protecting-your-intellectual-property-from-domain-name.html|date=26 March 2008|last=Slavitt|first=Kelly M.|work=FindLaw|archive-url=https://web.archive.org/web/20130726234418/http://corporate.findlaw.com/intellectual-property/protecting-your-intellectual-property-from-domain-name.html|archive-date=26 July 2013|url-status=live}}</ref> Other examples are equifacks.com ([[Equifax]].com), experianne.com ([[Experian]].com), and tramsonion.com ([[TransUnion]].com); these three typosquatted sites were registered by comedian [[John Oliver (comedian)|John Oliver]] for his show ''[[Last Week Tonight with John Oliver|Last Week Tonight]]''.<ref>{{cite news |last= Debter |first= Lauren |date= April 16, 2016 |title=John Oliver Takes Aim At Credit Reports In 'Last Week Tonight'  |url=https://www.forbes.com/sites/laurengensler/2016/04/11/john-oliver-credit-reports-last-week-tonight/|work=[[Forbes]] |location= |access-date=July 17, 2023}}</ref><ref>{{Cite web |last=Durkin |first=J. D. |date=11 April 2016 |title=John Oliver Creates Fake Web Sites to Troll Major Three Credit Bureaus |url=https://www.mediaite.com/online/john-oliver-creates-fake-web-sites-to-troll-major-three-credit-bureaus |url-status=live |archive-url=https://web.archive.org/web/20160414103447/http://www.mediaite.com/online/john-oliver-creates-fake-web-sites-to-troll-major-three-credit-bureaus |archive-date=14 April 2016 |website=[[Mediaite]]}}</ref> Over 550 typosquats related to the [[2020 United States presidential election|2020 U.S. presidential election]] were detected in 2019.<ref>{{Cite web |last=Riper |first=Harrison van |date=2019-10-16 |title=Typosquatting and the 2020 U.S. Presidential election |url=https://www.digitalshadows.com/blog-and-research/typosquatting-and-the-2020-u-s-presidential-election/ |url-status=live |archive-url=https://web.archive.org/web/20210904000808/https://www.digitalshadows.com/blog-and-research/typosquatting-and-the-2020-u-s-presidential-election/ |archive-date=2021-09-04 |access-date=2021-09-04 |website=Digital Shadows |language=en-US}}</ref>

The Magniber [[ransomware]] is being distributed in a typosquatting method that exploits typos made when entering domains, targeting mainly Chrome and Edge users.<ref>{{cite web |author=MalBot |date=2022-10-25 |title=Rapidly Evolving Magniber Ransomware |url=https://malware.news/t/rapidly-evolving-magniber-ransomware/64443 |url-status=live |archive-url=https://web.archive.org/web/20240504041023/https://malware.news/t/rapidly-evolving-magniber-ransomware/64443 |archive-date=May 4, 2024 |access-date=November 16, 2022 |website=malware.news}}</ref>

==In United States law==
In the United States, the 1999 [[Anticybersquatting Consumer Protection Act]] (ACPA) contains a clause (Section 3(a), amending 15 USC 1117 to include sub-section (d)(2)(B)(ii)) aimed at combatting typosquatting.<ref>{{Cite web|title=S. 1255{{snd}}Trademark Cyberpiracy Prevention Act|date=October 27, 1999 |url=https://www.congress.gov/bill/106th-congress/senate-bill/1255/text/is|archive-url=https://web.archive.org/web/20180921113259/https://www.congress.gov/bill/106th-congress/senate-bill/1255/text/is|archive-date=21 September 2018|url-status=live}}</ref><ref>{{Cite web|title=Without Typo-squatters, How Far Would Google Fall?|url=https://www.theregister.com/2008/10/23/google_and_typosquatting|date=23 October 2008|last=Metz|first=Cade|work=The Register|archive-url=https://web.archive.org/web/20081024195809/http://www.theregister.co.uk/2008/10/23/google_and_typosquatting/|archive-date=24 October 2008|url-status=live}}</ref>

On April 17, 2006, evangelist [[Jerry Falwell]] failed to get the [[Supreme_Court_of_the_United_States|U.S Supreme Court]] to review a decision allowing Christopher Lamparello to use www.fallwell.com. Relying on a plausible misspelling of Falwell's name, Lamparello's [[gripe site]] presents misdirected visitors with scriptural references that are intended to counter the fundamentalist preacher's scathing rebukes against [[homosexuality]]. In ''[[Lamparello v. Falwell]]'', the high court let stand a 2005 [[United States Court of Appeals for the Fourth Circuit|Fourth Circuit]] opinion that "the use of a mark in a domain name for a gripe site criticizing the markholder does not constitute cybersquatting."

==WIPO resolution procedure==
Under the [[Uniform Domain-Name Dispute-Resolution Policy]] (UDRP), [[trademark]] holders can file a case at the [[World Intellectual Property Organization]] (WIPO) against typosquatters (as with cybersquatters in general).<ref name=slavitt/> The complainant has to show that the registered domain name is identical or [[confusing similarity|confusingly similar]] to their trademark, that the registrant has no legitimate interest in the domain name, and that the domain name is being used in [[bad faith]].<ref name=slavitt/>

==See also==
* [[Bitsquatting]]
*{{annotated link|Domain Name System}} (DNS)
** [[Domain name spoofing]] &ndash; Phishing attacks that depend on falsifying or misrepresenting an internet domain name
**{{annotated link|Doppelganger domain}}
**{{annotated link|IDN homograph attack}}
*{{slink|Misdialed call|Toll-free numbers}} &ndash; Similar attacks on vanity [[phoneword]]s
*{{annotated link|Mousetrapping}}
*{{annotated link|Phishing}}
*{{annotated link|Slopsquatting}}
*{{annotated link|URL shortening}}

==References==
{{Reflist}}

==External links==
*{{cite news |last=Giles |first=Jim |date=17 February 2010 |title=Typos may earn Google $500m a year |url=https://www.newscientist.com/article/dn18542-typos-may-earn-google-500m-a-year/ |work=[[New Scientist]] |location= |access-date=July 19, 2023}} (reporting research by Ben Edelman and Tyler Moore: [https://www.lightbluetouchpaper.org/2010/02/17/measuring-typosquattings-perpetrators-and-funders/ Measuring Typosquatting Perpetrators and Funders])
*{{cite web |url=https://www.internetcommerce.org/internet_commerce_association_announces_member_code_of_conduct_affirming_its_commitment_to_best_practices/ |url-status=dead |last=Corwin |first=Philip |date=September 13, 2007 |title=The Internet Commerce Association Code of Conduct |archive-url=https://web.archive.org/web/20160407011821/https://www.internetcommerce.org/internet_commerce_association_announces_member_code_of_conduct_affirming_its_commitment_to_best_practices/ |archive-date=April 7, 2016 |access-date=2007-09-13 |website=InternetCommerce.org |publisher=Internet Commerce Association |quote=}}

<!--spacing-->

{{Domain parking}}

[[Category:Cybercrime]]
[[Category:Network addressing]]
[[Category:Nonstandard spelling]]
[[Category:Trademark law]]
[[Category:URL]]