Typosquatting

Typosquatting is a phishing technique where attackers use look‑alike domain names that rely on common typing mistakes to trick people into trusting a fake website or email sender.

What does typosquatting look like?

Attackers register domains that are almost identical to legitimate ones, such as:

• Missing letters
• Extra letters
• Swapped letters
• Similar‑looking characters

For example:

• micros0ft.com instead of microsoft.com
• paypai.com instead of paypal.com
• itambulnace.co.uk instead of itambulance.co.uk

These domains are then used in emails, links, or login pages to capture passwords or spread malware.

Why it’s dangerous

Typosquatting works because:

• The domain looks trustworthy at a glance
• People don’t always spot small spelling differences
• The email or website often copies branding and layout

Security training materials and phishing campaigns regularly use this technique because it’s highly effective at getting clicks.

Where you’ll usually see it

• Email sender addresses
• Links inside emails
• Fake login pages
• Search engine ads

Many modern email security tools explicitly include typosquatting detection because of how common this attack type has become.

How to protect yourself

• Read domain names carefully, not just the display name
• Hover over links before clicking
• Be extra cautious with login pages reached via email
• If something looks nearly right, assume it isn’t

Key takeaway

Typosquatting relies on tiny mistakes, slowing down is your best defence.