TechKnowSurge
TechKnowSurge Catalog Videos Typosquating
VideoSecurityFree

Typosquating

Typosquatting is a cyberattack in which malicious actors register misspelled or lookalike domains to impersonate legitimate websites and deceive unsuspecting users. It is also known as URL hijacking, cousin domain, sting site, or fake URL.

⚑ Complete this video to capture a CTF flag worth 1 point.

About this video

Typosquatting is a form of impersonation attack in which a threat actor registers a domain name that closely mimics a legitimate website, typically by introducing a small spelling variation such as a transposed, missing, or substituted character. When a user mistypes a familiar web address, they are redirected to the fraudulent site, which is often designed to appear nearly identical to the real one in order to harvest credentials, distribute malware, or conduct phishing campaigns. The attack is highly effective because it requires no technical compromise of the target organization — it simply exploits predictable human error. The technique is known by several names in the industry, including URL hijacking, sting site, cousin domain, and fake URL, all of which describe the same fundamental mechanism. Two closely related concepts are cybersquatting, where a domain is registered to exploit or profit from another entity's brand, and brandjacking, which involves the unauthorized use of a company's logos, trademarks, and visual identity to fraudulently represent that organization. Understanding these distinctions is important for both defenders building domain monitoring programs and end users learning to verify URLs before entering sensitive information.

What you'll learn

What's covered

Typosquatting

Key terms

Typosquatting
A form of impersonation that registers misspelled or look-alike domain names to deceive users into visiting fraudulent websites.
URL Hijacking
An alternate term for typosquatting, where a deceptive URL is used to redirect users to a malicious or impersonating website.
Cybersquatting
An impersonation technique where an attacker registers a domain name that mimics a legitimate brand or organization to deceive users.
Brandjacking
An attack in which a threat actor uses another organization's trademarks, logos, or brand identity to impersonate and misrepresent that organization.
Spoofing
An attack where an adversary impersonates a trusted entity by falsifying data such as an IP address or email address.

Topics

Typosquatting Impersonation Attacks Url Hijacking Brandjacking Social Engineering Cybersecurity

Transcript

Typosquatting is a type of impersonation attack. If you were to set up a website that mimics somebody else's website, and the domain is really closely related, so it looks like the illegitimate website, that would be an example of typosquatting.

The key to this is the term typo right there. Typo as in you misspelled something. So if I'm trying to go to www.microsoft.com but I misspelled something right here, I put a T instead of an R right there, and suddenly I find myself on this typosquatted site, this site that's been mimicked. It represents itself as being Microsoft, but actually it's the scammer.

Other names for this attack

This type of attack goes by many different names besides just typosquatting. You could call it URL hijacking, a sting site, a cousin domain, or a fake URL.

Very similar concepts that have a lot of overlap would be cybersquatting, where once again you're impersonating another brand, and brandjacking, where you're using their trademarks and their logos and different aspects of the company to represent or misrepresent yourself and who you are.

About TechKnowSurge

TechKnowSurge builds IT and cybersecurity professionals through hands-on, concept-first training built around real understanding — not memorization. Free interactive tools, structured programs, and 25+ years of real-world experience, all in one place.

Explore free tools and programs →