Typosquatting: The Trending Cybersecurity Hack Your Business Should Know About

You can’t understand typosquatting without first digesting a far-simpler concept: the typo. 

Those who take pride in typing at the speed of sound are bound to make a typo here and there. Hackers know this, and they’re taking advantage of your typos through a tactic known as typosquatting.

Although companies that provide client-side security, like Feroot, are fully aware of typosquatting and work to protect companies from this form of attack, most businesses are unaware that it exists. As you know, the consequences of a breach could be substantial for your business and the issue of typosquatting warrants your attention as well.

Typosquatting “tricks” users into visiting malicious sites with URLs that are “common misspellings of legitimate websites.” Visiting web pages like Amazin.com and Googke.com has never been so perilous. 

Typosquatting is a form of social engineering, an approach by which hackers exploit the vulnerabilities of human error—in this case, imperfect typing. As cybersecurity professionals have learned to combat the tactic, typosquatting has become increasingly sophisticated. Its evolution continues with each passing day.

By understanding the origins of typosquatting and its current state, you may be better able to protect your organization from related breaches. 

The Origin of Typosquatting

In the most basic sense, typosquatting occurs when someone registers a domain that is similar to a more well-known, legitimate domain. Registering the look-alike domain is typically the first step in a grander scheme.

The practice of typosquatting dates back to at least the early 2000s. Back then (and possibly before), typosquatting was a tool for online pranksters to divert unwitting marks to X-rated webpages. It didn’t take long for scammers to recognize typosquatting’s potential as a money-making practice.

Most hacking schemes share a common goal: procure sensitive information to exploit victims financially. Social security numbers and credit card details will do just fine. Both crude and complex typosquatting schemes generally share this financial motive.

Hackers have aimed their sights higher since the earliest days of typosquatting. As a result, the scale and complexity of these type of hacks are accelerating at an alarming pace.

The Alarming Evolution of Typosquatting 

Typosquatting has evolved in both scope and style. Hackers are engaging in this type of cyber attack more frequently and doing so in increasingly creative iterations.

Watchdog organizations detect tens of thousands of deceptive URLs per day. Hackers cleverly target victims with mass-appeal topics like elections, consumer goods, and health. This barrage of malicious look-alike URLs across a broad spectrum of interests puts internet users in a vulnerable spot.

The stakes of typosquatting have also risen. Once upon a time, typosquatters targeted:

• Credit and debit card details
• Social security numbers
• Valuable usernames and passwords
• Professional credentials

Hackers will gladly accept these treasures today. However, they can do far more damage by holding entire supply chains for ransom.

Hackers have increased their odds of success by deploying target-specific typosquatting campaigns. By closely emulating the email address of a supply chain partner, for example, a hacker may dupe a victim into providing compromising information. They may then infiltrate and disrupt an entire supply chain network.

This cybersecurity threat is fundamentally similar to its earliest iterations. However, hackers have gathered ample data on which approaches work best. This is bad news for internet users who lack the most discerning of instincts.

Make sure your organization is insulated from typosquatting schemes. Third-party security firms specialize in these types of attacks and are a worthwhile resource for businesses and corporate security teams alike.