What Is Typosquatting? How to Protect Your Business

Nathan Hill-Haimes, Technical Director | 7 min read · Mar 2026

What is typosquatting?

Typosquatting — also called URL hijacking or domain mimicry — means registering domain names that are slight variations of a legitimate domain, designed to catch people who mistype a URL or do not look closely. A criminal might register amv1a.co.uk or amvla.co.uk to impersonate amvia.co.uk, betting that many readers will not spot the difference in a phishing email or a browser address bar.

Domain registration is cheap — a.co.uk domain costs a few pounds per year — so an attacker can register dozens of variants of a target domain for very little. The potential return from one successful phishing attack dwarfs that outlay, which makes typosquatting an economically rational tactic for criminals targeting a specific business or brand. It sits alongside email impersonation as a core ingredient of modern phishing protection thinking, and it is why domain-level monitoring belongs in any serious managed cybersecurity programme.

How do typosquatting attacks actually work?

Typosquatting is rarely the whole attack — it is the prop that makes the real attack convincing. The lookalike domain lends false legitimacy to a phishing email, a cloned login page, or a hijacked supplier conversation. Below are the four patterns we see most often against UK SMEs.

Phishing via email

Typosquatted domains are frequently used as the sending domain for phishing emails. An email from `accounts@barclays-online-secure.co.uk` looks convincing to a recipient who does not examine the full domain. The typosquatted domain passes some technical checks — it has its own SPF, DKIM and DMARC records — because it is a genuinely registered domain, just not the real brand's domain. Phishing remains the most common type of breach reported by UK businesses, according to the government's Cyber Security Breaches Survey 2025.

Fake websites

A typosquatted domain can host a website that visually mimics the legitimate business — same design, same content, cloned from the real site — with a login form that quietly steals the credentials people enter after landing there by mistake. This works especially well against businesses with public-facing login portals, where users expect to type a username and password.

Business email compromise support

Criminals running business email compromise (BEC) attacks sometimes place a typosquatted domain in the reply-to address of an email that appears to come from a real supplier. Replies from the victim go to the criminal's inbox rather than the genuine supplier's, letting them intercept and steer the conversation — often towards a fraudulent change of bank details.

Software package hijacking

A specific variant targets developers who install packages from repositories like npm or PyPI. A malicious package named `reqests` instead of `requests` can be installed by accident and run hostile code inside a development or production environment. The same human reflex — not reading carefully — that powers email typosquatting powers this supply-chain version too.

Who is most at risk from typosquatting?

Any business with a public-facing web presence and a recognisable brand is a potential target. The highest-risk categories are those where a stolen login or a redirected payment causes immediate financial or regulatory damage, and where customers routinely receive emails carrying the brand's domain.

• Financial services firms with online client portals
• Professional services firms — law firms, accountants — whose domains appear in client communications involving money
• E-commerce businesses where users log in and enter payment details
• Any business with a well-known brand attackers can borrow to build credibility

SMEs are not immune. Criminals often pick smaller firms precisely because they are less likely to have brand or domain monitoring in place than large corporations — a gap AMVIA closes as part of a single, accountable security service.

How do you detect a typosquatting attack?

The primary detection tool is domain monitoring. Services that watch newly registered domains for variations of your brand name can alert you within hours of a typosquatted domain being registered — giving you time to investigate and, if needed, pursue takedown before it is weaponised. Speed matters because the damage starts the moment the domain is used, not the moment it is registered.

Free tools such as dnstwist generate lists of likely typosquatting variants of a domain and check whether they are already registered. Commercial brand-protection services add automated monitoring, alerting and takedown assistance. The NCSC also runs a Suspicious Email Reporting Service that helps remove malicious sites once they appear.

How do you protect your business from typosquatting?

Effective protection is layered, because no single control stops every variant. The combination below removes the easiest attack routes, surfaces the rest quickly, and gives your staff the awareness to catch what slips through.

Working through that stack in practice:

• Defensive domain registration: Register the most likely typosquatting variants of your primary domain — common misspellings, singular/plural forms, hyphenated versions — and redirect them to your real site. A five-domain defensive registration might cost £20-50 per year. It is not feasible to register every possible variant, which is why this pairs with monitoring.
• Domain monitoring: Automated monitoring for new registrations that closely resemble yours, with alerting so you can investigate suspicious registrations quickly.
• Staff and customer awareness: Train staff to read the full domain before entering credentials, and warn customers to verify the URL they are visiting.
• Email security gateway with impersonation detection: A gateway that flags near-match domain impersonation in inbound email adds a technical layer against typosquatted phishing. AMVIA delivers this through the email security controls in the Barracuda suite.

A common misconception is that authentication on your own domain solves the problem. Enforcing DMARC at `p=reject` stops criminals sending email as your exact domain — see our guide to email spoofing for how that works — but it does nothing against typosquatted domains, which are independently registered and carry their own DMARC records. Those still require monitoring and defensive registration.