miji.beTyposquatting is an attack technique that registers look-alike domains targeting typos of well-known domain names and lures users who access them by mistake to malicious sites. Typical examples are domains generated by adding / deleting / substituting / transposing a single character, such as googel.com, amazom.com, and faceboook.com.
After acquiring a typo domain, the attacker sets up phishing sites, malware distribution pages, parking pages aimed at advertising revenue, and the like. Besides targeting the mistakes users make when typing a URL into the address bar by hand, attackers sometimes use URLs that closely resemble a legitimate domain in links in emails and messages. Some techniques also exploit characters that are hard to tell apart visually (l and 1, O and 0, rn and m).
URL shorteners are also targets of typosquatting. Look-alike domains that differ by only one character are used, as with blt.ly against bit.ly. There is also a technique of brute-forcing the random string part of short URLs (e.g., bit.ly/abc123) to discover valid links and abuse them. Providers of URL shorteners can reduce damage by registering look-alike domains in advance and monitoring domains.
As a defense, one method is to register typo domains related to the company's own brand in advance and redirect them to the legitimate site. Integration with browsers' Safe Browsing features and security training for employees are also used. Another method is to encourage users to check the domain of a trusted service accurately when using short URLs. Under ICANN's Uniform Domain-Name Dispute-Resolution Policy (UDRP, the version updated on February 21, 2024 and applied from August 21, 2025), trademark holders can file a proceeding covering domains handled by ICANN-accredited registrars and some country-code domains that have adopted the policy. The proceeding seeks cancellation or transfer of a domain name that is identical or confusingly similar to a trademark, in which the registrant has no rights or legitimate interests, and that has been registered and is being used in bad faith. In the United States, the Anticybersquatting Consumer Protection Act (15 U.S.C. §1125(d)) makes the registration, trafficking, or use of such domain names with a bad faith intent to profit from a trademark subject to civil actions brought by the trademark holder.