Notable Cases of Typosquatting
Author: Domeny.ForSale editorial team Published
In brief: Typosquatting involves registering addresses similar to a legitimate domain to exploit a user’s typing mistake or inattention. Notable cases involve brands such as Verizon and Microsoft, as well as traffic captured by John Zuccarini. These domains were used to display advertisements, redirect visitors, steal information, or make it difficult for users to leave a site.
What exactly is typosquatting?
Typosquatting is a form of cybersquatting: exploiting domains associated with someone else’s name or trademark. Its defining feature is a mistake a user might make when typing an address: an omitted letter, a substituted character, an incorrect sequence, or an extra character.
If the legitimate address were the example domain bezpiecznybank.pl (Polish for “safe bank”), an attacker might be interested in variants such as bezpiecznybnak.pl or bezpieczny-bank.pl. The first exploits transposed letters, while the second is not a typo in the strict sense but can serve the same purpose: looking credible at first glance.
Not every similar domain is automatically unlawful. Relevant factors include how it is used, the risk of confusion, rights to the name, and the registrant’s intent. Assessing a particular case may require an analysis of the registry’s terms, dispute resolution rules, and applicable law.
John Zuccarini and large-scale capture of typo traffic
John Zuccarini was one of the best-known typosquatters. He registered numerous domains exploiting mistakes in the names of popular websites and brands. Anyone who mistyped an address would land on sites earning money from advertisements or redirects; some also led to pornographic content.
His activities are associated with a technique known as mousetrapping. This involved opening additional browser windows or making it difficult to leave a website, so that an accidental visit generated further ad impressions. US authorities and courts dealt with Zuccarini’s cases, and his name became an example of the commercial exploitation of typo domains registered on a large scale.
This case shows that typosquatting does not necessarily mean password theft. Traffic from accidental visitors can have value in its own right if the domain owner monetises every visit.
Verizon versus OnlineNIC
Verizon’s high-profile dispute with registrar OnlineNIC concerned hundreds of addresses similar to the US telecommunications brand’s trademarks. These included variants using misspellings of the Verizon name. The domains directed traffic to pages containing advertisements and commercial links.
A US court entered a default judgment in Verizon’s favour and awarded substantial statutory damages. The case is often cited because it involved not a single, incidental address, but an organised portfolio of domains profiting from their resemblance to a protected brand.
It also illustrates the difference between defensive registration and typosquatting. A company can buy the most obvious typo variants of its own domain and redirect them to the correct website. A third party registering those same variants to profit from customers’ mistakes is acting with an entirely different purpose.
Microsoft versus Shah
Microsoft brought a case against Amar Shah and related entities over domains resembling the names of its products and services. The allegations included registering misspelled variants and directing users to pages with advertisements. The dispute ended in a settlement involving payment and the transfer of domains.
The important element here was the recurring pattern: numerous similar addresses, exploiting brand recognition, and monetising visits resulting from mistakes. A single typo may look harmless, but an entire network of such domains can capture traffic intended for various products or services offered by one company.
Typos, homographs, and misleading extensions
Not all trap domains are classic examples of typosquatting. A homograph attack uses characters that look similar but are actually different characters—for example, the Latin a and its counterpart from another alphabet. Changing the extension, such as replacing .com with another one, is sometimes described as TLD confusion or impersonation using a lookalike domain.
For users, the terminology matters less than the outcome. Before logging in or making a payment, check the entire address, not just the name at the beginning. It is safer to open a bank, shop, or company portal from a bookmark than to type the domain manually or follow a link sent in a message.
How to reduce risk on both sides
A brand owner should first identify a few of the most likely mistakes: a missing letter, a doubled character, transposed adjacent letters, and an incorrect extension. Registering every possible variant is usually impractical, so addresses associated with logins, payments, and customer service should take priority. Monitoring new domains similar to the company’s name is also useful.
After discovering a suspicious address, preserve evidence of its use, identify its operator, and check the applicable dispute procedure. Depending on the extension and circumstances, this may involve an abuse report, an arbitration proceeding such as UDRP, or court action. This is general information, not individual legal advice; current rules and evidentiary requirements should be confirmed with the registry operator, dispute resolution provider, or a lawyer.
The practical next step is simple: bookmark your most important websites, and at your company, check a few of the most obvious typo variants of the domain used for email and payments today.
See also: Domains and phishing—how can you protect customers from impersonation?
Read also
