Typosquatting

Typosquatting is the practice of registering a domain name that's a deliberate misspelling, extra hyphen, or lookalike variant of a well-known brand's real address, then using it to catch people who mistype the URL or click a manipulated link. In advertising, it shows up two ways: as the final destination behind a native ad that never mentions the brand it's impersonating, and as a cloaking layer that shows a clean page to reviewers while sending real visitors somewhere else entirely.

How it shows up in native and programmatic ads#

A typosquat domain almost never earns its own ad placement by advertising honestly. It rides in on other tactics instead. A bad actor might register something like "amaz0n-rewards.com" and drive traffic to it through a disguised chain that starts on a legitimate-looking native creative and ends on the typo domain several hops later. Because the domain never appears in the ad itself, a quick manual review often misses it; you have to actually follow the click tracking domain to the real endpoint to catch it. That's the same mechanic behind most ad cloaking: show the network's crawler one page, show a paying visitor another.

Typosquatting also overlaps with phishing ads, where the fake domain mimics a bank, retailer, or software brand closely enough that a rushed visitor enters credentials or card details without noticing the swapped letter. And it's a favorite ingredient in copycat landing pages, where the typo domain hosts a near-identical clone of a real brand's page to borrow its credibility for a few hours before it gets pulled.

Why it matters for advertisers and brands#

For the brand being squatted, the cost is direct: lost sales, damaged trust, and sometimes real financial fraud committed in its name. For advertisers running legitimate native campaigns, typosquatting matters because it pollutes the same ad supply chain you're trying to use profitably. A network that tolerates a lot of typosquat traffic tends to have looser brand safety controls across the board, which is worth weighing when you decide where to put spend.

Catching it usually means monitoring domain registrations for close variants of your own brand and auditing where affiliates or resellers actually send their traffic. It also means watching which domains appear as landing pages across networks, since a typosquat site running paid native ads is a pattern you can spot before a customer files a complaint. Some variants swap a single character for a visually similar one (a zero for an "o", a lowercase "l" for an "i"), which is harder to catch on a quick glance than an obvious misspelling, so automated monitoring tends to outperform manual spot checks.

A searchable index of captured ads and their landing pages across Taboola, Outbrain, MGID and other networks (see pricing for the plans that include search) makes this kind of check routine rather than a fire drill. If you do find one, reporting the scam ad to the network and the domain registrar is the fastest way to get it taken down.