Typosquatting is the practice of registering domain names that closely resemble a legitimate one — exploiting common typos ("gooogle.com"), swapped characters, different top-level domains, or visually similar letters ("rn" for "m", a Cyrillic "а" for a Latin "a"). The goal is to catch users who mistype a URL or fail to notice the difference, sending them to a page the attacker controls.
These look-alike domains are a backbone of phishing, credential theft, and brand impersonation. For investigators, typosquatting is both a threat to detect and a lead to follow: enumerating the look-alikes around a brand, then checking their WHOIS records and DNS infrastructure, can reveal a phishing campaign's scope and connect multiple malicious domains back to a single operator.