What Is Typosquatting? How Lookalike Domains Mislead Users

Typosquatting is the registration or use of a domain name that resembles another domain by exploiting likely typing, reading, or spelling mistakes. A person who omits a letter, swaps two characters, presses a neighboring key, or trusts a nearly correct link can arrive at the lookalike domain instead of the intended site.

The lookalike may show ads, imitate a login or payment page, distribute software, redirect elsewhere, or simply remain parked. Context matters: not every typo domain is malicious, and a misspelling alone does not prove who registered it or why. The practical safety question is whether the registrable domain belongs to the organization you intended to reach.

Key Takeaways

• Read the registrable domain, not just a familiar word, logo, subdomain, or search-result title.
• Common variants include deletion, insertion, substitution, adjacent-key errors, and transposition.
• Typosquatting overlaps with phishing and brand abuse but is not identical to homograph attacks or broad cybersquatting.
• Visitors should leave the site and use a trusted route; brand owners should preserve evidence before reporting to the registrar, host, platform, or an appropriate dispute process.

How does typosquatting work?

An attacker or opportunistic registrant predicts mistakes around a popular domain and registers variants that are still available. The domain can attract people who type an address directly, but it can also be placed in email, text messages, QR codes, social posts, support replies, or sponsored search results. The victim does not have to make the typo personally; the sender may provide it.

CISA and the FBI describe how impersonating domains can make official-looking communications and websites more convincing. Their guidance emphasizes control of a trusted government domain because visual similarity and familiar naming can otherwise create impersonation risk.［1］ The same principle applies generally: recognizable words do not establish ownership.

A typo site may immediately copy the expected brand, redirect through several pages, or wait for particular visitors. It may collect usernames, payment details, recovery codes, or downloads. Some domains instead display unrelated ads or offer themselves for sale. That is why the domain pattern is a warning signal, not a complete verdict.

What are the common typo-domain patterns?

The exact variants depend on spelling, keyboard layout, language, and top-level domain, but several patterns recur.

Pattern	What changes	Illustrative form for example.com
Deletion	One character is omitted	exmple.com
Insertion	An extra character is added	exammple.com
Substitution	A character is replaced	examp1e.com
Adjacent key	A nearby keyboard key is pressed	rxample.com on a QWERTY keyboard
Transposition	Two neighboring characters switch order	examlpe.com
Hyphen or word split	Punctuation changes the visual rhythm	exam-ple.com
Different suffix	The label is reused under another public suffix	example.net

These are examples, not a detection formula. A legitimate company may own defensive variants, regional domains, or campaign domains. A separate company may legitimately use a similar dictionary word. Conversely, an attacker can use a domain with no obvious typo and rely on a deceptive subdomain or page title.

The FBI also warns that slight spelling variations can accompany sponsored search results that imitate employee self-service sites.［2］

What is the registrable domain, and how do you find it?

The registrable domain is the portion a registrant controls under a public suffix. In a simple address such as login.example.com, example.com is the registrable domain and login is a subdomain. A deceptive address can place a trusted name on the left—such as brand.security-check.example.net—while the actual registrable domain is example.net.

First identify the hostname in the URL, then ignore any path, query, or fragment that follows it. Next, identify the public suffix and the label immediately before it. Public suffixes can contain more than one label, so guessing that the last two words are always the registered domain is unreliable. Browsers and password managers already use maintained public-suffix information; ordinary users can usually avoid manual parsing by opening a saved bookmark or official app instead.

Do not treat HTTPS or a padlock as ownership proof. It only means the connection is encrypted to the domain shown. Also distinguish the hostname from path text: example.com.account-check.example.net has the registrable domain example.net, while unrelated.test/example.com has the hostname unrelated.test.

How is typosquatting different from homograph attacks and cybersquatting?

Typosquatting focuses on likely mistakes and near spellings. A homograph attack uses characters that look alike, potentially across writing systems, even when they are technically different. URL phishing is broader: it covers deceptive links and URL structures whether or not the registrable domain is a typo.

Cybersquatting is a legal and policy concept generally associated with bad-faith registration or use involving a trademark. ICANN explains that its Uniform Domain Name Dispute Resolution Policy provides an administrative process for certain disputes, with specific elements a complainant must establish.［3］ A strange or similar domain does not automatically satisfy those elements, and a dispute proceeding is not the same as an emergency malware takedown.

Term	Main characteristic	What it does not prove by itself
Typosquatting	Variant exploits a likely typing or spelling error	Malicious intent or trademark rights
Homograph	Different characters look visually similar	That the victim typed the address
Cybersquatting	Claimed bad-faith domain registration involving rights	That every similar domain is unlawful
URL phishing	Link or page deceives the recipient	That the domain must be a typo

The labels can overlap. A typo domain used for a fake login may be both typosquatting and phishing. Evidence should describe the domain, content, delivery route, and requested action rather than relying on one label.

How should you check a suspicious domain?

Pause before signing in, paying, downloading, or calling a number shown on the page. Compare the whole registrable domain with a bookmark, official app, statement, product packaging, or another source you already trust. Do not use the suspicious page’s contact link to verify itself.

Search advertisements deserve particular caution. The FBI warns that criminals impersonate employee self-service websites and use sponsored search ads or slight spelling variations to steal credentials and funds. A top position or “Sponsored” label says that placement was purchased; it is not an identity check. For accounts and software, type the known domain or use a saved official route.

Check for a password-manager mismatch. If credentials normally fill on the genuine domain but do not appear, stop rather than forcing them into the form. Look for the same requested task inside the independently opened account. If no alert, invoice, password reset, or message exists there, report the original link.

What should you do after visiting a typo domain?

Match the response to what happened. Simply seeing a page is not the same as giving it secrets or running software.

Exposure	Immediate action	Follow-up
Only viewed the page	Close it; do not use its support or download links	Report the URL to the impersonated organization or delivery platform
Entered credentials	Change the password through the real site and revoke sessions	Change reused passwords and check recovery details, forwarding, and sign-ins
Entered payment or identity data	Contact the bank or relevant provider through a trusted number	Monitor accounts, preserve records, and follow local fraud-reporting guidance
Downloaded or executed content	Stop sensitive activity on the device and remove unknown downloads	Run trusted checks; secure accounts from a clean device if compromise is possible

If you only typed the address but the browser blocked it before loading, there may be nothing else to remediate. If a download began automatically, locate it without opening it and remove it. If you granted notification, extension, profile, or application permissions, revoke those separately.

What can a brand owner do about a lookalike domain?

Preserve evidence before it changes: the full URL, date and time, page content, delivery message, redirects, certificate or DNS details collected by authorized specialists, and any transaction or abuse identifiers. Do not submit real credentials or interact beyond what is necessary to document the report.

Choose the route that matches the harm. A search engine or social platform can review an abusive ad or account. A hosting provider may investigate phishing content. A registrar accepts domain-abuse reports but does not necessarily control the hosted page. A trademark owner may consider a UDRP or court process with qualified legal advice. Reporting to one party is not a guarantee of immediate suspension.

Defensive registration can reduce exposure for a small set of high-risk variants, but no organization can register every possible spelling, suffix, and script. Monitoring, predictable official domains, email authentication, fast reporting, and clear customer guidance are more durable. The online security guide, phishing-site guide, and explanation of WWW2 addresses provide related checks without treating every unfamiliar hostname as malicious.

Summary

Typosquatting uses a lookalike domain to benefit from mistakes or misplaced trust. The strongest everyday defense is to identify the registrable domain or bypass the questionable route entirely by using a bookmark, official app, or manually entered address. A typo is a reason to verify, not automatic proof of crime. If exposure occurred, secure the account, payment method, or device according to the action taken and preserve evidence for the appropriate platform or domain-abuse channel.

Frequently asked questions

Is every misspelled domain malicious?

No. It may be a defensive registration, an unrelated legitimate name, a parked domain, or an abandoned project. Treat the spelling as a warning and evaluate ownership, content, delivery, and requested action.

Can a typosquatting site have HTTPS?

Yes. HTTPS certificates are widely available and authenticate control of the requested domain, not a relationship with the brand it resembles.

Is changing .com to another suffix typosquatting?

It can be part of a lookalike strategy, but the classification depends on context. Different organizations can legitimately use the same word under different suffixes.

Does a search engine’s top result prove the domain is official?

No. The result may be an advertisement, a manipulated listing, or a page whose title resembles the brand. Use a trusted official route for sign-ins and downloads.

What should I do if my password manager does not fill?

Stop and inspect the real domain. Open the service from your bookmark or app. Do not paste the password merely to work around the mismatch.

Can a registrar remove a typosquatting website?

A registrar can investigate reports under its policies, but hosting, content, and registration are different layers. Outcomes depend on evidence, contracts, policy, and applicable law.

Should a company register every possible typo?

Usually that is impossible. Prioritize the most plausible and harmful variants, then combine selective registration with monitoring, clear official-domain guidance, and rapid reporting.

What evidence should I keep for a report?

Keep the full URL, time, original message or ad, screenshots of the page, redirects if safely collected, and any financial or account impact. Avoid revisiting the site solely to gather more material.

This article provides general security information and is not legal advice about domain-name rights or disputes.

Sources

1. CISA and FBI — https://www.cisa.gov/sites/default/files/2024-04/CISA-FBI-The_.gov_Domain-Helping_Mitigate_Election_Office_Cybersecurity_and_Impersonation_Risks_v2_508c.pdf
2. FBI — https://www.fbi.gov/investigate/cyber/alerts/2025/cybercriminals-impersonating-employee-self-service-websites-to-steal-victim-information-and-funds
3. ICANN — https://www.icann.org/resources/pages/cybersquatting-2013-05-03-en

Sources checked 28 August 2026.