Typosquatting Explained: How Lookalike Domains Work
Typosquatting is registering a domain name that's a small variation on someone else's, close enough that a mistyped address, a careless click, or a quick glance lands on it instead of the real thing. It's the same idea behind subdomain takeover in spirit, taking advantage of trust in a name, just aimed at the domain itself instead of infrastructure someone forgot to clean up.
Last updated: August 30, 2026
What makes a domain a good typosquat target?
Almost any small edit to a domain name works, because the goal isn't to fool a computer, it's to fool a person moving quickly. MS-ISAC's typosquatting primer groups the common techniques into six categories: a character removed (omission), a character doubled (addition), a character swapped for a keyboard-adjacent one (substitution), two adjacent characters swapped (transposition), a hyphen inserted (hyphenation), and visually similar characters substituted (homoglyph). On top of those, registering the same name under a different ending, .net instead of .com, is common enough to count as its own category.
Homoglyphs: when the letters aren't even the same letters
The simplest homoglyphs are plain ASCII: an rn that reads as m, a 0 that reads as o, a lowercase l that reads as a 1. The more sophisticated version uses Unicode. A handful of Cyrillic letters, among others, are rendered identically or near-identically to their Latin counterparts in most fonts, so example.com can be recreated with a single Cyrillic character swapped in and still look correct at a glance. Browsers and registries defend against this with the confusable-detection rules in Unicode Technical Standard #39, which is also why a domain like that usually displays in its punycode form, something starting with xn--, once a browser detects the mixed script.
How to check whether you've been typosquatted
- List the small edits someone could make to your domain, one character removed, doubled, swapped, or transposed, plus a hyphen and the common TLD variants.
- Check whether each variant is actually registered rather than just guessing, plenty of superficially "risky-looking" names are simply unclaimed.
- For anything registered, check what it's actually being used for before assuming the worst: a parked page and an active phishing site call for very different responses.
- Decide whether it's worth acting on, a UDRP complaint through ICANN, a report to the registrar, or simply monitoring it, depending on what you find.
Common mistakes
- Assuming a registered lookalike is automatically malicious. Plenty are simply unrelated to your brand, or registered by someone defending their own similar name.
- Only checking the obvious typos and missing TLD swaps, which are just as easy for someone to register and just as easy for a user to land on.
- Assuming your own SPF, DKIM, and DMARC protect you here. They don't. A typosquatted domain is a completely separate domain, and its owner can publish their own authentication records for it.
- Treating a clean check as permanent. New variants get registered over time, so this is worth revisiting periodically, not just once.
Generate the common typo and homoglyph variants of a domain and see which ones are actually registered.
Frequently asked questions
Is registering a typosquatted domain illegal?
It can be, depending on intent and jurisdiction. In the US, the Anticybersquatting Consumer Protection Act covers domains registered in bad faith to profit from someone else's trademark, and the UDRP process lets a trademark holder challenge a domain through ICANN-accredited arbitration instead of a lawsuit. Neither one is automatic. Someone typically has to file a complaint.
Should I register every lookalike of my domain myself?
Not every one. Registering dozens of variants defensively gets expensive fast and most brands don't need all of them. It's more practical to prioritize the handful that are the easiest typing mistakes and the most common TLD swaps, and monitor the rest instead.
What should I do if I find a lookalike that's already registered?
Check what it's actually being used for before assuming the worst. A parked page, an ad-filled placeholder, or a page impersonating your brand are each a different situation, and the response ranges from ignoring it to a UDRP complaint to reporting active phishing to the registrar or a browser's Safe Browsing program.
Can a typosquatted domain send email that looks like it's from me?
Yes, and this is one of the more common uses of a lookalike domain. Since it's a real domain the attacker controls, they can publish their own SPF, DKIM, and DMARC records for it, so the mail passes authentication checks. Nothing about your own domain's setup can stop that. The defense is on the recipient's side: training people to check the actual sending domain, not just the display name.