---
title: "What Is Typosquatting? Examples and How to Protect a Brand"
description: "Typosquatting is registering a domain one typo or look-alike letter away from a real one, so mistyped addresses land on a copy. How to spot and prevent it."
url: https://proxynet.io/blog/typosquatting
date: 2026-11-07
author: "Acar Diveroli"
category: "Proxies, Use Cases"
lang: en
---

# What Is Typosquatting? Examples and How to Protect a Brand

An accountant receives a note from a supplier: the bank account for invoices has changed. The email is signed by the right person, quotes the right order numbers and comes from a domain that reads like the supplier's, one letter different. Nobody notices until the real supplier asks where the payment went.

This post explains what typosquatting is, which variants exist, what a look-alike domain is used for, how to recognise one and what a brand can do about it. It is written for the defending side; there is no recipe here, and every example is built on `example.com`, a domain reserved for documentation.

> **Note: Short answer**
>
> Typosquatting is the registration of a domain name one typing error or one look-alike character away from a real one, so that people who mistype an address or skim a link land on a site the brand does not control. The copy serves phishing, malware, ads or misaddressed email. Read the registrable part of a domain letter by letter; brands register the obvious variants, lock their email, watch registrations, report abuse and recover domains through the UDRP.

## What is typosquatting?

Typosquatting, also called URL hijacking, is the registration of domain names that imitate an existing one through a spelling mistake, a swapped ending or a character that looks like another. The squatter does not break into anything. They own a real domain, and they rely on the fact that a machine reads a name letter by letter while a person reads it as a word.

It is a branch of cybersquatting, the registration of someone else's name or trademark as a domain. Cybersquatting takes the exact name under an ending the brand forgot; typosquatting takes the near misses. Dispute rules treat both as abusive registrations.

## How does typosquatting work?

1. **A target with traffic.** A bank, a shop, a software vendor or a supplier that sends invoices: the more people type or receive the name, the more misses it produces.
1. **A list of near misses.** Every domain has a few likely typos, a few look-alike spellings and a handful of alternative endings. The squatter checks which are still free.
1. **Registration.** A domain costs a few dollars a year and resolves within minutes; a certificate for it is issued just as fast.
1. **Traffic arrives.** By hand, from people who mistype; by link, from emails the squatter sends; by search, when the look-alike is pushed into the results, which is what [SEO poisoning](/blog/seo-poisoning) does.
1. **The page does its job.** A login copy, an installer, a parking page full of ads or a mailbox that collects whatever was sent to the wrong address.

Nothing on the network side distinguishes a mistyped name from a correct one: the browser asks DNS for the address behind the name it was given, and a registered name gets an answer ([What Is DNS?](/blog/what-is-dns) covers the lookup). The only check that sees the mistake is the person reading the address bar.

## What kinds of typosquatting are there?

| Variant | Example | Why it works |
|---|---|---|
| Missing letter | `exmple.com` | The eye reads the word, not its letters |
| Swapped letters | `exmaple.com` | The most common typing error |
| Neighbouring key | `exampke.com` | `k` sits next to `l` on the keyboard |
| Look-alike characters | `exarnple.com`, `examp1e.com` | `rn` reads as `m`, `1` as `l` |
| Different script (homograph) | `xn--exmple-4nf.com` | A Cyrillic `а` has the shape of a Latin `a` |
| Wrong ending | `example.co`, `example.cm` | Typed from habit; both endings exist |
| Added word (combosquatting) | `example-login.com` | The brand word is intact; the extra word sounds official |
| Subdomain trick | `example.com.example.net` | The real name comes first; the actual domain is at the end |
| Missing dot | `wwwexample.com` | The `www.` habit |

**Look-alike characters** are the dangerous end of the table: `rn` for `m`, `vv` for `w` and `1` for `l` survive a quick look. The homograph variant goes further: a name spelled with Cyrillic letters can look identical to the Latin original, and browsers show such names in their `xn--` form, called punycode, when they look suspicious.

**Combosquatting** is the variant most phishing emails use, because it is not a typo at all: `example-login.com` contains the brand word unchanged. **Bitsquatting** needs no human error; a flipped bit in a device's memory turns one letter of a stored name into another.

## What does a typosquatted site do?

**Copies a login page.** The page looks like the brand's sign-in form and forwards what you type to the squatter, sometimes passing it on to the real site so that the login appears to work. A captured password is usually tried on other services within hours; [What Is Credential Stuffing?](/blog/what-is-credential-stuffing) explains that second step.

**Delivers software.** A look-alike of a vendor's download page offers the real installer bundled with malware. The file may carry a valid signature; the domain is what gives it away.

**Earns on the traffic.** Parking pages show ads for the brand's own products and get paid per click; affiliate redirects send the visitor on to the real site through a referral link, so the brand pays commission for a customer it already had.

**Receives email.** A domain one letter away from a company's mail domain collects every message sent to the mistyped address: invoices, contracts, password resets. WIPO's report on its 2025 caseload, over 6,200 domain name cases and the most it has handled, mentions a domain that "nearly diverted USD 800,000 to a fraudulent bank account" before the case stopped it ([WIPO, January 2026](https://www.wipo.int/en/web/amc/w/news-domain-name-disputes/2026/news_0001)).

## Typosquatting in package registries

The trick is not limited to websites. On npm and PyPI a package name is typed into an install command, so a package one letter away from a popular one gets installed by mistake, and installing it runs its code. npm's threat documentation says the registry can detect such names and block their publication.

The registries' own domains are targeted too. In July 2025 PyPI users received "email verification" messages linking to `pypj.org`, a look-alike of `pypi.org` with a lowercase `j` for the `i`; the site relayed the real one, four accounts were phished and two malicious releases were uploaded before the domain was taken down. PyPI's [incident report](https://blog.pypi.org/posts/2025-07-31-incident-report-phishing-attack/) says the registry itself was not breached and recommends WebAuthn or hardware security keys, because a relayed one-time code does not survive those.

For developers: copy install commands from the project's documentation rather than from memory, and use a lockfile so that a typo made once is not repeated on every machine.

## How do you recognise a typosquatted domain?

1. **Find the registrable part and read it letter by letter.** The ending and the label just before it are the domain someone registered; everything to the left is a subdomain they chose. In `example.com.example.net` the domain is `example.net`.
1. **Treat `xn--` as a warning.** Chrome shows a label in Unicode only when it passes its [IDN display rules](https://chromium.googlesource.com/chromium/src/+/main/docs/idn.md); a label that mixes Latin with Cyrillic or Greek, or whose "skeleton" matches a well-known domain, appears as punycode. A brand name you know should never appear that way.
1. **Trust your password manager, not the padlock.** A certificate proves only that the connection is encrypted and was issued for the domain shown, which the squatter owns. A password manager fills a form only on the domain where the password was saved; its silence on a familiar-looking page is the warning.
1. **Heed the browser's warning.** Chrome shows **Did you mean [site name]?**, **Is this the right site?** or **Fake site ahead** when a hostname matches the shape of a popular site, and the red **Dangerous site** page once a domain is on the Safe Browsing list. Keep Safe Browsing on under **More** > **Settings** > **Privacy and security** > **Security**, where **Enhanced protection** is the stricter level.
1. **Arrive by your own route.** Type the address, use a bookmark or open the app; a link in an unexpected email is the squatter's delivery channel. Read a sender's domain the same way and confirm any change of bank account by phone.

## How do brands protect themselves against typosquatting?

1. **Register the obvious variants.** The main endings, the country endings of the markets you sell in, and the few typos a permutation list ranks highest, all redirected to the canonical domain with an HTTP 301, the redirect Chromium's lookalike check recognises.
1. **Lock your email.** Publish SPF, DKIM and DMARC with a reject policy for the domain you send from, and an SPF record that authorises no sender on domains you own but never send from. DMARC protects your domain, not the look-alike.
1. **Watch registrations and certificates.** Generate the permutations of your domain with an open-source tool such as dnstwist and check on a schedule which are registered and what they serve; certificate transparency logs are public, so a certificate for a look-alike often shows up there first.
1. **Look at the page as your customers see it.** A look-alike rarely shows the same page to everyone: the office or a hosting network gets a parking page, a customer on a home connection in the targeted country gets the login copy. Check from the markets you serve before calling a domain harmless.
1. **Report what is live.** Phishing and malware pages go to Google's [Safe Browsing report form](https://safebrowsing.google.com/safebrowsing/report_phish/), which feeds the browser warnings; send the same evidence to the registrar's abuse contact, which ICANN requires every registrar to publish, and to the host or CDN in front of the site. A first report can be rejected, as PyPI's was; send it again with more detail.
1. **Recover the domain.** WIPO's [UDRP guide](https://www.wipo.int/amc/en/domains/guide/) sets out what a complainant proves under the Uniform Domain Name Dispute Resolution Policy: the domain is identical or confusingly similar to a mark you hold, the registrant has no rights or legitimate interests in it, and it was registered and is being used in bad faith. A case "normally should be completed within 2 months", costs USD 1,500 for one to five domains with a single panelist and ends in transfer or cancellation; for newer generic endings ICANN's Uniform Rapid Suspension is a faster route that suspends the domain instead.
1. **Tell your customers where you live.** Publish the domains you use and state that you never ask for a password by email, so support staff have one page to send when a customer asks whether a link is yours.

Step 4 is the honest use of a [Residential Proxy](https://proxynet.io/residential-proxy): load the suspect page through an exit in the customer's country and city and keep what it shows for the dispute file, a handful of page loads per domain, not a crawl.

The setup, from choosing the exit to keeping the evidence, is on our [brand protection](/brand-protection) page.

## What can users do?

- **Type the address or use a bookmark** for anything you sign in to, and open the app instead of a link in a message.
- **Keep a password manager** and treat its silence as a warning.
- **Use passkeys or a security key** where offered; a relayed one-time code is exactly what a look-alike login page collects.
- **Read the sender's domain** of any email that asks for money or a password, and confirm payment changes by phone.

## Where typosquatting hurts most

Banks and payment apps, where a copied login page leads to money within minutes. Online shops and software-as-a-service companies, whose login and checkout pages are copied along with the brand. Software vendors and package maintainers, because a download or an install command is the moment a visitor expects to run something. Suppliers and their customers, where a mail domain one letter off turns into invoice fraud.

## Common mistakes

- **Trusting the padlock.** It proves encryption to the domain shown, nothing about who owns it.
- **Registering hundreds of domains and forgetting them.** Defensive domains that do not redirect, or that expire, become the squatter's.
- **Thinking DMARC covers look-alikes.** It authenticates your domain; the squatter's domain authenticates itself.
- **Reporting only to the registrar.** The browser warning, the host and the CDN each act on their own, and usually faster.
- **Checking the look-alike only from the office.** A page that varies by country shows you the harmless version.

## Decision guide

| Your situation | What to do first |
|---|---|
| A look-alike is live with a login copy | Report to Safe Browsing, the registrar and the host today; keep evidence as users see it |
| A look-alike is registered but parked | Watch it, keep the evidence, prepare the UDRP file |
| Customers receive invoices from a domain like yours | Warn them, set DMARC to reject, register the typo of your mail domain |
| You are launching a brand | Register the main endings and top typos; 301 redirects and empty SPF on them |
| You entered a password on a look-alike | Change it on the real site, end other sessions, add a passkey |
| You maintain a package | Hardware-key 2FA at the registry; check its domain before every login |

## Frequently asked questions

### Is typosquatting illegal?

Registering a domain is not a crime in itself, which is why the UDRP exists as an administrative route to recover abusive registrations without a court. What is done with the domain can be illegal: phishing, malware and invoice fraud are offences in most countries, and using a trademark to deceive is infringement.

### What is the difference between typosquatting and cybersquatting?

Cybersquatting registers someone else's exact name or trademark as a domain, usually under an ending the brand does not own. Typosquatting registers the near misses of that name. Both are abusive registrations under the UDRP.

### What is the difference between typosquatting and phishing?

Typosquatting is about the domain; phishing is about the page or email that asks for your credentials. A phishing page often sits on a typosquatted domain because it needs a convincing address, but a typosquatted domain can also serve ads or collect email without any phishing page.

### How do I find out whether someone is typosquatting my domain?

Generate the likely variants of your domain and look up which are registered, check certificate transparency logs for names like yours, and look at what the registered variants serve from the markets you sell in.

### Does HTTPS mean a site is genuine?

No. HTTPS means the connection to the domain in the address bar is encrypted and the certificate was issued for that domain. Anyone who owns a domain can get a certificate in minutes, so a look-alike shows a padlock as readily as the real site.

### Can I get a typosquatted domain transferred to me?

Yes, through the UDRP, if the domain is confusingly similar to your trademark, the registrant has no legitimate interest in it and it was registered and used in bad faith. WIPO's guide puts a one-to-five-domain case at USD 1,500 and about two months; country endings that did not adopt the UDRP have procedures of their own.

## Summary

Typosquatting turns your customers' typing errors and reading habits into traffic for a domain you do not control: a login copy, an installer, a parking page or a mailbox for misaddressed invoices. Readers protect themselves by reading the registrable part of a domain letter by letter and trusting their password manager over a familiar design. Brands register the variants that matter, lock their email, watch registrations and certificate logs, report live pages and recover the domain through the UDRP. To see what a look-alike shows to a customer in another country or city, our [proxy services](/proxy) provide the exit address.