Typosquatting turns your customers’ spelling mistakes into someone else’s revenue. A single miskeyed letter — microsft.com for microsoft.com, paypa1.com for paypal.com, arnazon.com for amazon.com — lands the user on a domain someone else owns. That domain can host malware, phishing, an affiliate redirect, a fake login page, or nothing at all until the attacker decides.
The volume is not incidental. Zscaler ThreatLabz reported approximately 30,000 lookalike domains targeting the world’s most-abused brands across a single six-month window — roughly 200 per brand (Zscaler ThreatLabz — Phishing, Typosquatting, and Brand Impersonation Trends, retrieved 2026-09-03). Anti-Phishing Working Group data reinforces the scale: APWG’s quarterly phishing reports consistently show hundreds of thousands of new phishing domains registered per quarter, of which brand-lookalike registrations are a durable share (retrieved 2026-09-03).
Six Families of Typosquat
Every lookalike domain in the wild is a member of one of six families. The families overlap in practice — a single domain often mixes two or three techniques — but understanding each in isolation is how you build detection that catches all of them.
1. Character Omission and Insertion
The simplest form. Drop a letter, add a letter, or move one.
microsoft.com → microsft.com (missing 'o')
microsoft.com → microsooft.com (extra 'o')
microsoft.com → mircosoft.com (transposed 'i' and 'r')Character-omission squats catch fast typists who miss a keystroke. Character-insertion squats catch anyone with a slightly overzealous auto-repeat setting. Transposition squats catch the majority of one-letter mistakes on QWERTY layouts.
2. Character Substitution
Replace one character with another visually or physically adjacent character.
paypal.com → paypa1.com (lowercase 'l' → digit '1')
google.com → gooogle.com (extra 'o')
amazon.com → arnazon.com (Latin 'm' → 'rn')The rn → m substitution is one of the most effective — at font sizes below 14px the two are visually indistinguishable to nearly every reader. Character substitution is the workhorse of high-volume phishing, and detection needs to know about every pair of confusables in the Latin script alone.
3. TLD Swap
Keep the second-level label. Change the top-level domain.
microsoft.com → microsoft.co
microsoft.com → microsoft.support
microsoft.com → microsoft.online
microsoft.com → microsoft.infoThe 2013 expansion of the generic TLD program made this vector cheap. There are now over 1,000 registerable TLDs, most costing under $10 for the first year, several under $1. A brand that owns example.com and example.net still leaves example.co, example.support, example.online and hundreds more available.
4. Brand-Suffix and Brand-Prefix
Register the target brand as a subdomain of a controlled apex, or embed it in a longer label.
paypal.com → paypal-security.com
paypal.com → paypal-verify.online
paypal.com → secure-paypal.com
paypal.com → paypal.login-verification.netThe last of the four is particularly effective. Users scanning a URL in a hurry read the leftmost token they recognize (paypal.) and stop reading. The real registered domain is login-verification.net and it belongs to the attacker. Combined with a valid TLS certificate — which Let’s Encrypt issues in minutes for anything DNS-resolvable — the address bar looks fine to most people.
5. Homoglyph and IDN Homograph
Replace a Latin character with a visually identical character from a different Unicode script.
apple.com → аpple.com (Cyrillic 'а' for Latin 'a')
paypal.com → pаypal.com (Cyrillic 'а' for Latin 'a')Every browser encodes IDN domains on the wire as punycode, an ASCII-safe representation prefixed with xn--. So аpple.com (with a Cyrillic ‘а’) actually resolves as xn--pple-43d.com. Modern browsers try to detect confusables and render the punycode form in the address bar — Chrome and Firefox both do this when a domain mixes scripts or uses characters from unexpected scripts for the current locale. The detection is imperfect, and single-script IDN attacks (where every character comes from Cyrillic and the domain is registered in a Cyrillic-friendly TLD) can still render as native text.
6. Punycode-in-Path and Hybrid
The xn-- encoding gets combined with the earlier five families to layer techniques.
xn--pypl-loa.com (paypal-shaped IDN)
xn--myetherwallet-6cd.com (MyEtherWallet-shaped IDN, single-script variant)The MyEtherWallet incident of April 2018 remains the canonical hybrid case. On April 24 that year, attackers hijacked BGP routes to redirect DNS resolution for myetherwallet.com to a server they controlled, then served a phishing page whose SSL certificate was issued for a lookalike domain (Ars Technica — “Suspicious event hijacks Amazon traffic for 2 hours, steals cryptocurrency”, retrieved 2026-09-03; incident coverage summarized by The Hacker News, April 2018, retrieved 2026-09-03; technical breakdown by Cloudflare — “BGP leaks and cryptocurrencies”, retrieved 2026-09-03). Users who verified the URL character by character still fell victim because the characters rendered identically. Reported losses in the immediate aftermath exceeded $150,000 in ETH.
Why the SSL Padlock Doesn’t Save You
The single biggest change in the typosquat landscape between 2015 and today is TLS. In 2015, an attacker registering a lookalike had to buy an OV or DV certificate from a commercial CA — friction that filtered out the low-effort operators. Since Let’s Encrypt reached general availability in 2016, any resolvable domain can obtain a trusted DV certificate in under 60 seconds, at zero cost.
A domain like paypa1.com served over HTTPS with a Let’s Encrypt certificate renders in the browser with the exact same padlock, the exact same “connection is secure” language, and the exact same locked-lock icon as paypal.com. Distinguishing them is a job for the user’s eyes, not the browser’s chrome. See the /learning/what-is-phishing-link walkthrough for how to inspect a URL correctly, and the /glossary/phishing entry for the wider category.
Detection: What DNS Twist Does, and Where It Stops
The open-source tool dnstwist by Marcin Ulikowski is the reference implementation for typosquat generation. Given a seed domain, dnstwist generates permutations across all six families above and checks which ones exist in DNS.
# Install
pip install dnstwist
# Generate permutations for paypal.com and check DNS resolution
dnstwist -r paypal.comThe output is a table of every permutation, its resolving IP if one exists, and lightweight risk indicators (nameserver, MX, WHOIS date). dnstwist is excellent for a single point-in-time audit. Where it stops is monitoring — running the permutation engine once per day, diffing against yesterday’s output, and alerting on new registrations before they get weaponised. That is the workflow gap continuous typosquat monitoring is designed to close.
What the Bounty and Incident Record Shows
Public disclosures repeatedly show the same pattern: the domain used in a successful phishing attack was registered days or hours before the campaign, not months. The narrow monetization window is the point. An attacker who registers a lookalike, gets a Let’s Encrypt cert, and blasts a phishing template on the same day gains a 24–72 hour window before defenders notice, block, and take down. Faster detection compresses that window.
- The Facebook and Google $121M BEC — perpetrator Evaldas Rimasauskas, 2013–2015 — used a typosquat of a Taiwanese hardware vendor’s domain to invoice both companies over two years. Lookalike domain plus DMARC-unaligned mail plus wire transfer approval process; over $121M paid before the pattern was detected (DOJ press release, retrieved 2026-09-03). See the full incident breakdown at /learning/facebook-google-121m-bec.
- KnowBe4’s own reporting consistently ranks brand-lookalike phishing among the top three most-successful phishing template families in employee simulation programs. The variant that works is not sophisticated; it is the plain-brand-suffix template like
microsoft-security-alerts.com. - APWG Q4 2024 attributed a majority share of observed phishing domains to lookalikes of the top 25 targeted brands (APWG Trends Reports, retrieved 2026-09-03). The specific counts vary quarter to quarter; the concentration on the same brands does not.
Prevention Checklist
Real prevention is a mix of defensive registration, monitoring, and takedown. In priority order:
- Defensively register the obvious variants. Own the top-25 permutations of your brand — single-character omissions, insertions, transpositions, homoglyphs on the most-abused characters, and the most common TLDs (
.co,.net,.org,.online,.support). This is a one-time cost per year and blocks the highest-volume typosquats. - Watch WHOIS for new registrations of your brand. Continuous monitoring of newly-registered domains that contain your brand as a substring (or a homoglyph-equivalent substring) catches the domains you did not defensively register.
- Enforce DMARC at
p=reject. A lookalike domain can send email that spoofs your brand only if your DMARC policy permits it. See the /learning/what-is-dmarc walk-through and the enforcement-gap analysis for the mechanics. - Ship a takedown process. When you find a live phishing site on a lookalike, you need a template email to the hosting provider, the registrar’s abuse contact, and the CDN if one is fronting the site. Fifteen minutes of preparation now saves hours during an active incident.
- File UDRP for the durable squats. For clearly infringing domains that resist takedown, a Uniform Domain-Name Dispute-Resolution Policy complaint costs roughly $1,500 and typically resolves in 30–60 days. Worth it against a domain being used to harvest customer credentials.
- Cross-check against known-bad indicators. A newly-registered lookalike whose nameservers, hosting IP, or SSL issuer overlaps with previously-flagged phishing infrastructure is much likelier to be weaponised. That correlation is the highest-ROI signal in continuous monitoring.
- Educate the finance team specifically. BEC via typosquats overwhelmingly targets accounts payable and treasury. A monthly reminder — plus a mandatory pause-and-call rule for any wire transfer request from a domain the recipient hasn’t emailed with in 30+ days — costs nothing and stops most incidents in this class.
Where DomainScan Fits
DomainScan runs continuous typosquat monitoring as part of the Pro tier. Add your brand once; the platform generates the permutation universe (all six families), watches new-registration feeds, correlates every hit against nameserver, IP, MX, and SSL indicators, and alerts you the day a new lookalike appears with enrichment already attached. Free forever for 2 domains — no credit card, no time-limited trial. You can pilot the check on one brand before rolling it across your estate.
Frequently Asked Questions
What is typosquatting in one sentence?
Typosquatting is the practice of registering a domain that visually or textually resembles a real brand — via a single-character typo, a homoglyph swap, a TLD change, a brand-suffix add, or a punycode Unicode trick — with the intent to trap users who mistype, misread, or trust surface-level signals like a valid SSL padlock.
What is the difference between typosquatting and a homoglyph attack?
Typosquatting is the umbrella term. A homoglyph attack is one family under that umbrella — specifically, substituting a character with one that looks visually identical or near-identical (e.g., Cyrillic ‘а’ for Latin ‘a’, digit ‘1’ for lowercase ‘l’, or zero for uppercase ‘O’). When homoglyphs cross scripts (Latin ↔ Cyrillic ↔ Greek), the attack is called an IDN homograph attack and is encoded on the wire as punycode (xn--).
What is a punycode phishing attack?
A punycode phishing attack registers an internationalized domain name (IDN) whose Unicode characters render as a Latin-script brand in the address bar, while the actual DNS name is an ASCII-safe xn-- encoding. The MyEtherWallet incident of April 2018 is the canonical case: attackers hijacked BGP routes and served a phishing site whose certificate matched a punycode-encoded lookalike, so the browser padlock stayed green for many victims. Modern browsers block some cross-script variants, but single-script IDN attacks still render as native text.
How many lookalike domains target the average major brand?
Zscaler ThreatLabz reported approximately 30,000 lookalike domains targeting the world’s most-abused brands across a single six-month window — averaging around 200 lookalikes per brand. The Anti-Phishing Working Group’s quarterly reports show broadly consistent volumes: hundreds of thousands of new phishing domains registered per quarter across all targets, of which brand-lookalike registrations are a significant share.
What is dnstwist and what does DomainScan add on top?
dnstwist is an open-source Python tool by Marcin Ulikowski that generates permutations of a seed domain and checks which ones resolve. It’s excellent for one-off audits. DomainScan runs the same permutation engine continuously, enriches each hit with WHOIS registration date, resolving IP, MX record, SSL certificate, and abuse score, and alerts you when a new lookalike appears. dnstwist tells you which permutations exist today; DomainScan tells you which ones showed up yesterday and what to do about them.
Can I take down a typosquat domain?
Sometimes. Legitimate paths include a UDRP (Uniform Domain-Name Dispute-Resolution Policy) complaint with the registrar or ICANN — cheap and fast against clear infringement — and, for active phishing, a takedown request routed through the hosting provider or CDN. Registrars vary in cooperation, and clear brand-infringement cases resolve faster than ones requiring evidence of active abuse. The realistic goal is not zero lookalikes; it is faster detection than the attacker’s monetization window.
Related Learning
- /learning/what-is-phishing-link — how to read a URL correctly before you click
- /learning/what-is-dmarc — the email-side control that blocks typosquat-fueled spoofing
- /learning/facebook-google-121m-bec — the $121M BEC case that used a single lookalike domain
- /glossary/phishing — the wider category
Sources
- Zscaler ThreatLabz — “Phishing, Typosquatting, and Brand Impersonation Trends and Tactics”
- Ars Technica — MyEtherWallet BGP hijack coverage, April 2018
- Cloudflare — “BGP leaks and cryptocurrencies” technical breakdown
- The Hacker News — “MyEtherWallet DNS Hijacking”
- APWG — Trends Reports
dnstwist— Marcin Ulikowski, GitHub- DOJ — Rimasauskas plea, Facebook/Google BEC
- ICANN — UDRP process overview
Common Questions
What is typosquatting in one sentence?
Typosquatting is the practice of registering a domain that visually or textually resembles a real brand — via a single-character typo, a homoglyph swap, a TLD change, a brand-suffix add, or a punycode Unicode trick — with the intent to trap users who mistype, misread, or trust surface-level signals like a valid SSL padlock.
What is the difference between typosquatting and a homoglyph attack?
Typosquatting is the umbrella term. A homoglyph attack is one family under that umbrella — specifically, substituting a character with one that looks visually identical or near-identical (e.g., Cyrillic 'а' for Latin 'a', digit '1' for lowercase 'l', or zero for uppercase 'O'). When homoglyphs cross scripts (Latin ↔ Cyrillic ↔ Greek), the attack is called an IDN homograph attack and is encoded on the wire as punycode.
What is a punycode phishing attack?
A punycode phishing attack registers an internationalized domain name (IDN) whose Unicode characters render as a Latin-script brand in the address bar, while the actual DNS name is an ASCII-safe `xn--` encoding. The MyEtherWallet incident of April 2018 is the canonical case: attackers hijacked BGP routes and served a phishing site whose certificate matched a punycode-encoded lookalike, so the browser padlock stayed green for many victims.
How many lookalike domains target the average major brand?
Zscaler ThreatLabz reported approximately 30,000 lookalike domains targeting the world's most-abused brands across a single six-month window — averaging around 200 lookalikes per brand. The Anti-Phishing Working Group's quarterly reports show broadly consistent volumes: hundreds of thousands of new phishing domains registered per quarter across all targets, of which brand-lookalike registrations are a significant share.
What is dnstwist and what does DomainScan add on top?
`dnstwist` is an open-source Python tool by Marcin Ulikowski that generates permutations of a seed domain and checks which ones resolve. It's excellent for one-off audits. DomainScan runs the same permutation engine continuously, enriches each hit with WHOIS registration date, resolving IP, MX record, SSL certificate, and abuse score, and alerts you when a new lookalike appears. `dnstwist` tells you which permutations exist today; DomainScan tells you which ones showed up yesterday and what to do about them.
Can I take down a typosquat domain?
Sometimes. Legitimate paths include a UDRP (Uniform Domain-Name Dispute-Resolution Policy) complaint with the registrar or ICANN — cheap and fast against clear infringement — and, for active phishing, a takedown request routed through the hosting provider or CDN. Registrars vary in cooperation. The realistic goal is not zero lookalikes; it is faster detection than the attacker's monetization window.