A customer types examplebank.com with one letter wrong. The page that loads looks right, asks for a login, and the attacker keeps the password. This post covers how that works, what the fake domains are used for, and how to find and remove them.
What is typosquatting?
Typosquatting means registering a domain name that is one small slip away from a real one, so that mistyped addresses land on the attacker’s site. The same domain also fools people who skim a link. The attacker then uses it for phishing, scams or malware.
Unit 42, the research team at Palo Alto Networks, says the most frequent typosquatting techniques include registering names one edit away from the original, because those are the most common and most overlooked mistakes users make. MITRE lists the wider practice as T1583.001, Acquire Infrastructure: Domains. It notes that adversaries may choose domains similar to legitimate ones and that typosquatting may help deliver payloads through drive-by compromise.
Which patterns do attackers register?
Most lookalikes follow a handful of patterns. The table uses a made-up brand, examplebank.com.
| Pattern | Example | What it fools |
|---|---|---|
| Omission | examplebnk.com | A reader who skips a missing letter |
| Transposition | examplebnak.com | Two swapped letters that the eye reads as correct |
| Adjacent key | exanplebank.com | A finger that hit the neighboring key |
| Added word or hyphen | examplebank-secure.com | A reader who trusts a familiar name plus a reassuring word |
| Different ending | examplebank.co | A reader who expects the usual ending |
| Look-alike character | examp1ebank.com (digit 1 for the letter l) or a Cyrillic letter for a Latin one | A reader who checks quickly |
The added-word pattern is called combosquatting. Unit 42 describes it as joining a trademark with words such as security, payment or verification. The last row is the hardest to catch by eye. Unit 42 shows a case where a Latin “a” in a well-known domain was replaced by the Cyrillic “а”, and the two look the same on screen.
Unit 42 also names soundsquatting, which uses words that sound alike, and bitsquatting, where a name differs from the original by a single bit.
What are lookalike domains used for?
The domain is only the delivery step. What sits behind it decides the harm. For a wider view of the brand risk, see our post on lookalike domains and brand impersonation.
Credential phishing and fake login pages
The classic use is a copy of a login page. Unit 42 found a domain imitating a US bank that went after customers’ email credentials and ATM PINs. MITRE lists phishing, drive-by compromise and command and control as common uses of acquired domains.
Invoice fraud and mail from a lookalike sender
A lookalike can also send email. In a March 2023 alert, the FBI described criminals who use spoofed email domains and the display names of current or former employees to place bulk orders with vendors. Its examples show the pattern well: for @company.com, the fake domains include @co-pany.com and @company-usa.com.
The FBI advises checking that the sender’s domain belongs to the business it claims to be. Note that SPF, DKIM and DMARC on your own domain do not help here, because the attacker sends from a different domain that they control.
Scams, parking pages and malware
Unit 42 grouped the squatting domains it studied by purpose. The groups include re-bill scams, where a small first payment is followed by a charge of $50 to $100, and fake technical support. They also include reward scams, malware delivery and command and control. Some domains only host parking pages that earn money from ad clicks.
How common is typosquatting?
The best public numbers we could verify are old. Unit 42 published them on 1 September 2020, and they come from domains registered in December 2019. Treat them as a snapshot from 2020, not as a current rate.
- 13,857Squatting domains registered in December 2019, about 450 a daySource: Unit 42, Palo Alto Networks, 1 September 2020
- 18.59%Of those domains judged maliciousSource: Unit 42, Palo Alto Networks, 1 September 2020
- 36.57%Judged high risk to visitorsSource: Unit 42, Palo Alto Networks, 1 September 2020
- 55%Of malicious or high-risk domains flagged by no vendor on VirusTotalSource: Unit 42, Palo Alto Networks, 1 September 2020
The gap in the last figure is the useful part. In that sample, more than half of the bad domains had no flag from any vendor Unit 42 compared. A blocklist alone is a late defense.
Unit 42 also found that squatters prefer profitable targets. These were search, social media, financial, shopping and banking sites, where users are ready to share sensitive data.
How do you find lookalikes before they go live?
MITRE’s detection advice is to monitor DNS data and to use WHOIS and passive DNS to track newly acquired domains. It adds that you should watch for domains built like yours, including under a different top-level domain. Registration data is public by design, so this is work you can start without the attacker’s help.
New registrations, certificates and mail records
- New registrations: generate likely misspellings of your domains and compare them with daily lists of new domains.
- Certificates: Certificate Transparency logs publicly record TLS certificates as they are issued, so a new certificate for a name close to yours is a reason to look at once.
- Mail records: a Google Threat Intelligence guide says a phishing domain with a valid MX record may indicate that the attacker intends to receive replies from victims.
- Age: the same guide calls a very recently registered domain a strong indicator of potential maliciousness.
MITRE also suggests the quiet fix of registering similar domains yourself, to deter adversaries from taking them. That covers a few variants, but never all of them.
Brandefense follows new registrations that look like yours, checks whether a live page copies your brand and keeps the evidence. The phishing and lookalike domains use case shows the steps, and the phishing monitoring and domain abuse module covers the product side.
How do you get a lookalike removed?
Registrar and host abuse reports
Most removals start with a report to the host of the page and to the registrar of the domain, with evidence of the abuse. Each has its own process, and the other side decides how fast to act, so nobody can promise a removal time. The takedown service page explains this work in more detail.
UDRP and the ACPA
The UDRP is a dispute process that all ICANN-accredited registrars follow. A trademark owner files a complaint with an approved provider, such as WIPO, and must prove three things. The domain is identical or confusingly similar to the mark, the holder has no rights or legitimate interest in it, and it was registered and is used in bad faith.
WIPO says a case with no procedural issues normally finishes within two months of the complaint. If the complainant wins, the registrar cancels or transfers the name.
Some country-code domains use their own variants of the UDRP. WIPO’s page lists examples such as .eu, .ie, .nl and .au.
In the US, the Anticybersquatting Consumer Protection Act (15 U.S.C. 1125(d)) lets a mark owner bring a civil action against a person who has a bad faith intent to profit and who registers, traffics in or uses a confusingly similar domain. The statute lists factors a court may weigh. This is general information, not legal advice, so ask counsel before you choose a route.
Browser blocklists while the takedown runs
Google publishes a form for reporting phishing URLs that are not yet on its phishing list. A blocklist report does not remove the domain. Think of it as a stop-gap that protects visitors while the registrar and host work through your case.
A response checklist for brand and SOC teams
Use this list when a lookalike turns up, whether a customer reports it or your monitoring does.
- Capture evidenceSave screenshots, the full URL, the date and the DNS records.
- Check the domainNote the creation date, name servers and any MX record.
- Block itAdd the domain to your mail and web filters.
- Report to host and registrarSend the evidence and state the abuse plainly.
- Report to blocklistsSubmit the URL to Google Safe Browsing.
- Choose a legal routeAsk counsel about the UDRP or an ACPA claim if the page stays up.
- Keep watchingLook for other domains from the same registrant and for new variants of your name.
You can see how many phishing domains target your own brand with the free domain risk score. The lookalike domain takedown page shows what happens after a detection, from the check to the registrar and host contact. When you want this watched all the time, request a demo.
Last checked against sources on 19 October 2026.