Typosquatting: What It Is, Real Examples, and How to Protect Your Domain
Typosquatting is registering a domain name that is one small mistake away from a real one, such as a missing letter, a swapped character or a different ending, so that people who mistype an address or misread a link land on a site the squatter controls. It is a form of cybersquatting, and today it is mostly a phishing tool: the look-alike domain hosts a fake login page, sends email that survives a quick glance, or quietly collects mail meant for someone else.
How Typosquatting Works
Registering a domain costs a few dollars and takes a minute. Getting it a valid TLS certificate is free and automatic, so the fake site shows the same padlock as the real one. An attacker who registers a handful of close variants of your domain can then use them in several ways:
Credential phishing: a copy of your login page on a domain that differs from yours by one character, linked from an email or an ad.
Business email compromise: invoices and payment changes sent from a domain your finance team reads as yours.
Mail interception: an MX record on the misspelled domain collects every email people send to the wrong address.
Malware and scams: fake downloads, fake support pages and fake stores that borrow your brand's trust.
Parking and resale: ad pages that earn money from mistyped traffic, or an offer to sell the domain back to you.
Common Typosquatting Techniques
Most look-alike domains come from a short list of predictable edits. Using example.com:
Omission: a letter is dropped, as in exmple.com.
Repetition: a letter is doubled, as in exaample.com.
Transposition: two letters swap places, as in exmaple.com.
Replacement: a neighbouring key or similar shape, as in exanple.com, or vv in place of w.
Homoglyphs: characters that look identical, such as rn for m, or a Cyrillic а in place of a Latin a (an IDN homograph).
TLD swap: the same name on another ending, such as example.co or example.shop.
Hyphenation and combosquatting: the brand plus a word, as in example-login.com or support-example.com.
Dot omission: wwwexample.com, which catches people who skip the dot after www.
Because these edits are mechanical, they can be generated and checked automatically. That works for attackers and for defenders.
Real Examples of Typosquatting
In May 2026 the FBI warned that threat actors had registered more than 498 fake domains tied to the FIFA World Cup. The examples in the advisory map neatly onto the techniques above: wvvw-fifa[.]com uses vv in place of w plus a hyphen, fifa[.]pink and fifa[.]ceo are TLD swaps, and jobs-fifa[.]com and worldcup26ticket[.]com combine the brand with common words. We broke down every technique in 498 Fake FIFA World Cup Domains.
The same pattern shows up around every major event, product launch and acquisition, and outside DNS too: package registries such as npm and PyPI regularly remove malicious packages named one character away from popular libraries.
Typosquatting vs Cybersquatting
Cybersquatting is registering a domain that matches someone else's trademark in bad faith, usually to resell it, earn ad revenue from its traffic, or impersonate the owner. Typosquatting is the subset that relies on misspellings and look-alike characters. Combosquatting, where the exact brand is joined to another word, is a close relative. In practice the categories overlap, and a single campaign often uses all three. Cybersquatting: what it is and how to get a domain back
Is Typosquatting Illegal?
Often, yes, when a trademark is involved and the registration was made in bad faith. In the United States the Anticybersquatting Consumer Protection Act (1999) lets a trademark owner sue anyone who registers, sells or uses a domain confusingly similar to a distinctive mark with a bad faith intent to profit, with statutory damages of $1,000 to $100,000 per domain. Internationally, ICANN's Uniform Domain Name Dispute Resolution Policy (UDRP) lets a trademark owner ask for a domain to be transferred or cancelled without going to court. Using a look-alike domain for phishing is fraud regardless of trademark law. This is general information, not legal advice.
How to Protect Your Domain From Typosquatting
Register the most convincing variants yourself: the common typos, the main TLDs and the country codes of your key markets. You cannot register them all, so focus on the ones a customer could plausibly type or trust.
Publish DMARC with a policy of p=reject. It stops attackers spoofing your exact domain, which pushes them toward look-alikes you can detect. Check yours with the SPF & DMARC Checker.
Monitor for new look-alike registrations, and watch for the moment a parked variant gains a web server, an MX record or a certificate. That change is when it becomes dangerous.
Act quickly on the dangerous ones: abuse reports to the registrar and host, a report to browser blocklists, a UDRP complaint where a trademark applies, and a heads-up to customers and staff.
Lock down your own domain as well. Typosquatting imitates your domain, while domain hijacking takes it from you, and both end in the same phishing page.
How DNS Spy Detects Typosquatting
To see what already exists, run the free Typosquatting Scanner. It lists registered look-alikes of any domain, with no signup.
For continuous coverage, Phishing Sentinel generates thousands of permutations of each monitored domain using 17+ techniques, checks which are registered with live DNS, and scores each one from 0 to 100 based on its technique and its infrastructure: web hosting, mail servers and TLS certificates. It keeps watching, and alerts you when a new variant appears or a parked one comes to life. DNS Spy does not file takedowns for you, but it gives you the evidence to file them. Phishing Sentinel is part of the Enterprise plan; see brand protection for how it fits with DNS, WHOIS and certificate monitoring.
Related
Cybersquatting: What It Is, Real Cases, and How to Get a Domain Back
DNS Hijacking: How It Works, How to Detect It, and How to Stop It
Frequently asked questions
What is an example of typosquatting?
A typosquatting domain changes one detail of a real name, such as exmaple.com for example.com. In 2026 the FBI listed fake World Cup domains like wvvw-fifa[.]com, which uses vv in place of w, and fifa[.]pink, which keeps the name and swaps the ending. Both are built to pass a quick glance.
Is typosquatting illegal?
Typosquatting is often illegal when it targets a trademark in bad faith. In the US, the Anticybersquatting Consumer Protection Act allows damages of $1,000 to $100,000 per domain, and the UDRP lets owners recover domains without court. Using a look-alike domain for phishing is fraud in any case. This is not legal advice.
What is the difference between typosquatting and cybersquatting?
Cybersquatting is registering any domain that matches someone else's trademark in bad faith, whether to resell it, profit from its traffic or impersonate the owner. Typosquatting is the subset built on misspellings and look-alike characters, such as exmaple.com. Combosquatting, which adds a word like login to the exact brand, is a close relative.
How do I check if someone is typosquatting my domain?
Generate the likely variants of your domain and check which are registered with live DNS. The free DNS Spy Typosquatting Scanner does this for any domain without signup. For ongoing coverage, Phishing Sentinel checks thousands of permutations, scores each one by threat, and alerts you when a new look-alike appears or comes online.
Does DMARC protect against typosquatting?
No. DMARC only protects your exact domain, so it stops attackers spoofing example.com but not mail sent from a look-alike such as exampel.com, which publishes its own records. DMARC at p=reject is still worth having, because it forces attackers onto look-alike domains, and those can be detected and reported.
