Typosquatting, also called URL hijacking, is the practice of registering a misspelled or lookalike version of a real domain, such as goggle.com for google.com, to catch people who mistype an address or don’t look closely. Criminals use those domains to steal logins, spread malware and send fake invoices that appear to come from someone you trust.

For SMBs and nonprofits, the uncomfortable part is that your email security can’t prevent it. DMARC, SPF and DKIM protect your own domain but cannot stop someone else from registering a lookalike of it. If your firm is mapleaccounting.ca, a stranger can buy mapleacounting.ca this afternoon, and nothing in your setup will block the sale.

You can’t stop the fake domain from existing. You can make it useless. That means spotting it early, verifying before anyone trusts a link or invoice, and using logins a fake site can’t steal.

What Is Typosquatting? A Fake Domain That Bets on Your Typos

Typosquatting works because people type fast and read faster, so a domain one character off the real one slips past a quick glance. Palo Alto Networks’ Unit 42 found that the most common technique is a name just one edit away from the original. Its example, whatsalpp.com for WhatsApp, changes a single letter. Read it at normal speed and your brain fills in the real name.

One edit means one character added, dropped, swapped or replaced. The same idea goes by several names, including URL hijacking, domain mimicry and lookalike domains. They all describe an address built to be mistaken for a real one.

Lookalikes catch two kinds of visitors. Some people mistype an address and land on the fake. Others click a link in an email or text without reading it closely. For your business, the second group carries the bigger risk. The attacker decides when that link arrives and what the message around it says.

The trick also works on software. Criminals publish code packages with names close to popular ones and wait for a developer to install the wrong one. That version is a growing supply-chain problem for any organization that builds or customizes software.

Seven Lookalike Tricks, Shown on One Canadian Business Name

Almost every lookalike domain comes from a short list of predictable edits, and predictable means you can list them before an attacker does. The table applies each technique to mapleaccounting.ca, a made-up Canadian accounting firm.

Wrong extensions deserve a closer look. If you own only .ca, an attacker can register your name under .com, .net, .org or .co, because many people type .com out of habit. The .co and .cm endings sit one keystroke away from .com and are easy to miss in an email.

Homograph attacks are the hardest to see. Some Cyrillic letters look exactly like Latin ones, so a domain can spell your name perfectly on screen while pointing somewhere else. Browsers store these international names in a format called Punycode, which begins with xn--. Some browsers show that raw form when a name mixes alphabets, which gives you one visual clue.

Combosquatting skips the misspelling entirely. It pairs your real name with a believable word, such as mapleaccounting-payments.ca or maple-accounting-login.ca. Even the plain hyphen version, maple-accounting.ca, can fool a busy reader.

A few rarer variants round out the list. Soundsquatting uses words that sound alike, like “write” and “right.” Bitsquatting bets on a random hardware error flipping one bit in memory, which turns one character into another. Levelsquatting puts your real name at the front of a longer address, such as mapleaccounting.ca.account-check.net, where the part that decides the destination is the end.

Five Stages from Domain Registration to a Stolen Password

Every typosquatting attack follows roughly the same five stages, and the middle two leave public records you can watch.

Domain registrations and new security certificates are public, so the green-marked stages are where defenders can catch an attack before any email goes out.

1. Pick a target. Attackers choose names people log into or pay, such as Microsoft 365, banks and payroll services. Your business qualifies too, because your clients trust your invoices and your donors trust your donation page.
2. Generate variants. Free tools churn out hundreds of misspellings, swaps and extensions in seconds. The attacker registers whichever ones are still available.
3. Set up the trap. They copy a real login page, add a security certificate so the padlock appears, and configure mail records so the domain can send and receive email. The padlock only means the connection is encrypted. It says nothing about who owns the site.
4. Deliver the lure. A phishing email, text or chat message carries the link. Sometimes they simply wait for typing mistakes. Staff who know how to spot and avoid phishing scams break the chain here.
5. Harvest and cash out. Stolen passwords open real accounts. A fake invoice redirects a payment. A download installs malware.

Stages two and three are your early-warning window. New registrations show up in domain records. Every publicly trusted security certificate is also written to Certificate Transparency logs that anyone can search. A lookalike you spot there before the first email goes out is one you can report before it costs anyone money.

Logins Come First, Then Payments and Malware

The main goal of typosquatting is credential theft, because one working password unlocks email, files and payment approvals that a fake website alone never could. Phishing and spoofing was the most-reported cybercrime type to the FBI’s Internet Crime Complaint Center (IC3) in 2025, with 191,561 complaints.

The FBI doesn’t count typosquatting as its own category. Lookalike sender domains are a common ingredient in phishing, though, so those complaints are where this problem shows up.

Business email compromise is where the money moves. The IC3 recorded about $3.05 billion in BEC losses across 24,768 complaints in 2025, up from $2.77 billion in 2024. A typical version uses a domain one letter off from a real supplier’s to send “updated” banking details. The defense is mostly process, and business email compromise preventionstarts with a rule that payment changes get confirmed by phone.

Malware is the third goal. Lookalike domains host fake software downloads and fake update pages. They also run command-and-control servers, the addresses infected machines quietly check in with for instructions. A name that resembles a real service blends into network logs, so an IT person scanning traffic can miss it. Some ransomware infections start exactly this way.

Nonprofits face a fourth goal, which is donations. A lookalike donation page collects real money from real supporters. The damage to trust lands on you, not the criminal.

Real Cases Show How Far Fake Domains Can Reach

Recent cases show fake domains running at industrial scale, with cleanup often left to courts and large tech firms. Lookalike sender domains turn up often in real phishing examples, and the two cases below show what happens when that scales up.

RaccoonO365 Lost 338 Domains in One Court Order

In September 2025, Microsoft’s Digital Crimes Unit and Cloudflare seized 338 domains used by RaccoonO365 under a court order from the Southern District of New York. RaccoonO365 sold a phishing kit as a service. By then it had stolen more than 5,000 Microsoft credentials in 94 countries.

Two lessons stand out. Renting a kit means an attacker needs no real skill. And shutting it down took a global tech company plus a federal court. A small business can’t wait for that kind of rescue, which is why your defense has to live in your own logins and habits.

Pennsylvania’s votepa.com Had a Fraudulent Twin

In 2020 the FBI warned of typosquatting domains aimed at people looking for state election office websites. Pennsylvania’s official votepa.com once competed with a fraudulent lookalike.

Any organization the public looks up by name can attract a twin. That includes charities, clinics, associations and local service firms. If your clients or donors search for you, someone can register the spelling they’re most likely to get wrong.

Fake Code Packages and AI-Invented Domains Are the New Lookalikes

Typosquatting has moved beyond web addresses into the code your developers install and the links AI chatbots recommend.

Typosquatted Packages Go After Developer Secrets

Developers pull free code libraries from public registries such as npm for JavaScript and PyPI for Python. Anyone can publish there, including criminals. Sonatype identified more than 454,600 new malicious open-source packages in 2025 alone.

For developers, that means a correctly spelled brand name in a package is no proof it comes from the real maintainer.

Some are classic typosquats. GitLab found five malicious PyPI packages spreading a copy of the Shai-Hulud worm. Four were typosquats of Flask, Requests and NumPy, three popular Python libraries. They ran the moment they were installed and stole credentials from CI/CD environments, the automated systems that build and ship software.

Most fake packages are subtler. Sonatype studied 4,309 malicious packages, and only 9% of the brandjacking malware relied on classic misspellings. The other 91% used believable variants that add words like plugin, config or SDK to a trusted name. That’s combosquatting for code. In the same study, 74% of the packages went after developer data such as environment information and secrets.

If an IT contractor or agency builds your website or tools, ask how they check package names and protect the secrets their build systems hold. That’s supply-chain risk management, and it belongs on your vendor questionnaire.

AI Chatbots Are Suggesting Domains Nobody Owns Yet

Unit 42 researchers asked two AI model families 685,339 questions about 913 brands. The answers contained 2.1 million URLs. Of those, 13,229 were already classified as malicious. About 250,000 pointed to domains that didn’t exist, which anyone could register.

Attackers have already used that gap. Unit 42 flagged one AI-invented postal-service domain 51 days before an attacker registered it and used it to spread a malicious Android app. Treat a link from a chatbot the way you’d treat one from a stranger, and check it against the company’s real site before you log in or pay.

Typosquatting Copies Your Domain, Hijacking Takes It Over

The key difference between these often-confused terms is whose domain is involved. It’s either a new lookalike someone else registered or your own domain taken from you. The table sorts the five terms you’re most likely to hear.

The defenses differ too: hijacking is stopped at your registrar account, while lookalikes need monitoring and phishing-resistant logins.

Cybersquatting is the broad legal term, and typosquatting is one form of it. In the United States, the Anticybersquatting Consumer Protection Act took effect on November 29, 1999. It makes a person liable for registering or using a domain “identical or confusingly similar” to a distinctive mark. They must also have a “bad faith intent to profit.” That’s a U.S. court remedy.

The Uniform Domain-Name Dispute-Resolution Policy (UDRP) is a separate, out-of-court process. It transfers or cancels a domain only when three conditions are all met. The domain must be identical or confusingly similar to your existing rights. The owner must have no legitimate interest in it. And it must have been registered and used in bad faith.

URL spoofing is about the link rather than the domain. The text in an email might read mapleaccounting.ca while the link behind it goes somewhere else entirely. Hovering over a link before clicking often reveals the real destination.

Domain hijacking is a different and more direct threat, because you lose control of your real domain. An attacker who gets into your registrar account can point your website and email at their own servers. Protect that account with a unique password and multi-factor authentication. Turn on registrar lock, and keep the renewal contact pointed at a mailbox someone actually reads.

Seven Controls That Make a Lookalike Domain Useless

Defensive registration shrinks the target, but the controls that protect your data best are the ones that make a lookalike worthless after it goes live. People remain the main target. Verizon’s 2026 DBIR found a human element in 62% of breaches, across more than 22,000 it analyzed. The list starts with your domains and ends with your people.

• Register a short list of variants. Buy your name in the other common extension (.com if you’re on .ca, or the reverse), your most likely misspelling and the hyphenated version. Point them all at your real site. Don’t try to buy every typo. There are too many, and an attacker needs only one you missed.
• Monitor new registrations. dnstwist, a free open-source tool, generates lookalikes of your domain and checks which ones are registered. crt.sh searches Certificate Transparency logs for new certificates containing your name. A WHOIS lookup shows when a suspicious domain was registered and, unless a privacy service hides it, by whom.
• Filter DNS and browsing. DNS filtering stops your devices from reaching known-bad and newly registered domains. Browser protection adds a warning when someone clicks through anyway.
• Lock down your own email. Set up DMARC, SPF and DKIM so nobody can send mail as your exact domain. Then turn on your email platform’s external-sender tags and lookalike warnings, which cover the gap DMARC can’t.
• Move to passkeys or security keys, plus a password manager. A passkey is tied to the real website, so a lookalike can’t capture a usable login. A password manager won’t autofill on a domain it doesn’t recognize, and staff can learn to treat that silence as a warning. Text-message codes, by contrast, can be typed straight into a fake page.
• Make verify-before-you-pay a rule. Bookmark the sites staff log into. Confirm any change in banking details by calling a number you already have, never one from the email. Be extra careful with texts. Verizon’s 2026 DBIR found that in phishing simulations, the median click rate for voice and text lures was 40% higher than for email. Regular phishing training for employees turns these habits into reflexes.
• Vet software packages. If you build or customize software, check package names letter by letter and lock each library to a known version. Keep passwords and keys out of build systems where an install script could read them.

Found a Lookalike of Your Domain? Warn People, Then Take It Down

When you find a lookalike of your domain, warn people fast and pursue the takedown steadily, because a warning protects clients today while a dispute can take time.

1. Capture evidence. Screenshot the site, save any related emails, and record the WHOIS details, the date you found it and whether it has mail records. A lookalike that can send email is the urgent kind.
2. Warn clients and staff. Share the exact fake address and say what you will never ask for by email, such as new banking details. Plain, early notice protects relationships better than silence.
3. Report it to the registrar and host. Every registrar and hosting company has an abuse contact. Send your evidence and ask for suspension, especially if the site is phishing or spreading malware.
4. File a UDRP complaint when all three conditions fit. WIPO, one of several approved dispute providers, handled more than 6,200 domain name cases in 2025, its highest caseload on record. Some country-code domains follow their own dispute rules, so confirm which process applies first.
5. Bring in legal counsel for stubborn cases. If the owner is profiting from your name and ignoring reports, a lawyer can advise on court options and your compliance obligations.

Quick Answers

What Is the Main Goal of Typosquatting?

The main goal is stealing login credentials through phishing. A working password then opens the door to payment fraud, business email compromise and malware.

What Is URL Spoofing?

URL spoofing hides where a link really goes so it looks like it points to a trusted site. It can use mismatched link text, lookalike characters or a typosquatted domain.

Can a Domain Name Be Hijacked?

Yes. Domain hijacking happens when someone takes over your registrar account and redirects your real domain. Multi-factor authentication and registrar lock are the main defenses.

What Is a Famous Example of Cybersquatting?

One public example involves Pennsylvania’s official election site, votepa.com, which once competed with a fraudulent lookalike. In 2020 the FBI warned that typosquatting domains were targeting people looking for state election office websites.

Check Your Own Domain in the Next 15 Minutes

Run your domain through dnstwist today. On a machine with it installed, the command “dnstwist –registered yourdomain.ca” lists only the lookalikes someone already owns. If the command line isn’t your thing, a free web-based lookup does a similar job.

Repeating this check every few months catches new lookalikes, since attackers can register a variant at any time.

For each registered variant, note who owns it, whether it hosts a website or mail records, and whether it’s an old domain your business bought and forgot. Then sort the list into three piles: buy, monitor or report. That one exercise turns an invisible risk into a short to-do list.

Then get RiskAware’s free cybersecurity score to see what else your business has exposed. We’ve helped hundreds of SMBs and nonprofits reduce cyber risks, and a discovery call is the quickest way to start.