Typosquatting: How Fake Domains Steal Your Credentials
Learn how typosquatting attacks steal employee credentials through fake domains and how to prevent them before damage is done.
Typosquatters steal credentials with domains that are one typo away from a real one. An employee types ‘ofice.com’ instead of ‘office.com’ and lands on a perfect replica of the login page. The employee enters their password. The attacker now has the employee’s password.
Interisle Consulting Group found that 77% of the domain names reported as phishing between May 2024 and April 2025 were registered by the attackers themselves. The other 23% were legitimate domains whose websites attackers had hacked.
Quick Summary
Typosquatting is registering a domain that resembles a real one to catch people who mistype the address or click a phishing link. Security keys and passkeys only work on the real site, so an attacker behind a fake login page can’t sign in. To find typosquatted versions of your domain, search HTTPS certificate logs for your brand and its misspellings.
What Is Typosquatting?
Typosquatting, also called URL hijacking, targets the predictable mistakes people make when they type a web address. We transpose letters. We miss keystrokes. We confuse similar-looking characters. Attackers register the domains those mistakes lead to.
How Do Typosquatting Attacks Work?
The attack lifecycle is deceptively simple. An attacker picks a high-value target domain, registers the most convincing typo variations, and drives victims to them through phishing emails or malicious ads.
Step 1: Target Selection
Attackers focus on domains with high traffic and high-value credentials. Microsoft and Google were the most imitated brands in 2025 phishing, according to Zscaler’s ThreatLabz 2026 Phishing and Initial Access Report.
Step 2: Domain Generation
Tools like dnstwist generate thousands of domain permutations automatically using character substitution and wrong TLDs. Interisle Consulting Group found that 37% of phishing domains were registered in bulk. Interisle counts a bulk registration as 10 or more domains at one registrar within 10 minutes.
Step 3: Infrastructure Setup
Attackers register the most convincing domains and obtain SSL certificates so the fake site loads over HTTPS like the real one. In 2025, 95.2% of the phishing that Zscaler blocked arrived over encrypted connections.
Attackers also hide what a lookalike domain is for, so security tools don’t flag it. In February 2026, CrowdStrike described three tricks. Two of them hide a working mail server that sends phishing emails behind a harmless website. That website either redirects visitors to the real site or shows a fake “domain for sale” page. In the third trick, the site checks each visitor’s IP address and location. Security scanners get a clean page. Visitors from the targeted locations get the phishing page.
Step 4: Credential Harvesting
The fake site replicates the legitimate login page pixel-for-pixel. When users enter credentials, the site either captures them and displays an error message, or passes them through to the real site while logging them. Either way, attackers now have valid credentials.
What Are the Common Types of Typosquatting?
Attackers use several techniques to create convincing fake domains. Knowing the patterns helps you spot and block them early.
Character Substitution
This technique replaces letters with visually similar characters. The classic example is substituting ‘rn’ for ’m’ because they look nearly identical in most fonts. ‘rnicrosoft.com’ looks like ‘microsoft.com’ at a glance. Other substitutions include ‘1’ for ’l’, ‘0’ for ‘o’, and ‘vv’ for ‘w’. The hardest ones to catch are homoglyph attacks using Cyrillic characters. Your eye won’t tell them apart.
Missing or Added Characters
Attackers remove or add single characters that users might miss. ‘gogle.com’ (missing ‘o’) and ‘googgle.com’ (extra ‘g’) exploit common typing errors. These domains catch users who type quickly without proofreading.
Transposed Characters
Swapping adjacent letters creates domains like ‘googel.com’ or ‘amazno.com’. These target the specific muscle memory errors people make when typing familiar URLs quickly.
Wrong TLD Variations
Users also type the wrong ending, such as ‘.co’ instead of ‘.com’. Attackers register ‘amazon.co’ or ‘google.net’ to capture this traffic. Some country-code TLDs sit one keystroke from ‘.com’, such as ‘.cm’ (Cameroon) and ‘.om’ (Oman).
Hyphenation and Combosquatting
Adding hyphens or combining brand names with common words creates domains like ‘face-book.com’ or ‘amazon-deals.com’. This technique, called combosquatting, extends domain typosquatting into brand impersonation territory.
IDN Homograph Attacks
Internationalized domain names allow Unicode characters from other alphabets. Some of these characters look identical to Latin letters. Cyrillic ‘а’ looks the same as Latin ‘a’ but is a different character. The .com registry won’t accept a name that mixes Cyrillic and Latin letters, so attackers spell the whole name in Cyrillic. In 2017, researcher Xudong Zheng registered ‘аррӏе.com’ to show the trick. The domain uses only Cyrillic letters and looks like ‘apple.com’. Chrome now displays that domain as Punycode (xn--80ak6aa92e.com). Zone files and certificate logs also list the domain as xn--80ak6aa92e.com, so a filter matching ‘apple’ never flags it.
Each technique targets different user behaviors, so attackers often register multiple variations to maximize their catch rate.
Package Name Typosquatting
Attackers also typosquat software packages. The attackers publish malicious packages under names one typo away from popular libraries. They target registries such as npm, the JavaScript package registry, and PyPI, the Python Package Index. A developer who mistypes the name in an install command gets the attacker’s package instead. The package’s code then runs on that developer’s machine or build server. PyPI now flags potential typosquatting attempts when someone creates a new project.
Typosquatting vs Cybersquatting
These terms get confused often. Cybersquatting is registering a trademarked domain name (like ‘cocacola.net’) to resell it to the trademark owner for profit. Typosquatting is registering a misspelled version (‘cocaocla.com’) to intercept traffic and steal credentials. Cybersquatters want the brand owner to pay them for the domain. Typosquatters want to steal credentials from people who mistype the URL. A trademark owner can challenge both kinds of domain under the ACPA (the US Anticybersquatting Consumer Protection Act). The domain has to be confusingly similar to the trademark. The domain’s owner has to have registered or used the domain in bad faith, to profit from the trademark.
What Are Real-World Typosquatting Examples?
Recent typosquatting cases include a phishing proxy that took over PyPI maintainers’ accounts and npm packages built to steal cloud tokens. Our phishing domain examples show more lookalike login pages.
Facebook’s $2.8 Million Lawsuit
Facebook sued a group of domain owners under the ACPA over typosquatted versions of facebook.com, such as facebock.com and faceboik.com. In June 2013, the court entered default judgments totaling about $2.8 million in statutory damages.
Russia’s Doppelganger Domains (2024)
In September 2024, the US Justice Department began seizing 32 internet domains from Russia’s Doppelganger campaign. Some of the 32 domains imitated real news sites. For example, washingtonpost.pm imitated washingtonpost.com. The sites dressed up Russian government propaganda as real news to influence voters before the 2024 US presidential election.
The PyPI Phishing Proxy (2025)
In July 2025, an attacker emailed Python package maintainers from noreply@pypj.org with a link to pypj.org, one letter off from pypi.org. The site was a proxy that passed everything through to the real PyPI. PyPI’s incident report says four accounts were phished. The attacker uploaded two malicious releases of the num2words package. A proxy like this can also capture one-time codes and session cookies. With a captured code, an attacker can get past multi-factor authentication (MFA) that uses one-time codes. With a session cookie, the attacker doesn’t need to sign in at all.
VMware Typosquatting for Malware C2 (2024)
In February 2024, Unit 42 discovered a Linux variant of the Bifrost remote access trojan (RAT) using download.vmfare.com as its command-and-control (C2) server. The typosquatted domain mimicked VMware’s real domain to help the malware evade detection. When Unit 42 published its report, the domain was still undetected on VirusTotal.
Typosquatted npm Packages (2026)
In May 2026, Microsoft reported 14 malicious npm packages with names that imitated OpenSearch and Elastic libraries. All 14 packages were published within four hours. The packages were built to steal credentials and tokens for Amazon Web Services, HashiCorp Vault, GitHub Actions and the npm registry.
What Are the Goals Behind Typosquatting Attacks?
Most attackers use lookalike domains to steal credentials or spread malware. Others intercept email, earn ad revenue or target a competitor.
Credential Harvesting
The primary goal is stealing usernames and passwords. Fake login pages capture credentials that attackers use directly or sell on dark web forums. These stolen credentials often appear in combo lists.
Malware Distribution
Typosquatted domains serve as malware infrastructure. Users downloading software from lookalike domains install infostealers or RATs instead of legitimate applications. Typosquatted domains can also point to a C2 server, as download.vmfare.com did for Bifrost.
Phishing Campaign Infrastructure
Typosquatted domains provide convincing infrastructure for spear phishing campaigns. Email links to ‘amaz0n.com’ or ‘paypal.co’ look legitimate enough to bypass casual inspection. The domains add credibility to social engineering attacks.
Email Interception
A lookalike domain with a mail server receives email that people send to a mistyped address. Attackers also use the lookalike domain for business email compromise. They send invoices and payment requests that look like they came from a colleague.
Ad Fraud and Traffic Monetization
Some typosquatters simply monetize mistyped traffic through advertising. Users who land on parking pages covered in ads generate revenue for the domain owner. It’s less harmful than credential theft, but the domain still infringes on the brand’s trademark.
Competitive Disruption
Occasionally, typosquatting targets competitors. A company might register a domain that looks like a competitor’s to redirect the competitor’s traffic or display negative content. It’s rare compared to credential theft, but it happens.
How Do You Prevent Typosquatting?
To prevent typosquatting, register the likeliest lookalike domains yourself. Watch for lookalike domains that attackers register so you can block them. Require security keys or passkeys at sign-in too.
Defensive Domain Registration
Register common misspellings and TLD variations of your primary domains. This prevents attackers from registering them instead. Focus on high-value variations that users are most likely to mistype. You can’t register every permutation, and attackers will switch to a cheap TLD like .xyz the moment you lock down the obvious ones. But defensive registration still costs far less than cleaning up a successful attack.
Technical Controls
DNS Filtering: Block access to known typosquatted domains at the network level. Free options like Quad9 or Cloudflare’s 1.1.1.1 for Families provide basic protection. Paid services such as Cisco Secure Access (formerly Cisco Umbrella) and Cloudflare Gateway also include phishing categories you can block.
Email Security: Configure email gateways to scan URLs and block messages containing links to known typosquatted domains. Most enterprise email security products include this capability.
Browser Protection: Chrome, Firefox, and Safari use Google Safe Browsing to warn users about phishing sites. Microsoft Edge has Website Typo Protection specifically for typosquatted domains. Encourage employees to keep browser protections enabled.
DMARC/DKIM/SPF: Implement email authentication to prevent attackers from spoofing your domain in phishing campaigns that direct victims to typosquatted sites.
Phishing-Resistant MFA: Security keys and passkeys use the WebAuthn standard, which ties each sign-in to the real site’s domain. A security key won’t work on a lookalike domain. An attacker running a phishing proxy can’t sign in with a stolen password alone. PyPI’s incident report says a security key would have kept the attacker from using the second factor.
Watch for New Lookalike Domains
Every publicly trusted HTTPS certificate is recorded in public Certificate Transparency logs. Search the logs with a free tool like crt.sh. Look for new certificates on domains that contain your brand name or a common misspelling of it. Check your DNS logs for visits to lookalike domains. If several employees visited the same lookalike domain, block it and ask those employees whether they entered a password. Each fake login page an employee reports gives you a domain to block and to search your DNS logs for.
Free typosquatting checkers such as dnstwist give you a one-time list of the lookalike domains already registered. Lookalike domain monitoring checks new registrations continuously and sends an alert when someone registers a domain that looks like yours.
If an employee does type a password into a fake page, compromised credential monitoring can find that password. Monitoring covers the credentials phishing kits collect and data for sale on dark web marketplaces.
User Education
Train employees to bookmark frequently used sites instead of typing URLs. Roll out a password manager, because it only auto-fills a password on the domain where the password was saved. Teach employees to treat a login page the password manager won’t fill as a warning sign. On a login page the password manager won’t fill, employees should check the address before typing or pasting a password. Phishing simulations that include typosquatted domains test whether training is effective.
Users make mistakes. That’s why technical controls are your first line of defense. Training helps, but don’t rely on it alone.
How Do You Respond to a Typosquatting Attack?
Block the domain and file a takedown request. Removing the site won’t tell you which employees already entered a password on it.
Document Everything
Screenshot the typosquatted site and record the domain registration details using WHOIS lookup. Note the registrar, creation date, and nameservers. This evidence supports legal action and takedown requests.
Check for Credential Compromise
Search your breach monitoring tools for any credentials associated with the typosquatted domain. If employees visited the site and entered credentials, initiate password resets immediately. Revoke those employees’ active sessions too, because proxy phishing kits can steal session cookies. Check login logs for suspicious authentication attempts from unusual locations.
Block the Domain
Add the typosquatted domain to your DNS and email security blocklists. This stops additional employees from falling victim while you work on the takedown.
File Takedown Requests
Report the domain to the registrar’s abuse contact. Registrars accredited by ICANN must act on evidence of phishing. Suspending the domain is one of the actions they can take. For trademark-infringing domains, file a Uniform Domain-Name Dispute-Resolution Policy (UDRP) complaint. File it with a provider that ICANN has approved, such as the World Intellectual Property Organization (WIPO). ICANN is the organization that oversees domain names. You can also pursue legal action under the ACPA. Brand protection software can automate this process across multiple registrars.
Monitor for Related Domains
Attackers rarely register just one domain. Search for other variations that might be part of the same campaign. Check certificate transparency logs for certificates issued to similar domains around the same time.
Alert Affected Users
If customers or partners might have visited the typosquatted site, notify them immediately. Provide clear instructions for checking whether their credentials were compromised and how to protect themselves.
Key Takeaways on Typosquatting
Typosquatting works because humans are predictable. Users type URLs from memory and trust familiar-looking login pages. Attackers capitalize on that at scale.
Domain names reported for phishing rose 38% in a year, to over 1.5 million, according to Interisle.
So how do you fight back? Prevention and detection. Register defensive domains to block attackers from acquiring them. Implement DNS filtering and email security to catch typosquatted links. Give staff a password manager, which won’t fill a password on a fake domain.
Dark web monitoring shows which employees’ passwords turned up in phishing kits.
Breachsense typosquatting protection flags new lookalike domains and manages the domain takedowns for the malicious ones. Or check your dark web exposure to see what credentials are already circulating on criminal marketplaces.