Typosquatting: How One Typo Becomes a Phishing Site
2026-10-13 · 9 min read · By the DomainGuard team
The short version
Typosquatting is when an attacker registers a domain that looks like yours, one letter off, a swapped letter, a lookalike character, an extra word. Then they use it to phish your customers, intercept your email, or steal your traffic. In March 2026, the town of Surfside Beach, South Carolina, wired $545,598.30 to criminals who had registered surfsidesbeach.org, the town's real domain with a single extra "s", days earlier. The forensic investigation found no evidence of any breach of the town's own systems. Nobody hacked anything. The attackers just owned a name that looked close enough to be trusted.
How a typosquat attack actually unfolds
Most explainers stop at "attackers register similar domains." That tells you nothing about the sequence, and the sequence is where the damage happens. Here is how a typical campaign runs, step by step. This is a composite scenario built from real incident patterns, the Surfside Beach case above is one verified example of it.
Step 1: pick the target and generate variants. The attacker picks a brand, a vendor, or a municipality that moves money by email. They generate dozens of lookalike variants, omissions, transpositions, extra letters, hyphenated combos, alternate TLDs. Registration costs around $10–15 per name for a year. For the price of a lunch, they can hold twenty variants.
Step 2: register and set up mail. The critical move most people miss: the attacker publishes MX records on the lookalike domain. Now the fake domain can send and receive email. Password resets, invoices, and confidential threads addressed to a mistyped domain don't bounce, they land in the attacker's inbox.
Step 3: build the clone. A copy of the target's login page or payment portal goes up on the lookalike. In 2026, these clones routinely carry valid TLS certificates, so the browser shows the padlock and no warning. The certificate is real. The operator is a criminal.
Step 4: the lure. The attacker doesn't wait for typos. They send email from the lookalike — an "updated invoice," a "new bank details" notice, a "please re-confirm your payment" message. On a phone screen, surfsidesbeach.org and the real domain are visually identical to a busy clerk.
Step 5: the money moves. The victim wires funds or hands over credentials. By the time anyone notices the extra letter, the domain is abandoned and the money is gone. The Surfside Beach investigation concluded the attackers used the lookalike specifically to delay discovery while the funds moved.
The techniques attackers actually use
Attackers don't guess. They work through a known set of transformations, and automated tooling generates all of them in seconds:
- Omission, dropping a letter: exampl.com. The Surfside Beach case was the inverse (an added letter), which shows both directions get used.
- Transposition, swapping two letters: exmaple.com. One of the most common because fast typists transpose constantly.
- Replacement, a neighboring keyboard key: exanple.com (n sits next to m on QWERTY).
- Homoglyphs, lookalike characters from other alphabets: exampIe.com (capital I for lowercase L), or a Cyrillic "а" swapped for a Latin "a". Browsers render these through punycode (xn--...), but most users never look at the raw form.
- Combosquatting — adding trusted words: secure-example-login.com, example-payments.com. These don't rely on typos at all, they rely on the words "secure" and "login" doing the persuading.
- TLD-swap, your name on another ending: example.co, example.io, example.org. Cheap, and many users treat all TLDs as interchangeable.
- Bitsquatting, a single flipped bit in a character, catching hardware memory errors. Rare in practice, but it shows the level of thoroughness in the tooling.
Scale matters here. The World Intellectual Property Organization logged a record 6,200 domain disputes in 2025, a 68% increase since 2020, driven substantially by squatting scams. That is only the cases that reached formal dispute, the ones where the brand noticed, cared, and paid to fight.
Why it keeps working
People read the shape of a domain, not each character. On a phone screen, rn looks like m. In a mail client preview pane, nobody inspects every letter of the sender's domain. And crucially: email clients and browsers do not warn you when a domain is merely similar to one you trust. The padlock means the connection is encrypted, not that the operator is who you think.
There is also an asymmetry that favors the attacker. The defender has to protect every plausible variant of their name. The attacker only needs one variant the victim won't scrutinize. And registration is instant, anonymous enough, and costs less than the coffee the victim was drinking when they approved the wire.
The email angle most people miss
Here is the detail that changes how you should think about this. A lookalike domain with MX records can send email that passes SPF — because SPF checks the sending server against the lookalike's DNS, which the attacker controls. Your SPF record, your DKIM keys, your DMARC policy: none of them apply. They protect your domain from being spoofed directly. They do nothing about a cousin domain that looks like yours.
This is why typosquatting and business email compromise travel together. The Surfside Beach attackers didn't spoof the town's domain, DMARC would have caught that. They sent from a domain the town didn't own and wasn't watching. When we scan lookalikes at DomainGuard, we check MX records specifically for this reason: a lookalike with mail infrastructure is a lookalike being prepared for email fraud, not a parked domain.
Do the math: defensive registration vs. dispute
Once you accept that you can't win the variant game perfectly, the question becomes economic. Run the numbers:
Defensive registration costs $10–15 per domain per year. Registering the 10–20 highest-risk variants of your brand, transpositions, omissions, the major TLD swaps, the obvious combosquat forms, runs roughly $150–300 a year. That is a rounding error in any security budget.
A UDRP dispute (the ICANN Uniform Domain-Name Dispute-Resolution Policy) starts around $1,500 in filing fees for a single domain before a single-member panel, and that assumes you handle it yourself. With counsel, expect several thousand dollars and weeks of calendar time. The ACPA route (US federal court) costs more. And during the weeks the dispute runs, the attacker's domain stays live.
So the rational priority order is: first, register the variants an attacker would actually weaponize (transpositions and omissions of your exact brand on .com, plus the TLD swaps of your exact brand); second, monitor everything else continuously so you find weaponized variants within days, not months; third, keep the dispute process as the backstop for the one that slips through. Monitoring is what makes this strategy work, defensive registration covers the obvious, monitoring covers the infinite rest.
Check your own exposure in ten minutes
You can see the scale of your own problem right now with open-source tooling. dnstwist generates the variant list and checks which are registered:
$ pip install dnstwist $ dnstwist --registered --mx example.com
Replace example.com with your domain. The --registered flag filters to variants someone actually owns; --mx adds mail-server information. Output lines look roughly like this:
exmaple.com registered A:93.184.216.34 MX:mail.exmaple.com examplle.com registered A:93.184.216.34 (no MX)
Read it like an attacker would. Registered + has MX records is the combination that should raise your pulse, it means someone is paying to keep that lookalike emailable. Registered + has a website deserves a look at what's hosted there: password fields, login forms posting to other domains, your brand name in the page title on a domain you don't own are classic phishing-kit signals. Registered + parked (a for-sale page) is lower priority but worth noting, because parked today doesn't mean parked next month.
One run gives you a snapshot. The gap is what happens between snapshots — which is why continuous monitoring exists. A variant registered on Tuesday and weaponized on Thursday beats a monthly manual check every time.
What to do when you find a weaponized lookalike
Move on every channel at once: the registrar's abuse contact, the hosting provider's abuse desk, Google Safe Browsing and Microsoft SmartScreen for browser-level blocking, the community feeds (PhishTank, Netcraft), and law enforcement for financial fraud. Blocklisting protects users within hours even while the domain itself is still being fought over. We walk through the full takedown ladder, with the exact reporting URLs and what evidence to attach, in our phishing takedown guide.
FAQ
Is typosquatting illegal?
Often, yes, but "illegal" and "quickly stoppable" are different things. In the US, the Anticybersquatting Consumer Protection Act (ACPA) allows trademark owners to sue bad-faith registrants, and the UDRP offers an administrative process to transfer or cancel abusive registrations. Both take time and money, which is why prevention and fast detection beat legal remedies in practice.
Does DMARC stop typosquatting?
No. DMARC stops attackers from sending email as your exact domain. It does nothing about a lookalike domain the attacker owns outright, because the lookalike passes its own SPF and DKIM checks. This is one of the most common misconceptions we encounter.
How many variants should I defensively register?
Start with the 10–20 highest-risk: single transpositions and omissions of your brand on your primary TLD, your exact brand on the other major TLDs, and the two or three most plausible combosquat forms (yourbrand + pay, login, secure, support). Then monitor the rest instead of trying to register the infinite tail.
Can a typosquat domain get a real HTTPS certificate?
Yes. Domain-validated certificates only prove the requester controls the domain, and the attacker does control the lookalike. Never treat the padlock as proof of legitimacy.