Typosquatting and Homoglyph Domains Explained

How attackers register lookalike domains such as examp1e.com and exarnple.com, why they work, and how brands can detect, prioritize and remove them effectively.

Almost every phishing campaign against a brand needs a domain that looks close enough to the real one to pass a quick glance. Two families of tricks dominate: typosquatting, which relies on typing and reading mistakes, and homoglyphs, which rely on characters that look alike. In this guide we use the reserved name example.com to show how they work.

Typosquatting: betting on small mistakes

Typosquatting domains imitate the errors people make when typing or skimming an address. The most common patterns are:

• Omission: a missing letter, as in exmple.com.
• Repetition or insertion: an extra letter, as in exammple.com.
• Transposition: two letters swapped, as in exapmle.com.
• Keyboard neighbors: a key next to the right one, as in exanple.com.
• Different extension: the same name on another TLD, such as example.co or example.net.
• Hyphens and dots: ex-ample.com or wwwexample.com.

A close relative is combosquatting, where the real brand name is combined with a reassuring word: example-login.com, example-support.com, secure-example.com. These contain no typo at all, which is exactly why they fool people.

Homoglyphs: characters that look the same

Homoglyph attacks exploit the fact that different characters can look nearly identical, especially in certain fonts or on small mobile screens.

• Digit for letter: examp1e.com uses the number one instead of a lowercase L; in names that contain an O, a zero can play the same role.
• Letter combinations: exarnple.com uses “r” and “n” side by side to imitate “m”. Similarly, “vv” can pass for “w”.
• Uppercase and lowercase: a capital I and a lowercase l are hard to tell apart in many fonts, which matters in e-mail display text.
• Unicode lookalikes: internationalized domain names (IDNs) allow letters from other scripts. A Cyrillic “а” or “е” looks the same as its Latin counterpart but produces a completely different domain. Behind the scenes these names are stored in a form beginning with xn--, known as Punycode.

Modern browsers apply rules that display suspicious mixed-script names in their Punycode form, which reduces but does not eliminate the risk. E-mail clients, messaging apps and SMS previews do not always offer the same protection.

A note for brands with Turkish characters

If your brand name contains ç, ğ, ı, ö, ş or ü, you have two spellings to protect: the ASCII form and the form with Turkish characters. A brand called “Örnek”, for example, would need to watch both ornek.com and the internationalized örnek.com, plus the usual variations of each. The dotless ı and the dotted i are a particularly easy pair to confuse.

Why these domains are so effective

People rarely read a full address. They recognize a shape, a logo and a familiar color scheme. On a phone, the address bar may show only part of the domain, and links in SMS or chat apps are often shortened. Attackers also use lookalike domains to send e-mail, which is why authentication alone does not solve the problem; see our post on SPF, DKIM and DMARC for what they do and do not cover.

How to detect lookalikes

• Generate permutations of your brand and key product names, then check which variations are registered. Open-source tools exist for this.
• Watch new registrations and certificate transparency logs, where newly issued certificates often reveal a phishing domain before it is used.
• Check DNS signals: a lookalike with mail server (MX) records may be preparing e-mail fraud; one pointing to live web content needs a closer look.
• Compare page content against your own sites to spot cloned logos, titles and forms.

What to do about them

Not every lookalike domain is malicious. Some are parked, some belong to unrelated businesses, and some are owned by fans or resellers. Prioritize by behavior: active phishing pages and e-mail-capable domains come first and can usually be handled through hosts, registrars and blocklists. Parked domains that infringe your trademark may be better suited to legal routes such as the UDRP domain dispute process. Defensive registration of your most obvious variants is worthwhile, but no brand can register every possible combination, which is why continuous monitoring matters.

Phishvoid monitors lookalike and homoglyph domains for your brand and takes action as soon as one goes live. Book a free exposure scan to see which variations already exist, or report a phishing site you have found.