What is typosquatting?
Typosquatting is the use of a web address that looks like a well-known one: a letter changed, a word added, a different ending. It catches people who mistype an address, and people who read one too quickly.
Short answer. A typosquatted address copies a brand's name closely enough to pass a quick look: n0rthbank.com or northbank-secure-login.com for a bank called Northbank. Read the registered name (the part just before .com or .co.uk), and reach important sites from a bookmark or the app instead of a link. A password manager helps, because it fills in your password only on the real address. Run the checks on an address or a message.
What it is
Get Cyber Safe, the Government of Canada's advice service, puts it this way: "Cyber criminals will often register a common misspelled website that appears like a legitimate one", which it calls typosquatting or URL hijacking (Get Cyber Safe, read 29 October 2026). Australia's Scamwatch lists "The website address is slightly different to normal" as a warning sign of a scam (Scamwatch, read 29 October 2026).
The copied site may show a fake sign-in page, sell fake goods, install harmful software, or simply show adverts to people who mistyped.
The common tricks
The examples copy a made-up bank, Northbank, whose real address is northbank.com.
| Trick | Example |
|---|---|
| A letter missing, doubled or swapped | nortbank.com, northbnak.com |
| A look-alike character | n0rthbank.com (zero for o), northbank.corn (r and n together look like m) |
| Extra words | northbank-secure-login.com, northbank-verify.net |
| A different ending | northbank.co instead of northbank.com |
| The brand on the left of a stranger's name | northbank.com.account-help.net |
| Letters from another alphabet | nоrthbank.com with a Cyrillic "о", which looks the same as a Latin "o" |
The last trick is called a homograph attack. Many browsers show such an address in a coded form that starts "xn--", which is a clue in itself.
How to read an address
Find the ending (.com, .co.uk, .com.au, .in) and read the one word just before it. That word and the ending are the registered name, and the registered name decides who owns the site.
- In login.bank.example.net/secure, the site is example.net.
- In www.bank.co.uk, the site is bank.co.uk.
Everything to the left of the registered name is chosen by whoever owns it, and everything after the first slash is a page on that site. Neither proves anything.
What our look-alike check does
Our checker compares the registered name with a list of brands that criminals often copy, each with its own known addresses taken from Wikidata or the brand's own pages. It looks for the brand's name itself, look-alike letters, names one letter off, extra words, and mixed alphabets. It also tells you when the address is one of the brand's own.
Normal causes. Big brands own many older addresses that no list holds, so a brand's name in an address registered years ago is graded as worth knowing, not as a warning sign. Resellers, fan sites and local businesses with a similar name also exist.
What it cannot see. Copies of small or local brands that are not on our list.
How to protect yourself
- Reach banks, shops and government sites from a bookmark, the official app, or by typing the address. Get Cyber Safe advises: "Bookmark your favourite websites" (Get Cyber Safe, read 29 October 2026).
- Do not trust an address because it contains a brand's name, or because the page looks right. Copying a page takes minutes.
- Be most careful on a phone, where the address bar shows only part of the address.
Where a product helps
A password manager is the product that helps most here, and many are free (browsers and phones include one). It saves each password with the exact address, so on a look-alike address it offers nothing. The UK's National Cyber Security Centre says a password manager "helps protect you from phishing attacks as the password will only autofill on the correct website" (NCSC, read 29 October 2026). If yours does not offer your password, stop and read the address again.
A password manager cannot stop you typing a password by hand into a fake page, so treat a missing autofill as a warning, not a fault.
About this guide
Our checks that this guide explains: Look-alike. Each quote was read on the source's own page on the date shown. Legit Signals has no affiliate links: no company pays to be named here.
Last reviewed: 29 October 2026. Spotted an error? Tell us