What Is Typosquatting and How to Avoid Fake Websites

Typosquatting is registering web addresses that look like popular ones, hoping people will mistype or misread them. Land on one and you might see ads, a fake sign-in page, a scam shop or malware.

Common tricks

• Misspellings: an extra, missing or swapped letter, such as "gooogle" or "amazom."
• Different endings: ".co" or ".net" instead of ".com."
• Added words: "paypal-login" or "netflix-billing," sometimes called combosquatting.
• Lookalike characters: letters from other alphabets that look identical, such as a Cyrillic "а" in place of a Latin "a." Browsers often show these addresses in a form starting "xn--" (punycode) to reveal them.
• Missing dots: "wwwexample.com" instead of "www.example.com."

What the fake sites do

• Steal passwords with copies of sign-in pages.
• Sell fake or non-existent products.
• Show ads or redirect to other sites.
• Push downloads containing malware.

It's not just websites

Attackers also publish software packages with names close to popular ones on code libraries such as npm and PyPI, hoping developers mistype an install command.

How to spot a fake site

• Read the address bar carefully, especially the part just before ".com."
• Watch for Chrome's warnings: it can flag addresses that look like well-known sites and ask "Did you mean...?"
• Be suspicious of prices that seem too good, poor spelling and pressure to act now.
• Your password manager not offering to fill in a password is a strong warning sign.

Simple habits

1. Bookmark sites you use for banking, shopping and email.
2. Use a password manager; it only fills passwords on the real site.
3. Don't click links in unexpected emails or texts; type the address or use your bookmark.
4. Turn on two-factor authentication, ideally with a passkey or security key, which won't work on fake sites.

See spotting fake websites and two-factor authentication.

If you landed on a fake site

1. Close the tab without entering anything more.
2. If you entered a password, change it on the real site, and anywhere you reused it.
3. If you entered card details, call your bank.
4. If you downloaded something, run a malware scan.

Protect your clipboard

Scam pages sometimes try to read what you've copied. Clipboard Guard blocks websites from reading your clipboard. It doesn't detect fake sites, so the habits above still matter.