Category: Deception & Impersonation
Typosquatting and homograph attacks
Typosquatting uses a domain one typo from a real brand. Homograph attacks swap in lookalike letters from other alphabets.
Both lead to fake logins, downloads, or checkouts. Your eyes will miss some of them. Use bookmarks for important sites. Let your password manager check the domain.
One wrong character can send you to a credential thief. A lookalike domain can still show a padlock.
Updated 2026-10-30
What is typosquatting?
MITRE T1583.001 covers buying domains that resemble real ones. Tricks include homoglyphs and swapped top-level domains. MITRE notes typosquats can also deliver drive-by downloads.
Lookalikes often host fake login pages or brand impersonation scams.
- You mistype an address or click a lookalike link.
- Ads and search results can surface the fake domain.
- The site clones a login, download, or support page.
- You enter credentials or payment details there.
What is a homograph attack?
A homograph attack swaps in letters that look identical. A Cyrillic а can pass for a Latin a. Internationalized domain names make this possible. Their ASCII form, called punycode, starts with xn--.
How do you spot a lookalike domain?
Read the address from right to left. The name just before the ending is the owner. The FTC also advises checking for misspellings or switched letters.
| Pattern | Fictional example | What to check |
|---|---|---|
| Typo | exmaple instead of example | Read every letter slowly |
| Added word | example-login instead of example | Extra words make a different domain |
| Swapped ending | .co or .net instead of .com | Check the top-level domain |
| Subdomain trick | example.com.login-check.test | Read right to left: the owner is login-check.test |
| Unicode lookalike | exаmple with a Cyrillic а | Watch for xn-- in the address bar |
Lookalike domain patterns. Every example is fictional.
Does Chrome warn about lookalike domains?
For some domains, yes. Chromium's IDN policy shows punycode for risky mixed scripts. Chrome also blocks some lookalike URLs with a warning. New typos can still slip past these checks.
Why do people and filters miss lookalike domains?
- New domains have no reputation, so blocklists lag.
- Ads and search results can rank lookalikes highly.
- People skim addresses and miss one character.
- Valid certificates make lookalike sites show a padlock.
How do you protect yourself and your brand?
- Open important sites from bookmarks, not search results.
- Use a password manager tied to your saved domains.
- Treat a missing autofill as a reason to stop.
- Prefer passkeys, which lookalike domains cannot use.
- Register common misspellings of your own brand.
- Watch new lookalike registrations and request takedowns.
Does browser isolation help with lookalike domains?
- Isolation cannot tell a real domain from a fake one.
- Shield opens a page in an isolated browser off your device.
- Shield cannot stop you sharing passwords with unfamiliar sites.
Limits
- Examples are fictional and simplified.
- Browser warnings vary by version and settings.
- Sources were checked on October 30, 2026.
- Legba publishes this guide. Shield is part of Legba's Chrome extension.
FAQs.
How is typosquatting different from phishing?
What is punycode?
Will a padlock or certificate warning reveal a lookalike domain?
Do browser warnings stop typosquats?
What is the simplest mitigation?
What is a homograph attack?
Can isolation stop credential entry on a typosquat?
References
- 01
- 02
- 03FTC: Scammers hide harmful links in QR codes to steal your informationFederal Trade Commission
- 04
Keep exploring
- ShieldShield opens a page in an isolated browser off your device.
- All guidesThreats, secure apps, and AI security pages.
- All browser threatsBrowse threats by category and intent.
- Secure apps directorySecure browsing guides for top SaaS apps.
- AI security guidesBrowse guides about AI prompt leakage and prompt injection.
