TL;DR:

  • Typosquatting involves registering domains similar to legitimate ones to deceive customers and employees — common variations include single-letter swaps, missing or added characters, and alternative TLDs
  • Free tools like dnstwist can generate and check hundreds of look-alike domains in minutes to show you what’s already registered
  • Defensive registration of your most likely look-alikes is the most reliable prevention, especially for your .co.uk, .com, and .org variants

One letter. That’s often all it takes. A customer types your domain wrong, lands on a copycat site that looks like yours, and either gets defrauded or leaves with a poor impression they blame on you. An employee receives an email from accounts@yourcompany-uk.com (instead of yourcompany.co.uk) and transfers money thinking it’s internal.

Typosquatting — registering domains that look like legitimate ones — is a well-established technique used in everything from simple phishing to full business email compromise operations. It’s not particularly sophisticated, which is part of the problem: it’s cheap and easy to do at scale, which means it gets done constantly.

What the attacks actually look like

The attacker’s goal is to make the fake domain visually convincing enough that people don’t look closely. Common techniques:

Single-character substitutions: yourcompany.co.uk becomes yourcopmany.co.uk (transposed letters), yourc0mpany.co.uk (zero instead of ‘o’), or yourcornpany.co.uk (rn replacing m — looks identical in many fonts).

Hyphen insertion or removal: yourcompany.co.uk becomes your-company.co.uk or your-company-ltd.co.uk. Both look plausible.

Added words: yourcompanyuk.com, yourcompanysupport.com, yourcompanyinvoices.com. The word added is usually chosen to match a use case — support, invoices, payroll, partners.

Different TLDs: If your main domain is .co.uk, attackers might register .com, .org, .uk, .net — any that are likely to be visited by mistake or that look authoritative enough to send emails from.

Homoglyph attacks: Using characters from different alphabets that look identical to Latin characters. An ‘а’ from the Cyrillic alphabet is visually indistinguishable from a Latin ‘a’ in most fonts. These are less common but particularly deceptive.

What do attackers do with these domains? Often, set up convincing copies of your website to harvest credentials or payment details from customers who mistype your URL. Or configure MX records and send phishing emails that appear to come from an organisation-like address. Business email compromise attacks almost always involve a look-alike domain — the attacker impersonates your finance team or a supplier using a domain one character different from the real one.

Finding out what’s already registered

The free tool dnstwist generates a comprehensive list of look-alike domains and checks which ones are actually registered. You can run it from the command line:

pip install dnstwist
dnstwist yourcompany.co.uk

It will output hundreds of permutations — character swaps, additions, homoglyphs, different TLDs — and flag which ones resolve to actual websites or have MX records configured. Any registered look-alike that has an MX record (meaning it can send email) is a potential phishing threat.

If you’d rather not run command-line tools, dnstwist also runs as a web service at dnstwist.it — paste your domain and it shows you the results. WHOIS history tools can tell you when a suspicious domain was registered, which sometimes correlates with phishing campaign timing.

For ongoing monitoring, tools like Cloudflare Registrar’s brand protection features, MarkMonitor (enterprise-tier), and various cyber threat intelligence services offer automated alerts when new look-alike domains are registered. Google Alerts with your brand name as the search term also catches some cases where the fake domain appears in phishing reports or news coverage.

What to do when you find one

If you discover a domain that’s clearly impersonating your business, you have a few routes:

NCSC reporting: The NCSC’s Suspicious Email Reporting Service (SERS) accepts reports of phishing domains at report@phishing.gov.uk. For websites rather than emails, Action Fraud (actionfraud.police.uk) takes online fraud reports. These won’t always result in quick takedowns, but they build the intelligence picture and sometimes trigger faster action.

Registrar abuse report: Every domain registrar has an abuse contact. File an abuse report with the registrar of the look-alike domain, explaining the impersonation. Registrars are required to act on credible abuse reports and will often suspend domains that are clearly being used for fraud.

NOMINET disputes (for .co.uk): Nominet, the registry for .co.uk domains, has a dispute resolution service (DRS) for cases where a .co.uk domain has been registered in bad faith. Filing a DRS complaint costs around £750–£1,500 but is a structured process that often results in domain transfer if the case is clear-cut. For small businesses, this makes most sense if the look-alike is actively causing harm — lost customers or active phishing — rather than pre-emptive.

Legal route (last resort): If the domain is being used to defraud your customers or impersonate your brand at scale, a solicitor’s letter to the registrant can prompt voluntary transfer. Actual litigation is expensive and slow, so most small businesses reserve it for serious ongoing harm.

The cheap prevention strategy: register the obvious ones

Domain registration costs around £10–£20 per year per domain. For the handful of look-alikes most likely to be mistyped or used in attacks — a transposition of your most common typo, your .com if you’re .co.uk, your .co.uk if you’re .com, and perhaps your-company.co.uk with a hyphen — the annual cost is modest insurance.

Configure these registered look-alikes to redirect to your real website. A customer who misypes your domain lands on your site anyway. An attacker who registers a look-alike first is preempted.

For email, consider setting up DMARC policies that reject email from domains with similar names — this won’t block the attacker’s domain directly, but combined with DMARC on your legitimate domain, it signals to email providers that you take impersonation seriously.

The NCSC’s Protective DNS service (available to some organisations through approved providers) also blocks known malicious domains including active phishing sites at the DNS level, which catches some look-alike domains once they’ve been flagged.

A quick dnstwist run on your domain name costs nothing and takes five minutes. If it shows registered look-alikes you weren’t aware of, that’s useful intelligence. If it shows MX records, it’s urgent.