# Typosquatting and lookalike domains explained

> Typosquatting is registering a domain that is a small misspelling of a real one so that visitors who mistype or trust it land on the wrong site.

Canonical page: https://www.edgeprotect.io/guides/typosquatting-and-lookalike-domains
Breadcrumb: [Home](https://www.edgeprotect.io/) > Typosquatting and lookalike domains

## What do the terms mean?

Four words, often mixed up. The words overlap in everyday use. This table separates them by what the attacker does.

| Term | What it means | Example |
|---|---|---|
| Typosquatting | Registering a domain that is a small misspelling of a real one, so that people who mistype the address land on it. | acmme.com |
| Cybersquatting (domain squatting) | Registering a domain that contains someone else's brand name, usually to sell it back to them or to profit from their reputation. No typo is needed. | acme-official.com |
| Lookalike domain | Any domain built to be mistaken for another, by a typo, swapped letters, a look-alike character, an added word or a different ending. It is the widest term and includes typosquatting. | acrne.com |
| Domain spoofing | Forging the sender address of a message so it appears to come from the exact domain of the target. No new domain is registered. The term is sometimes used loosely for lookalikes as well. | From: ceo@acme.com |

## Domain spoofing versus typosquatting

Same goal, different fix. Both put a trusted name in front of a victim. They work in different places, so they have different defences.

**Domain spoofing** forges the sender address so that a message appears to come from your exact domain. The attacker registers nothing. It is stopped at your own domain with SPF, DKIM and DMARC, which tell receiving mail servers which senders are allowed to use your name and what to do with the rest. That work is done in your own DNS settings, and reading the DMARC reports that come back is a separate job. EdgeProtect does not read those reports.

**Typosquatting and other lookalikes** use a different domain that the attacker owns. SPF, DKIM and DMARC on your domain do nothing about it, because the message is genuinely sent from the attacker's domain and passes its own checks. The defence is to find the lookalike, which is a discovery problem. That is the part EdgeProtect covers: it watches continuously for lookalikes of your domain and shows whether each is registered and can receive email.

In practice you need both. Authentication closes the door on your exact name, and discovery watches the names next to it.

## How do you find lookalikes of your domain?

Start with the list.

- Start by listing what an attacker could register: the typo, swapped-letter, look-alike character and added-word variants of your domain. Open-source command-line tools can generate that list for you.
- Then find out which of those names exist. For that you need a lookup against registration and mail records, which the same script can do, or which monitoring does for you. A monitored domain in EdgeProtect is watched continuously, and you get an alert as soon as we spot a new lookalike or a change to a known one.
- When you find one, record it and report it to the registrar and the host. The guide to reporting a phishing website covers the steps.

## Where is the law covered?

UK readers, start here. Legal routes differ by country. For the position in the United Kingdom, including trade mark claims and the Nominet dispute process for .uk names, read "typosquatting and cybersquatting in the UK, from Precursor Security" at https://www.precursorsecurity.com/blog/typosquatting-and-cybersquatting-uk-law. It is general information and not legal advice.

## Questions

### What is the difference between typosquatting and cybersquatting?

Typosquatting depends on a mistake: the domain is a small misspelling of a real one and catches people who mistype it. Cybersquatting is wider. It means registering a domain that contains someone else's brand name, usually to sell it back or profit from it, and no typo is needed.

### Can a domain be spoofed?

Yes. Spoofing forges the sender address so that a message appears to come from your exact domain. SPF, DKIM and DMARC at your own domain are the defence. A lookalike domain is different: the attacker registers another domain, so those checks on your domain do not apply to it.

### How do I find lookalikes of my domain?

List the variants an attacker could register (open-source tools can generate the list), then check which exist. Monitoring a domain in EdgeProtect watches continuously for its lookalikes and shows whether each is registered and can receive email.

## Related

- [Brand protection](https://www.edgeprotect.io/features/brand-protection)
- [Domain monitoring](https://www.edgeprotect.io/features/domain-monitoring)
- [How to report a phishing website](https://www.edgeprotect.io/guides/how-to-report-a-phishing-website)