Key Takeaways
Typosquatting works because it exploits how people actually read, not how carefully they intend to read. A URL is scanned, not proofread, especially on a phone where the address bar truncates long domains down to a handful of visible characters. Attackers who understand that don't need to build a flawless clone of a real site's design; they need a domain that survives a half-second glance, and there are several well-documented, repeatable techniques for building exactly that.
Direct answer: Typosquatting is the practice of registering domains that are visually or typographically close to a real one, through swapped characters, added hyphens, wrong top-level domains, or Unicode look-alikes, so that users who search, click a shared link, or misread a URL land on a fake site instead. The defense is to stop relying on reading the URL correctly in the moment: bookmark verified sites and use the bookmark, type addresses directly rather than clicking, and let a domain-locked password manager's silence on a fake page do the verification work a human eye can miss.
- Character substitution, added or removed hyphens, wrong top-level domains, and Unicode homoglyphs are the four core techniques behind fake look-alike domains.
- IDN homograph attacks can produce a fake domain that is visually indistinguishable from the real one in a browser's address bar, not just easy to misread.
- Attackers have repeatedly outbid real crypto projects for their own brand name in paid search ads, placing the fake domain above the genuine result.
- HTTPS and the padlock icon confirm encryption only, not identity; certificate authorities issue valid certificates for typosquatted domains routinely.
- A password manager that only autofills on the exact saved domain will not fill credentials on a look-alike domain, even one a human can't visually distinguish from the real one.
- Bookmarking a verified site and using that bookmark every time removes the URL-reading step from the equation entirely, which is the single most reliable individual defense.
What Typosquatting Is, and the Techniques Used Against Crypto Users
Typosquatting is the registration of a domain name deliberately similar to an existing, trusted one, with the goal of catching traffic intended for the real site: mistyped addresses, careless clicks, or a fast visual scan that doesn't register a small difference. It predates crypto by decades, showing up first against banks, retailers, and software vendors, but crypto is an unusually good fit for the tactic because the cost of a single successful visit is high, one connected wallet or one entered seed phrase can be worth far more than a stolen retail password, and because crypto users are routinely trained to move quickly between exchanges, wallet interfaces, and project sites as part of normal use. Five techniques account for nearly all of the fake domains built this way.
Character substitution
The most common technique swaps one or more characters for something that looks similar at a glance but isn't the same character at all. The classic example is replacing the letter "m" with "rn", two characters, r and n, set next to each other in most fonts render close enough to a single "m" that a fast read doesn't catch the difference, especially in a sans-serif typeface at small size. Numbers get swapped for letters they visually resemble: a zero for the letter "o", the digit "1" for a lowercase "l" or uppercase "I", or a "5" for an "S". None of these require anything exotic to register, they're plain ASCII characters arranged to fool the eye rather than the computer.
Added or removed hyphens and words
A second technique inserts or removes a hyphen, or adds a plausible extra word, in a way that still reads as a reasonable brand-adjacent domain. A real domain like coinbase.com spawns variants such as coin-base.com, coinbase-support.com, or coinbase-wallet-verify.com. These don't rely on being mistaken for the exact real domain so much as they rely on looking like a plausible extension of it, an official-sounding subdomain-style name that a user assumes is a legitimate support or verification portal run by the same company, when it's registered and controlled entirely by the attacker.
Homoglyph attacks and IDN homograph domains
This is the most sophisticated and least visually detectable technique. Domain names can include internationalized characters through a system called IDN, internationalized domain names, which allows non-Latin scripts, Cyrillic, Greek, and others, to be registered and displayed by browsers. Many of those characters are homoglyphs of Latin letters, meaning they are visually identical or nearly identical in most typefaces despite being entirely different characters at the code level. The most cited example is the Cyrillic "а" rendering indistinguishably from the Latin "a" in the vast majority of fonts. A domain built by swapping a single Latin "a" for its Cyrillic look-alike is a completely different domain to a browser, a certificate authority, and a DNS resolver, while looking exactly the same to a human reading the address bar. This is a real, well-documented technique known as an IDN homograph attack, demonstrated successfully against major brand domains in the past, not a theoretical risk. The domain is technically encoded and often stored internally in a punycode form starting with "xn--", but most browsers display the human-readable Unicode version by default, which is exactly what makes the attack effective, the punycode giveaway stays hidden during normal browsing.
Wrong top-level domain variants
The fourth technique doesn't touch the brand name at all, it changes the top-level domain, the part after the final dot. A project with an official .com domain gets a fake registered as the identical name under .io, .cc, .net, or a newer generic top-level domain. Crypto is particularly exposed to this because .io, originally the country code for the British Indian Ocean Territory, became a popular deliberate choice for legitimate crypto and tech projects, so users are already used to seeing crypto brands under unfamiliar top-level domains, which removes the instinctive suspicion a wrong TLD might otherwise trigger. A user who's used to typing or clicking a .io address for one project won't necessarily notice a .cc or a second, fake .io registration for another.
Subdomain tricks
The last common technique exploits how subdomains are read versus how they're actually structured. A URL like realbrand.attacker-domain.com is not a subdomain of realbrand.com at all, the actual controlling domain is attacker-domain.com, and "realbrand" is simply a label the attacker chose to put in front of it. Because people read left to right and tend to focus on the first recognizable word in a URL, a domain constructed this way can pass a fast glance as belonging to the real brand, when the portion of the address that actually determines who controls the site, and where any submitted credentials go, is the part furthest from that familiar brand name.
Worked Example: One Character, One Wallet
Illustrative walkthrough using a placeholder brand name — for education only, not a real incident.
To make the mechanics concrete without implying any real company was involved, imagine a fictional crypto exchange called Novacore. Its real, official domain is novacoreexchange.com. Here's how a typosquatted version of that exact domain might be constructed, and why it's nearly invisible in normal use.
The real domain: novacoreexchange.com
A character-substitution variant: novacorexchange.com, missing the second "e" in "core exchange," a single dropped letter that a fast reader's brain automatically fills back in, because the overall shape and length of the word still resembles the familiar one.
An "rn" for "m" variant applied to a different placeholder, Novacore rendered with a lowercase "m" somewhere in a longer brand name, swapped for "rn", would look correct in most sans-serif interface fonts at normal size, and would only reveal itself under close inspection or a serif font where the two shapes separate more clearly.
A homoglyph variant: the same domain, novacoreexchange.com, but with the Latin "a" after "nov" replaced by the Cyrillic "а". Rendered in a browser's address bar, the two strings are visually identical; unlike the missing-letter or rn-for-m tricks, this isn't a matter of reading quickly, it's a domain built from characters selected specifically because human vision cannot tell them apart at any reading speed.
Why mobile makes this worse: on a phone, address bars are narrow and frequently show only a truncated portion of a long domain before an ellipsis, or hide it entirely once a page has scrolled. A user checking "does this look right" on mobile has meaningfully less of the actual domain string available to check than on a desktop's full-width address bar, so even variants a careful desktop read might catch become effectively invisible.
None of these fake Novacore domains needs to fool a computer; DNS and certificate systems treat each as a completely distinct, independently valid domain. They only need to fool the person glancing at the address bar for the half-second it takes to decide the page looks right and proceed to log in or connect a wallet.
How Fake Domains Reach You
Registering a convincing look-alike domain is only half the operation; it has to be put in front of a target before it's useful, and three distribution channels account for most of the traffic these fake domains receive.
Paid search ads
Search engines sell advertising space against brand-name search terms, and attackers have repeatedly and publicly been documented buying ads that outbid the real project for its own name, placing a fake domain in the sponsored results above the genuine organic listing. A user searching for a well-known exchange or wallet by name can see the fake domain first, styled with an ad label most people don't distinguish from a normal result at a glance. Platforms remove reported malicious ads, but new campaigns get bought faster than existing ones are taken down, so this stays an ongoing arms race rather than a solved problem.
Fake social media posts and replies
The second major channel is social media, particularly reply-bots that post underneath a real project's own announcements, offering a "giveaway," "migration," or "support" link pointing to the fake domain. Because the reply appears directly beneath a genuine, trusted post, it borrows a sliver of that post's credibility, and impersonation accounts using a copied name, avatar, and bio make it look like it came from the project itself.
Phishing emails and direct messages
The third channel is the most traditional: an email or direct message, often claiming an account issue, a security alert, or an urgent claimable reward, with the fake domain embedded as a link or button. These messages are frequently sent at scale to addresses scraped from data breaches or public project communities, and the urgency framing is deliberate, designed to shorten the time a recipient spends evaluating the link before clicking it.
Practical Verification Techniques
Because these techniques are built specifically to defeat a quick visual read of the URL, the effective defenses are ones that don't depend on reading the URL correctly in the moment at all.
Bookmark real sites directly
The single most reliable habit is verifying a site's real domain once, through a trusted source, and saving it as a browser bookmark, then using that bookmark every time afterward instead of searching for the site or clicking a link from an email, DM, or ad. A bookmark you created yourself from a verified address cannot be silently swapped out the way a search result, a shared link, or a social media post can be, and it removes the URL-reading step from every future visit entirely.
Type or paste from a verified source, don't trust a link
When a bookmark isn't available, typing the address out manually, character by character, or pasting it from a source you've independently verified, such as a project's official documentation you navigated to directly, is meaningfully safer than clicking a link handed to you in a message, comment, or ad. The click removes the one moment where a careful reader might otherwise pause on the actual string of characters.
HTTPS and the padlock icon are not proof of legitimacy
A valid HTTPS certificate and the padlock icon in the address bar confirm exactly one thing: the connection between your browser and whatever server is on the other end is encrypted. They say nothing about who controls that server. Certificate authorities issue valid certificates to domain owners based on domain control, not brand identity, which means an attacker who has registered a typosquatted domain can obtain a completely legitimate, browser-trusted HTTPS certificate for it just as easily as the real project can for its own domain. Treating the padlock as a legitimacy check, rather than strictly an encryption check, is one of the most persistent and dangerous misconceptions in this space.
Use a password manager that autofills only on the exact saved domain
This is the strongest technical, rather than behavioral, defense available. A password manager stores credentials tied to the specific domain where they were originally saved and checks that domain exactly before offering to autofill, it does not evaluate whether a page looks correct the way a human does. Landing on novacorexchange.com when your saved credentials are tied to novacoreexchange.com, or on a domain using a homoglyph character your eye can't distinguish from the real one, means the password manager simply won't offer to fill anything, regardless of how convincing the page looks visually. That silence is a machine-verified signal operating on the actual domain string, immune to the visual tricks that fool human reading, and it's available as a passive check on every login attempt without requiring any extra deliberate effort in the moment.
Misconceptions Versus Reality
| Misconception | Reality |
|---|---|
| A site with a padlock icon and HTTPS is safe | HTTPS only proves the connection is encrypted, not that the site is who it claims to be; typosquatted domains routinely carry valid, legitimate certificates |
| If a domain looks right when I glance at the address bar, it is right | Character substitution and homoglyph techniques are specifically designed to survive a quick visual scan; some, like IDN homograph domains, are indistinguishable from the real domain to the human eye at any reading speed |
| The top search result for a brand name is reliably the official site | Attackers have repeatedly outbid real projects for paid ads against their own brand-name search terms, placing a fake domain above the genuine organic result |
| A link is safe to click if it was shared by someone who seems trustworthy or knowledgeable | Compromised accounts, impersonation profiles, and forwarded links from someone who was themselves fooled all carry the same fake domain regardless of who shared it |
| Unusual top-level domains like .io or .cc are inherently suspicious in crypto | Legitimate crypto projects commonly use non-.com top-level domains by choice, which means users are desensitized to a signal that would otherwise help flag a fake |
| My browser or antivirus software would warn me before I reached a fake domain | Newly registered typosquatted domains are frequently not yet flagged by browser or security-vendor blocklists, especially in the hours or days immediately after registration |
Common Mistakes That Make This Work
Beyond the domain-construction techniques themselves, a small set of everyday habits is what actually lets typosquatting succeed at scale, and each one is directly correctable.
- Clicking the first search result for a brand name without checking the actual URL. Treating search rank, especially a sponsored result, as a proxy for legitimacy skips the one check, reading the actual domain string, that would catch most typosquatted variants.
- Trusting a link because it was shared by someone who seems credible. A link's safety depends entirely on the domain it points to, not on the credibility of whoever shared it; a compromised account, an impersonation profile, or a well-meaning person who was themselves fooled all distribute the identical fake domain.
- Reading a URL quickly instead of character by character. Fast pattern-matching, recognizing the general shape of a familiar brand name, is exactly what character substitution and dropped-letter tricks are built to exploit; slowing down for the handful of seconds it takes to read a URL deliberately defeats most of these variants outright.
- Assuming a bookmarked-feeling or previously-visited-feeling site is the real one. A convincing fake, especially one reached repeatedly through the same compromised ad campaign or search result, can start to feel familiar through repetition alone, which is not the same thing as having verified it.
- Ignoring a password manager's failure to autofill. When a password manager that normally fills a login form automatically stays silent, that's a signal worth stopping for, not a minor inconvenience to work around by typing credentials in manually.
Risks, Limitations, and Exceptions
- New top-level domains and character combinations continue to expand the pool of plausible-looking fake domains available to register, so the specific examples here will look somewhat different from future variants.
- Homoglyph and IDN homograph domains can defeat even a slow, deliberate visual read of the address bar, since the underlying issue is a genuine rendering ambiguity, not a lapse in attention.
- Blocklists maintained by browsers and security vendors lag behind newly registered domains, sometimes by days, which means a brand-new typosquatted domain may not yet trigger any automated warning.
- A password manager only protects logins it has previously saved; it offers no protection on a first-time visit to any domain, real or fake, before credentials exist for it.
- Mobile browsers' truncated address bars reduce the amount of domain text available to check at all, independent of how carefully a user is reading.
- Recovering funds after credentials or a wallet approval have been captured through a fake domain is rare regardless of how quickly the mistake is discovered.
Practical Implementation Checklist
- Verify each site you use regularly once, through an independently trusted source, and save it as a browser bookmark rather than searching or clicking to reach it again.
- Read any unfamiliar or shared URL character by character before trusting it, and be aware that dropped letters, added hyphens, and rn-for-m substitutions are specifically built to survive a fast scan.
- Never treat the top search result, sponsored or organic, as automatically legitimate; check the actual domain before clicking.
- Use a password manager that autofills only on the exact saved domain, and treat its silence on a login page as a stop signal, not a nuisance.
- Remember that HTTPS and the padlock icon confirm encryption only, never identity or legitimacy.
- Be extra cautious on mobile, where truncated address bars hide the portion of a domain that would otherwise reveal a fake.
- Don't assume an unusual top-level domain like .io or .cc is inherently suspicious in crypto, but do check it against the specific project's actual known domain.
- Report suspected typosquatted domains to the platform hosting any ads or posts promoting them, and to the real project's official channels.
Tool Opportunity
A domain comparison tool built specifically to catch these techniques, character substitution, hyphen insertion, homoglyph characters, and top-level domain mismatches, would help readers evaluate an unfamiliar link before entering credentials or connecting a wallet.
Recommended inputs: the domain or full URL in question, and, where known, the project's verified official domain to compare it against.
Expected outputs: a character-level diff highlighting any substitution, added or removed hyphen, or top-level domain change; a homoglyph scan flagging any non-Latin Unicode character present in the domain string and its punycode representation; and a plain-language summary of which specific typosquatting technique, if any, the domain matches.
Validation requirements: never request or store login credentials as part of the check, label every output as a heuristic comparison rather than a verdict on whether a site is malicious, and clearly surface the punycode form of any domain containing non-ASCII characters so a homoglyph substitution can't hide behind its rendered appearance.
Sources
- Federal Bureau of Investigation, Internet Crime Complaint Center (IC3), public service announcements on cryptocurrency fraud, including phishing and fraudulent-website schemes. See ic3.gov.
- Federal Trade Commission, "What To Know About Cryptocurrency and Scams," consumer guidance on fake and impersonating websites used to target crypto users. See consumer.ftc.gov.
- ICANN Security and Stability Advisory Committee (SSAC), published guidance and advisories on internationalized domain names and confusable-character abuse in domain registration. See icann.org/groups/ssac.
Frequently Asked Questions
What is typosquatting in the context of crypto scams?
Typosquatting is registering a domain name that's nearly identical to a real one, differing by a swapped letter, an added hyphen, a different top-level domain, or a Unicode character that looks the same, so that users who mistype, skim, or get redirected land on a fake site built to imitate the real one. In crypto, that fake site typically imitates an exchange, wallet, or project login page to capture credentials, seed phrases, or wallet approvals.
What is an IDN homograph attack and how is it different from a simple typo?
An IDN homograph attack uses internationalized domain name support to register a domain built from Unicode characters, such as Cyrillic letters, that render visually identical to Latin letters on screen, rather than relying on an actual misspelling. A domain using a Cyrillic а in place of a Latin a can look pixel-for-pixel the same as the real domain in most browsers' address bars, which makes it invisible to careful reading rather than just easy to miss when skimming.
Does a padlock icon or HTTPS mean a site is safe?
No. HTTPS and the padlock icon only confirm that the connection between your browser and the server is encrypted; they say nothing about who controls that server or whether the site is the legitimate one. Certificate authorities routinely issue valid HTTPS certificates for typosquatted domains, so a fake exchange login page can carry the exact same padlock as the real one.
How does a password manager protect against typosquatted domains?
A password manager stores credentials tied to the exact domain where they were originally saved and will not offer to autofill them on a different domain, even one that looks identical to a human eye, including homoglyph and character-substitution variants. If you land on a fake login page and your password manager stays silent instead of offering to fill the username and password, that silence is itself a strong signal something is wrong before you've typed anything.
Why do fake crypto domains show up at the top of search results?
Attackers routinely buy paid search ads targeting a real project's brand name, and have repeatedly been documented outbidding the legitimate project for its own name as a search term, which places the fake domain above the genuine organic result. Search platforms remove reported ads, but new ones are bought faster than they're taken down, so treating the top result, sponsored or not, as automatically trustworthy is a recurring source of losses.
What's the safest way to reach a crypto exchange or wallet site I use regularly?
Save the real site as a browser bookmark the first time you verify it through a trusted source, such as typing the address directly or confirming it against the project's official social media, and use that bookmark every time afterward instead of searching or clicking links from emails, DMs, or ads. A bookmark you created yourself cannot be silently swapped for a fake one the way a search result or a shared link can.
Which Swoopr tool helps verify whether a domain is legitimate?
A domain comparison and link checker that flags character substitutions, homoglyph characters, and mismatched top-level domains against a project's known official domain, paired with the bookmark and password-manager habits on this page, is the practical way to check an unfamiliar or shared link before entering any credentials or connecting a wallet.
Conclusion
Typosquatting doesn't rely on convincing anyone of anything, it relies on nobody looking closely enough to disagree. Character substitution, hyphen tricks, wrong top-level domains, and homoglyph characters are all built around the same insight: a URL gets scanned, not proofread, and the fake only has to survive that scan for a second. The domains reach people through paid search ads, fake social posts, and phishing messages, each designed to get a click before a careful read happens. The defenses that actually work don't depend on reading more carefully in the moment, they remove the moment: bookmark verified sites and use the bookmark, type or paste from a source you've independently checked rather than clicking, remember HTTPS proves encryption and nothing else, and let a domain-locked password manager's silence do the verification a human eye sometimes can't. Read the phishing hub for the wider set of tactics this fits into, and the site-verification guide for a deeper walkthrough of checking any link before you act on it.
Related Reading
- Phishing & Wallet Drainers — the parent hub covering the full range of phishing and drainer tactics beyond fake domains.
- How to verify a legitimate site — a deeper walkthrough of the domain, certificate, and account checks referenced throughout this guide.
- How phishing works — the broader mechanics of social engineering that typosquatted domains are built to support.
- Fake airdrop phishing — how look-alike domains are frequently paired with fake token claims and giveaways.