Look-alike domains and typosquatting explained

paypa1.com. arnazon-support.com. microsoft-account-verify.net. They look right at a glance, and that's the whole point. Look-alike domains are website addresses designed to be mistaken for a real brand. Typosquatting is the version that bets on typing mistakes: register the address people get when they mistype a famous name, and wait for visitors.

These addresses are behind a large share of phishing pages and fake shops. The good news: once you know the tricks, they're surprisingly easy to spot.

First, how to read a website address

A website address has one part that really tells you who owns it: the domain name, right before the first single slash. And within it, what counts is the end.

• In www.amazon.co.uk/orders, the owner is amazon.co.uk.
• In amazon.co.uk.order-help.com/login, the owner is order-help.com. Everything before it is just a label the owner chose.
• In amazon-orders-help.com, the owner is amazon-orders-help.com, which has nothing to do with Amazon.

The rule: read the address from the end, not the beginning. Scammers put the brand name at the start because that's where people look.

The most common look-alike tricks

1. Typos and swapped letters

Addresses that differ from the real one by a single letter:

• a missing letter: gogle.com, amazn.com
• a doubled letter: paypall.com
• swapped letters: amaozn.com
• a neighbouring key on the keyboard: amazom.com

These catch people who type addresses by hand, and people who glance at a link without reading it closely.

2. Letters that look like other letters

Some letter combinations are almost impossible to tell apart, especially on a phone screen:

• rn looks like m: rnicrosoft.com
• vv looks like w: vvalmart.com
• 1 (one) looks like l: paypa1.com
• 0 (zero) looks like o: g00gle.com
• I (capital i) looks like l (small L) in many fonts

3. Characters from other alphabets

Some alphabets have characters that look identical to Latin letters. A Cyrillic "а" looks exactly like a Latin "a", but to a computer it's a completely different address. Modern browsers often protect you by showing such addresses in an unusual, scrambled form, but not always. If an address in your browser suddenly looks garbled or full of strange characters, don't log in.

4. Extra words around a brand

The most common trick by far. The brand name stays intact, and something is added:

• brand + action: paypal-login-secure.com, netflix-billing-update.com
• brand + shop words: nike-outlet-sale.store, adidas-official-shop.top
• brand + support: apple-support-help.com, microsoft-helpdesk.net

Big brands almost never use addresses like these. When they do run separate sites, they're usually listed on the brand's main website.

5. A different ending

Same name, different ending: brand.co instead of brand.com, brand.shop, brand.online, brand.info. Some endings are cheap and popular with people who run scam sites. It's also worth knowing that a shop with a country ending, such as .de, .fr or .co.uk, isn't necessarily based in that country.

6. The brand in the front part of the address

Like the example above: paypal.com.account-check.info. Because it starts with "paypal.com", many people read no further. The real owner is account-check.info.

Where you'll run into them

• Phishing e-mails and texts that link to a fake login page. See Phishing websites: how to spot fake login pages.
• Parcel scam texts, which love addresses mixing a carrier's name with words like redelivery or tracking. More in Parcel delivery scam texts.
• Fake shops pretending to be a brand's official outlet. See how outlet scam shops work.
• Search ads that appear above the real result for a bank, a crypto wallet or a support line. Fake support lines are the start of many tech support scams.
• Typing mistakes when you enter an address by hand.

Quick practice: real or fake?

Read each address and decide before you look at the last two columns. The fake ones are made-up examples in the style we see every day.

The pattern is always the same: find the end of the domain name, and ask whether that exact name belongs to the company you expect. If you're unsure, the company's official app or a bookmark gets you to the right place every time.

How to protect yourself

• Don't click links to log in. Open the app or type the address yourself, or use a bookmark.
• Use a password manager. It fills in your password only on the exact address it was saved for. If it doesn't offer your login, stop and look at the address.
• Read the address from the end. Find the part right before the first single slash and read it carefully.
• Zoom in on a phone. Many look-alike tricks only work on small screens.
• Be suspicious of urgency. Messages that say your account is locked or your parcel is on hold are designed to make you skip the address check.
• Check before you trust. Paste any address you're unsure about into websurely.com.

How websurely.com catches look-alike addresses

When you check a website, one of the things we look at is whether its name imitates a well-known brand. We compare it against well-known brands and the most visited websites in the world, and look for exactly the tricks described above: typos, swapped and look-alike letters, characters from other alphabets and brand names hidden inside longer addresses.

A website that looks like a famous brand but isn't that brand gets a strong warning in its Scam Score. We combine that with other checks: how long the website has existed, how many people visit it, whether it appears in more than a dozen trusted security databases that are updated around the clock, and red flags on the page itself. You can read how it all fits together in How websurely.com calculates the Scam Score.

Not every similar name is a scam, of course. Plenty of honest businesses have names that resemble a bigger brand by coincidence. That's why a look-alike name is a warning sign we weigh, not a final verdict, and why site owners can request a free manual review if they think we got it wrong.

The free websurely.com browser extension runs this check for you on every site you visit and shows a coloured risk badge in your toolbar.

If you've already entered details on a look-alike site

1. Change your password on the real website, typing the address yourself.
2. Change it anywhere else you used the same password.
3. If you entered card or banking details, call your bank on the number on your card.
4. Turn on two-step verification for important accounts.

Our guide What to do if you've been scammed online walks you through everything else. And please report the address, so the next person gets a warning.

Check a website now

Not sure whether an address is the real one? Check it on websurely.com before you log in or pay. It's free.