Lookalike Domains & Typosquatting: How Scammers Hijack Your Checkout

The URL bar is the most underused safety check on the web. Most people glance at it, see something that looks roughly like a brand they know, and move on. Scammers have built an entire industry around that one glance.

Lookalike domains — also called typosquatting, cousin domains, or doppelganger domains — are registered specifically to be mistaken for the real thing. A single character off, a swapped TLD, a Cyrillic letter that looks identical to the Latin one. The point is to catch the moment between “does this URL look right” and “does this URL match.”

Why lookalike domains exist

Three reasons scammers love them, in order of impact:

• They’re cheap. Registering twenty variants of a brand costs less than $40 a year. Even a 1% success rate pays for itself many times over.
• They survive ad review. Google, Meta, and X all run automated checks on landing-page domains. A lookalike that’s “close enough” can pass review long enough to catch its targets.
• They’re forgivable to the eye. Your brain auto-corrects URLs the way it auto-corrects sentences with letters in the wrong order. Scammers exploit this without you noticing.

The six URL tricks

Almost every lookalike domain falls into one of these six patterns. Once you can name them, you can spot them.

1. Letter swap. Replacing a character with a visually similar one — flipkart → fiipkart (lowercase L instead of i), paypal → paypa1 (digit one instead of L). Catches anyone reading at speed.
2. Letter omission. Dropping a single letter, betting on typos — amazn.com, gogle.com, microsft.com. These are the original typosquats, and they still work because they’re what users actually mistype.
3. Letter addition or doubling. googlle.com, youutube.com, netfllix.com. Same logic in reverse — fat-finger typos that scammers monetize.
4. Dash insertion. amazon-india.shop, flipkart-deals.store, icici-bank.online. These show up in paid ads constantly. Real brands almost never use a dash in their main domain.
5. TLD switch. Keep the brand name, change the extension. amazon.shop, nike.online, sbi.top. The cheaper, looser TLDs are scammer-favorite real estate.
6. Subdomain spoofing. The brand name appears as a subdomain of a scam domain — paypal.secure-login.com. People see “paypal” on the left and stop reading. The actual domain is secure-login.com.

Homograph & punycode attacks

This is the trick that fools even people who know about the other six. The internet now allows domain names with non-Latin characters (Cyrillic, Greek, Armenian) through a system called Internationalized Domain Names — IDNs. The catch: some non-Latin characters look identical to Latin ones.

Cyrillic “а” (U+0430) is visually indistinguishable from Latin “a” (U+0061). A scammer can register аpple.com — that’s a Cyrillic а — and your browser will render it identically to apple.com.

Browsers fight back by displaying the actual encoded form (called punycode) instead:

Visible to user:   аpple.com         (Cyrillic а)
Real domain:       xn--pple-43d.com   (punycode encoding)

Visible to user:   pаypal.com         (Cyrillic а)
Real domain:       xn--pypal-4ve.com  (punycode encoding)

Modern browsers handle this by switching to punycode display when the URL mixes scripts. But the defense is patchy across browsers and platforms, and a determined scammer can find character combinations that slip through. The only reliable defense is to look up the domain rather than trust the visual.

Real lookalikes in the wild

A few patterns we’ve seen on actual scam sites in the last twelve months (sanitized so they don’t serve as a hosts list):

• Banking impersonation: hdfc-netbanking.online, sbiyono.in, icicibank-secure.top — landing pages that match the real portal pixel-for-pixel.
• E-commerce clones: flipkart-bigsale.shop, amaz0n-deals.xyz, myntra-clearance.online — paid Instagram ads pushing branded products at 80% off.
• Logistics scams: indi4post.com, dhI-tracking.top (capital I instead of lowercase l), fedex-redelivery.shop — SMS-driven phishing for the ₹25 redelivery fee.
• Crypto exchanges: binаnce.com (Cyrillic а), wazirx-pro.online, coinswitch-india.shop — homograph attacks on global exchanges, lookalike subdomains on Indian ones.

How to detect one in 30 seconds

Two checks. Total time: under a minute.

1. Look up the WHOIS record. A real bank’s domain has been registered for 10+ years, via a corporate registrar (CSC, MarkMonitor, GoDaddy Corporate). A lookalike is days or weeks old, registered through a discount registrar, with redacted contact details.
2. Compare against the brand’s known domain. Open the brand’s verified social media or a search result you trust. The legitimate URL should match exactly — character for character, TLD included.

For brand owners: proactive defense

If you run a brand with any meaningful customer base, lookalike domains are coming for you. A three-step defensive posture:

1. Defensive registration. Buy the obvious variants of your domain — common typos, dashed versions, and the cheap TLDs (.xyz, .shop, .top). Total cost: ~$60/year. Worth it.
2. Monitoring. Subscribe to newly-registered-domain feeds filtered for your brand name and common typos. When a lookalike appears, you usually have a 24–72 hour window to act before it goes live.
3. Fast takedown. Have your legal and security teams pre-aligned on the takedown playbook — registrar abuse contact, Google Safe Browsing report, the major social platforms’ ad-policy teams. Speed kills these scams.

FAQ

What is typosquatting?

Registering domain names that are common misspellings of popular sites, in order to catch users who mistype the real URL. It’s been a tactic since the 1990s and is still one of the most reliable ways to acquire phishing traffic.

What is a homograph attack?

A phishing attack that uses non-Latin characters (Cyrillic, Greek, etc.) that look identical to English letters, creating a domain that visually matches a real one but is technically different. Modern browsers warn about these by displaying punycode, but the defense isn’t perfect.

Is buying typo domains of my brand worth it?

For any consumer-facing brand with payment flows, yes. The annual cost is trivial compared to the cost of a single successful phishing campaign against your customers — and the reputational damage of being the brand impersonated.

How do I tell if a URL has hidden Cyrillic characters?

Copy the URL, paste it into a plain text editor or a punycode converter. If the rendered form doesn’t match what you see in the address bar, you’ve found a homograph. Most browsers will also auto-display punycode (the xn-- form) when mixed scripts are detected.