What Is Typosquatting? How Lookalike Domains and Packages Scam You

Typosquatting is the practice of registering a domain name or publishing a software package with a name deliberately close to a popular one — often just one swapped, dropped, or doubled character — so that people who mistype or misremember the real name land on the fake instead. It shows up in two main forms: lookalike websites that catch mistyped web addresses, and lookalike packages on registries like npm and PyPI that catch a misspelled npm install or pip install command. Both exploit the same gap: people and automated build scripts trust a name more than they check it.

How typosquatting actually works

The mechanics are simple on purpose. An attacker identifies a widely used domain or package name, then registers a variant designed to survive a quick glance. According to Wikipedia's entry on typosquatting, common techniques for domains include misspellings, pluralizations, adding or dropping hyphens, and swapping top-level domains (registering the .cm or .co version of a .com site, for example). A related tactic called combosquatting adds a plausible extra word — think login-yourbank.com — while "doppelganger domains" simply add or remove a single period from a legitimate address.

Package registries work the same way at the level of a name string instead of a URL. A 2020 academic analysis of PyPI, cited on Wikipedia and in package-security research, found that attackers also split names on hyphens and rearrange the pieces — turning a package like python-nmap into nmap-python — betting that a developer typing from memory won't notice the swap. Because anyone can publish to npm or PyPI with minimal vetting, a convincing typosquat can sit on the registry for weeks before anyone reports it.

Domain typosquatting: the fake-website version

On the web, a typosquatted domain is usually built to look believable for just long enough to do damage. Per Wikipedia's summary of the practice, the fake site often copies the real one's branding and layout, and traffic frequently arrives through spam email links rather than an actual typo. The motives documented there include credential phishing, pushing malware, selling the domain back to the trademark owner, collecting ad or affiliate revenue, redirecting shoppers to a competitor, and harvesting email sent to a misspelled address.

CISA's guidance on social engineering and phishing describes the same mechanism from the defender's side without using the word "typosquatting": it warns that a "spoofed hyperlink or website" may "use a variation in spelling or a different domain" than the real one, and that a sender's address can be made to "closely resemble one from a reputable company by altering or omitting a few characters." That's typosquatting and lookalike-address phishing described as two sides of the same trick.

Some of the better-documented examples are almost comic in hindsight. Wikipedia notes that goggle.com — a one-letter typo of Google — was used in a 2006 security-vendor demo of drive-by malware, later redirected to adware, was flagged as malicious in 2020, and had become a political blog by mid-2022. Yuube.com targeted YouTube visitors with a fake "security check extension." In 2016, comedian John Oliver registered typo domains of credit bureaus — including a misspelling of Equifax — to make a point about the companies' own security failures. More recently, researchers reported in February 2026 that a phishing operation nicknamed "Diesel Vortex" used lookalike domains against freight and logistics firms and reportedly stole more than 1,600 unique credentials. Brand owners take the threat seriously, too: Wikipedia cites a report that Lego alone had filed roughly 309 domain-dispute cases by 2011, at an estimated cost of about $500,000.

Package typosquatting: the supply-chain version

The more consequential version of typosquatting today runs through open-source package registries, not browsers. When a developer or a build pipeline runs npm install or pip install with a misspelled package name, a typosquatted package can execute arbitrary code the moment it's installed — no phishing click required. That makes package typosquatting a specific, narrow technique inside the broader category of supply-chain attacks: it poisons the chain at the dependency-naming step rather than by compromising a maintainer's account or a build server.

Both major registries treat this as a named, reportable problem. PyPI's own security page lists "typo-squatting" and "dependency confusion" explicitly as examples of malware it wants reported through a project's Security tab, alongside instructions not to disclose suspected malicious packages in public forums like GitHub issues or chat channels while a report is pending. On the npm side, npm's Dispute Policy defines "package squatting" as a package that "serves no genuine function," and the policy npm uses to decide whether to hand over a disputed name includes a notable carve-out: npm says it may decline to transfer a name — even to a party with a legitimate claim to it — if doing so "would create supply-chain risk," because yanking a name already in wide use out from under existing installs can be as disruptive as the squat itself.

Security researchers have repeatedly found real campaigns built around exactly this pattern: packages with names a single character or word-order swap away from heavily downloaded libraries, sometimes configured to run quietly in the background — for example, writing a script into a Windows Startup folder so malicious code persists across reboots. Because package managers resolve dependencies automatically and often transitively, a single typosquatted package pulled in by one misspelled line in a manifest file can propagate into every build that depends on it.

Why the trick keeps working

Typosquatting survives because it targets a moment of low attention rather than a technical flaw. On the web, people type fast, autofill fills in the wrong thing, and a page that loads instantly with familiar colors and logos doesn't trigger suspicion the way a phishing email's urgent tone might. In code, the trust is even more automatic: a developer who has typed requests or lodash hundreds of times is pattern-matching on muscle memory, and a continuous-integration pipeline installing dependencies has no judgment to apply at all — it just runs what the manifest tells it to. In that sense typosquatting is really a quiet, low-effort cousin of social engineering: instead of persuading someone to hand over information, it just waits for a small, predictable mistake. CISA's phishing guidance makes a related point about lookalike sender addresses: the alteration is often small enough that "altering or omitting a few characters" is all it takes to get past a quick visual check.

How the law and the registries respond

Domain-level typosquatting has had a specific U.S. legal answer for more than two decades. The Anticybersquatting Consumer Protection Act of 1999 added 15 U.S.C. § 1125(d), letting a trademark owner sue someone who registers, traffics in, or uses a domain that's confusingly similar to the mark "with bad-faith intent to profit," per Wikipedia's summary of the statute and case law. Outside court, trademark holders more often use the Uniform Domain-Name Dispute-Resolution Policy (UDRP), which ICANN describes as the mechanism domain registrars are contractually required to follow for "abusive registration" disputes: a complainant files with an ICANN-approved provider and must show the domain is identical or confusingly similar to their mark, that the registrant has no legitimate interest in it, and that it was registered and is being used in bad faith. ICANN's current version of the UDRP Policy and Rules took effect in August 2024, with contracted parties required to adopt them by August 2025.

Package registries handle disputes administratively rather than through courts in most cases. npm's Dispute Policy routes name conflicts — including squatting claims — through a GitHub support ticket, separately from trademark complaints, and explicitly notes that filing a report doesn't guarantee a name will be transferred. PyPI, run under the Python Software Foundation, instead frames the problem primarily as a malware-reporting issue: its security page asks anyone who finds a typosquatted or otherwise malicious package to report it privately rather than naming it publicly while under review, precisely so the report itself doesn't advertise the malicious package to more potential victims.

How to protect yourself

• Don't trust a link; type or bookmark instead. For sites that touch money or credentials — banking, email, cloud storage — type the address yourself or use a saved bookmark rather than clicking through from an email or ad.
• Read the whole domain, not just the brand name. Check what comes immediately before the first single slash, and watch for swapped top-level domains (.cm, .co, .net instead of .com) and extra words tacked onto a real brand name.
• Look for the government-site cue when it applies. The FTC's phishing guidance reminds visitors that genuine U.S. federal government sites "often end in .gov or .mil" — useful when a message claims to be from an agency like the IRS or the FTC itself.
• Treat urgency as a signal, not a reason to rush. Both phishing emails and typosquatted sites lean on time pressure; slowing down to check the address is the single highest-value habit here. A closer look at how phishing emails are built to create that pressure covers the broader pattern.
• Report what you find. ICANN-accredited registrars have abuse contacts for individual domains, and consumers can report suspicious sites to the FTC at ReportFraud.ftc.gov.

How developers and organizations can protect their supply chain

• Pin exact dependency versions and use lockfiles. A locked package-lock.json or requirements.txt with hashes means a one-character typo can't silently swap in a different package on a later install.
• Use scoped packages where the registry supports them. npm's scope syntax (@yourorg/package-name) narrows the namespace an attacker would need to squat, and npm has said publicly that detecting name similarity to prevent typosquatting is an ongoing area of registry work.
• Review new or unfamiliar dependencies before adding them, including who maintains them, how long the name has existed, and whether the download count matches a package's apparent popularity.
• Report suspected malicious packages through the registry's own channel — PyPI's Security tab "Report project as malware" flow or npm's security reporting process — rather than discussing specifics in public issue trackers while the report is pending.
• Register your own organization's name defensively where it matters, the same way brand owners register common domain misspellings; it's cheaper than cleaning up after a squat is already in use.

What's next: this isn't going away

Typosquatting persists because it's cheap to attempt and only has to work occasionally to pay off — registering a domain or publishing a package costs little, and even a small fraction of mistyped visits or installs can be profitable. As open-source dependency trees get deeper and CI/CD pipelines install packages with zero human review at install time, the package-registry version of the trick is likely to keep drawing more attention from both attackers and registry operators than the older domain-squatting version. The practical defense hasn't changed much in twenty years, though: verify the exact name — character by character — before you click, install, or build on it.

Written bySana Qureshi

Sana Qureshi runs the security and privacy desk. She reports on actively exploited vulnerabilities, vendor patches and data breaches, and covers the password managers, VPNs and authentication tools readers use to protect themselves. Her alerts cite vendor advisories, CISA and the CVE record directly.

More from Sana QureshiAll Security & Privacy coverage