THE FRAUD CODEXSCAM DETECTION
MEDIUM RISK

Typosquatting Scam

Fake websites with URLs similar to legitimate sites (like "arnaz0n.com" or "paypa1.com") designed to steal credentials, distribute malware, or harvest payment info.

Losses: Part of data theft, credential harvesting, and phishing losses
Targets: Anyone who types URLs manually or clicks links quickly
Updated: 2026-01-07
Also known as: Lookalike Domain • URL Hijacking • Domain Spoofing • Combosquatting

1How It Works

Scammers register domains that look almost identical to legitimate websites. **Common techniques:** 1. **Typos**: gooogle.com, amazn.com, walmrat.com 2. **Letter substitution**: paypa1.com (number 1 for letter l), arnazon.com (rn looks like m) 3. **Added words**: amazon-deals.com, paypal-login.com 4. **Different TLD**: amazon.co (instead of .com), google.net 5. **Homoglyphs**: Using Cyrillic or other characters that look like English (аmazon.com) **What these sites do:** - Display login pages identical to real sites → steal credentials - Prompt downloads → install malware - Show fake order pages → steal payment info - Redirect to scam sites - Display ads for revenue (less malicious but still deceptive)

How Scammers Make Contact

Mistyped URLsPhishing emailsSearch adsSocial media links

2Warning Signs & Red Flags

  • URL has a typo or looks slightly off
  • Login page asks for more info than usual
  • Site certificate warning in browser
  • Site design is slightly outdated compared to real site
  • Prompted to download something unexpected
  • URL uses unusual domain extension
  • Site found through search ad rather than organic result
  • Clicking a link from email lands on unfamiliar domain

3Real-World Example

"I typed 'wellsfagro.com' instead of 'wellsfargo.com' by accident. The site looked identical to Wells Fargo's real site. I logged in before noticing the URL was wrong. The scammers tried to transfer $8,000 out of my account that night. Luckily, Wells Fargo's fraud detection caught it."

— Better Business Bureau Scam Alert

4How to Protect Yourself

  • Bookmark important sites rather than typing URLs
  • Always check the URL in the address bar before entering credentials
  • Look for HTTPS and valid certificates (lock icon)
  • Be careful when typing — slow down for important sites
  • Use a password manager — it won't autofill on fake sites
  • Don't click login links in emails — navigate directly to sites
  • Use browser security features that warn about suspicious sites
  • Be extra careful with shortened URLs (bit.ly, etc.)

5What To Do If You're a Victim

  1. 1If you entered credentials, change that password immediately
  2. 2Change password on any site where you used the same one
  3. 3Enable 2FA on affected accounts
  4. 4Run antivirus if you downloaded anything
  5. 5Monitor accounts for unauthorized access
  6. 6Report the fake domain to Google Safe Browsing
  7. 7Report to the legitimate company being impersonated
  8. 8Report to FTC at ReportFraud.ftc.gov

Report This Scam

FTC Report Fraud FBI IC3 Identity Theft

?Frequently Asked Questions

What is Typosquatting Scam?

Fake websites with URLs similar to legitimate sites (like "arnaz0n.com" or "paypa1.com") designed to steal credentials, distribute malware, or harvest payment info. Scammers register domains that look almost identical to legitimate websites. **Common techniques:** 1. **Typos**: gooogle.com, amazn.com, walmrat.com 2. **Letter substitution**: paypa1.com (number 1 for letter l), arnazon.com (rn looks like m) 3. **Added words**: amazon-deals.com, paypal-login.com ...

How common is this type of scam?

Typosquatting Scam is classified as a medium risk threat. Reported losses: Part of data theft, credential harvesting, and phishing losses. This primarily targets Anyone who types URLs manually or clicks links quickly.

Can I get my money back?

Recovery depends on how you paid. Credit card payments may be reversed through chargebacks. Wire transfers and cryptocurrency are rarely recoverable. Report immediately to your bank and file complaints with the FTC at reportfraud.ftc.gov and FBI IC3 at ic3.gov.

How do I report this?

Report to the FTC at reportfraud.ftc.gov. For internet crimes, file with FBI IC3 at ic3.gov. For identity theft, visit identitytheft.gov. Also contact your local police and your bank.

Sources & References

CISA: Typosquatting ThreatsICANN: Domain Name Abuse

Related Scams

AI-Enhanced Phishing

Highly personalized phishing emails written by AI that are more convincing and harder to detect than traditional phishing attempts.

Fake Online Store

Fraudulent e-commerce websites that take your payment but never deliver products, or send counterfeit/inferior goods.

Fake Data Breach Notification

Phishing emails disguised as legitimate data breach notifications that trick you into entering credentials on fake "identity protection" or "password reset" sites.

Think You've Encountered This Scam?

Use our free AI scanner to analyze suspicious messages, websites, or phone numbers.

Scan Now — It's Free