Built for Chrome. Your browser may show xn--80a6aa68c8d.com instead of аррӏө.com.
This is not apple.com
The first five characters of this address are Cyrillic. They look like Latin characters, but they spell a different domain.
A research demo by Have I Been SquattedRead more
You read the characters. Your computer looks the name up in its xn-- form, called Punycode, because domain names can only use basic Latin characters, digits, and hyphens. Both are the same registered domain.
apple.comаррӏө.comYour device's interface font, the same one as the address bar
Large size
To a computer, Cyrillic ө and Latin e are as different as a and b. Swap all five characters and you get a separate domain that anyone can register. We registered this one for the research.
Domain names can only contain basic Latin characters, digits, and hyphens, so your computer looks this one up as xn--80a6aa68c8d.com. Chrome shows that form instead when it decides a name is imitating another. This one passes the check, and the research explains why.
What is typosquatting?
Typosquatting is registering a domain that looks like a real one, so people visit it by mistake or trust it at a glance. There are several ways to build one, from a simple misspelling to letters from another alphabet. The cases below are real, public incidents, in date order.
2006
A domain one typing mistake away from the real one.
google.comgoggle.comOne letter off: the second o is a g
People who mistyped Google's address landed on a site that used a Windows image-file exploit to install SpySheriff, a fake anti-spyware program that demands payment to remove threats it invents.
2013–2016
The brand name appears in the address, but someone else owns the domain.
A Lithuanian man and accomplices posed as Quanta Computer, a hardware supplier both companies used. Fake email addresses, invoices, and corporate stamps were enough to get the payments approved. The court record does not name the email domains.
myaccount.google.commyaccount.google.com-securitysettingpage.tkThe highlighted part is the domain the attacker registered. Everything before it is a subdomain they chose
A fake Google alert said someone in Ukraine had used the password of Hillary Clinton's campaign chairman. Its shortened link opened a password page on this address. His Gmail account was taken, and its emails were later published.
2017–2019
A letter from another alphabet, or with a small mark, replaces a Latin letter.
adobe.comadoḅe.comxn--adoe-x34a.comḅ is Latin small letter b with dot below, U+1E05
A fake Flash Player update on this domain installed Betabot, a backdoor that turns off security software and steals what people type into web forms.
eos.comẹos.comxn--os-g7s.comẹ is Latin small letter e with dot below, U+1EB9
myetherwallet.commyethẹrẇallet.comxn--myethrallet-zk9e6w.comFake EOS token airdrops sent people to a copy of the MyEtherWallet page, which asked for their private key. Whoever holds a private key controls the wallet and everything in it.
binance.combịnạnce.comxn--bnnce-k11b2l.comBinance's own description: “2 dots at the bottom of 2 characters”
Phishing pages collected logins from early January and peaked around 22 February. The attackers made API keys for each stolen account and waited. On 7 March they used them to buy Viacoin from accounts they controlled at a pumped price. Binance's risk system halted withdrawals.
jetairways.comjetaırways.comxn--jetarways-ypb.comı is Latin small letter dotless i, U+0131
A WhatsApp message offered two free tickets for the airline's 25th anniversary. The page behind the link asked for personal details. Jet Airways warned customers that it ran no such offer.
delta.comdeǀta.comxn--deta-1kb.comǀ is Latin letter dental click, U+01C0, standing in for l
easyjet.comeasyjeṭ.comxn--easyje-n17b.comryanair.comryanaiṛ.comxn--ryanai-1x7b.comThe same free-ticket script moved from brand to brand. Visitors answered four questions and forwarded the link, then landed on another site that likely asked for card details.
britishairways.combaways.comNo swapped letters. The name reads as BA plus airways
Attackers got in with a supplier's stolen remote-access login, not through this domain. They changed a script on BA's website and app, and from 21 August to 5 September 2018 it copied card details from the payment form to baways.com.
amf-france.orgamf-fr.orgamf-france.org belongs to France's financial markets regulator, the AMF
Emails posing as the AMF sent bank staff in France and Malta to Word documents on this domain. On 13 February 2019, attackers inside Bank of Valletta's network sent about €13 million in fraudulent international transfers. The bank took its branches, ATMs, and website offline to stop them. Public reports do not say which email gave the attackers access. In 2021, the US Justice Department tied the heist to North Korean military hackers.
2022–2026
Lookalike domains registered quickly and aimed at employees, developers, and the software they ship.
twilio.comtwilio-sso.comcloudflare.comcloudflare-okta.comRegistered less than 40 minutes before the texts went out
Text messages told employees their password had expired and linked to a copy of their company's Okta sign-in page. The page passed one-time codes to the attackers as people typed them. At Twilio they reached data of 125 customers, which exposed about 1,900 Signal users' phone numbers. At Cloudflare, three employees entered their passwords, but hardware security keys blocked the sign-in.
circleci.comcircle-ci.comA hyphen added
circle-cl.comA hyphen added, and l for i
emails-circleci.comA word added in front
Emails posing as CircleCI asked developers to sign in with GitHub to accept new terms. A proxy passed their password and one-time code to the attackers. A Dropbox employee typed in a code from a hardware key. The copied code held some API keys and a few thousand names and email addresses.
microsoft.comrnicrosoft.comNo Unicode: r and n set close together read as m
A phishing kit rented by subscription cloned Microsoft 365 sign-in pages. Anyone could pay to run a campaign. Microsoft obtained a court order and seized the domains in September 2025.
npmjs.comnpnjs.comn for m. The email's support links went to the real npmjs.com
An email that looked like it came from npm support asked package maintainers to log in at a copy of the npm website. The maintainer of eslint-config-prettier did. With the stolen npm token, the attackers published new versions of that package and others by the same maintainer. Installing them on Windows ran a script that loaded malware.
aquasecurityscan.aquasecurtiy.orgTwo letters swapped. aquasecurity is the GitHub organization that publishes Trivy
checkmarx.comcheckmarx.zoneSame name, different ending
litellm.aimodels.litellm.cloudSame name, different ending, with a plausible subdomain
Attackers used stolen credentials to push malicious code into Trivy, a popular security scanner, and its GitHub Actions, and published a malicious Trivy release. Pipelines that ran it sent their secrets to the lookalike domain. Credentials taken that way opened Checkmarx's KICS and LiteLLM's release pipeline, where a malicious PyPI release, litellm 1.82.8, sent credentials to models.litellm.cloud. The lookalike domains were not the way in; they served the malicious code and received the stolen data.
In each case above, someone trusted how an address looked. These habits do not depend on reading the address.