WHERE IT STARTED
FIRST SEEN: Late 1990s (first mass typosquatter, Zuccarini) · GOING FOR: About 27 years
Typosquatting began in the United States in the late 1990s; John Zuccarini's mass registrations from 1999 led to the first FTC action in 2001 and the first criminal conviction in 2004.
Typosquatting - registering misspellings of popular domains to catch mistyped traffic - appeared in the late 1990s; John Zuccarini registered thousands of variants of names such as Britney Spears and Disney and became the first person convicted under the 2003 US Truth in Domain Names Act. The technique moved from ad revenue and porn redirects to fraud: lookalike domains now anchor phishing kits, fake crypto exchanges (a 2019 Europol case took $27 million from 4,000 wallets), business email compromise, and supply-chain attacks via typosquatted software packages. Brand-protection firms found more than 30,000 lookalike domains impersonating major brands in 2024.
HOW IT WORKS
The attacker registers a domain that looks like the target's - a missing letter, a swapped character, a homoglyph, a different top-level domain such as .co or .xyz - and either waits for mistyped visits or actively sends phishing links from it. Lookalike domains host cloned login pages that harvest credentials and one-time codes (Tycoon 2FA-style kits imitate Binance, Coinbase and Kraken), or serve as the sending domain in invoice and payroll fraud emails. Some register typos of package names on npm or PyPI to plant malware. The domains are cheap, registered in bulk, and rotated faster than takedowns.
Domain in an email or link differs from the real one by one character or TLDLogin page reached from a link rather than by typing the addressInvoice or bank-detail change sent from a lookalike company domainCertificate or WHOIS showing a domain registered days agoSearch ads for an exchange or bank pointing to an unfamiliar domain
HOW USEFUL IT IS TO CRIMINALS
Domains cost a few dollars and can be registered in bulk with no identity check, so a phishing crew can run hundreds of lookalikes and replace them faster than registrars act. Combined with a cloned login page, one domain can capture thousands of accounts. Criminal cases are rare and usually charged as fraud or phishing rather than typosquatting; civil UDRP or ACPA actions recover the domain but not the money.
THE DAMAGE IT HAS CAUSED
191,561
Phishing/spoofing complaints to the FBI in 2025 (no loss total isolated for typosquatting) — FBI IC3 Internet Crime Report 2025
No body publishes a typosquatting total; the FBI's phishing/spoofing line is the most-reported crime (191,561 complaints in 2025) and a single cloned exchange took $27 million from 4,000 victims (Europol, 2019). Non-money harm: credential theft feeds account takeover, brand trust is damaged, and typosquatted software packages have introduced malware into corporate systems.
191,561 Phishing/spoofing complaints to the FBI in 2025, the most-reported crime type (FBI IC3 Internet Crime Report 2025)
30,000+ Lookalike domains impersonating major global brands identified in 2024 (Brand-protection industry data via BrandShield, 2025)
4,000 Victims whose crypto wallets were emptied via one cloned exchange site (about $27M) (Europol, June 2019)
WHO USES IT MOST
MOST OF ALL: 🇺🇸 United States ▸
The first typosquatting laws, convictions (Zuccarini) and most brand-protection monitoring are American, and the FBI's phishing/spoofing category is the most-reported crime type with 191,561 complaints in 2025 (IC3, 2026).
United States (Truth in Domain Names Act; most targeted brands)United Kingdom (2019 crypto typosquat arrests)Netherlands (2019 arrests)Spain (2025 crypto-fraud network arrests)
GOVERNMENTS LINKED TO IT
No government is documented as using this method.
NOTABLE PEOPLE WHO USED IT — RANKED BY PROFILE ORDER (NOT BY AMOUNT)
#1 John Zuccarini CONVICTED; FTC JUDGMENTREPORT PENDING
$164,000 in typosquatting revenue surrendered; $1.9 million FTC judgment (2002) · 1999-2007
Serial typosquatter who owned about 5,500 misspelled domains and redirected users, including children, to adult sites; first person convicted under the US Truth in Domain Names Act, sentenced to 30 months in 2004 after earlier FTC judgments.
SOURCE: Pinsent Masons Out-Law, 2004; The Register, Oct 2007; Computerworld
#2 UK-Netherlands crypto typosquatting gang (six arrested) ARRESTEDREPORT PENDING
About $27 million (GBP 21-22 million) · 2017-2019
Six people arrested by UK and Dutch police with Europol in 2019 for a cloned cryptocurrency-exchange site at a lookalike URL that captured the wallet logins of at least 4,000 victims.
SOURCE: Europol via Avast blog and Tech Monitor, June 2019; Decrypt
#3 Spanish crypto-fraud network (five arrested) ARRESTEDREPORT PENDING
About $540 million (EUR 460 million) laundered · 2021-2025
Five suspects arrested in the Canary Islands and Madrid in June 2025 in a Europol-supported operation against a $540 million crypto investment fraud that used fake platforms and lookalike sites.
SOURCE: The Hacker News, June 2025; Europol
SOURCES
Pinsent Masons Out-Law, 'Cybersquatter gets 30 months in prison', 2004
The Register, 'Serial typosquatter settles FTC charges', 17 Oct 2007
Avast blog, 'Europol coordinates arrests of six in $28 million crypto scam', 2019
Tech Monitor, 'Cryptocurrency arrests sees UK and Europol haul in six for the theft of GBP 21 million', 2019
The Hacker News, 'Europol dismantles $540 million cryptocurrency fraud network, arrests five suspects', June 2025
FBI IC3 Internet Crime Report 2025
UpGuard, 'Typosquatting explained with real-world examples'
Wikipedia, 'John Zuccarini' (pointer)