This article is general information for UK organisations. This is not legal advice. Speak to a solicitor who handles trade mark and domain disputes before you act on a specific case.
Is typosquatting illegal?
Registering a misspelling of someone else's domain name is not, by itself, a criminal offence in the UK. The law looks at what the domain is used for and who it harms. Three routes matter most to a brand owner.
Trade mark infringement. If you hold a registered trade mark, using a confusingly similar sign in the course of trade can infringe it under the Trade Marks Act 1994. A domain that copies your brand and sells competing goods, or advertises against you, is a candidate for this claim. The claim is stronger when the mark is registered for the goods or services the site offers.
Passing off. This is a common law claim. It needs goodwill in your name, a misrepresentation that leads customers to think the site is yours, and damage to you as a result. It suits businesses that trade under an unregistered name. A site that copies your login page and collects credentials from your customers is a clear example of misrepresentation.
Nominet DRS for .uk domains. Nominet runs a dispute resolution service for .uk names. The complainant must show that it has rights in a name or mark that is identical or similar to the domain, and that the domain is an abusive registration in the hands of the registrant. The service is cheaper and faster than court action, and the outcome is usually transfer or cancellation of the domain. It does not award damages.
Other laws can apply when the site is used for crime. Fraud by false representation under the Fraud Act 2006 covers phishing pages that collect payment details. Computer Misuse Act offences can apply to the malware that some of these sites deliver. These are matters for the police and Action Fraud, not for a brand owner's own claim.
Two limits are worth stating plainly. Domains outside .uk, such as .com or .shop, fall outside Nominet DRS. For those you would normally use the ICANN Uniform Domain-Name Dispute-Resolution Policy (UDRP), which has similar tests, or a court claim. And a registrant outside the UK may be hard to reach with a UK court order.
What is the difference between typosquatting and cybersquatting?
The two terms overlap, and people use them loosely. The difference is in the method and the motive.
Typosquatting is the registration of a deliberate misspelling or close variant of a real domain. Examples are a swapped pair of letters, a missing letter, a different top-level domain, or a hyphen. The attacker relies on users making a typing error or reading a link too fast.
Cybersquatting is the registration of a domain that matches or closely resembles a brand, a company name or a personal name, with the intention of selling it to the owner at a profit or of using the owner's reputation. The name can be exact. There is no need for a typing mistake.
A single domain can be both. A registrant who buys a misspelling of your brand and then offers to sell it to you is doing both things at once. In a Nominet DRS or UDRP case, the label matters less than the evidence: your rights, the similarity of the name, and the registrant's conduct.
Lookalike domains are the wider category. They include typosquats, homoglyph domains that use visually similar characters, and domains that add a trusted word such as support or login to a brand name. Attackers use all of them for phishing and for impersonating a company by email.
What to do when you find one
Follow the steps in this order. The order protects your evidence.
- Preserve evidence first. Take full-page screenshots with the date and time. Save the page source. Record the domain, the IP address, the registrar and the registration date from a WHOIS or RDAP lookup. Save any phishing email that links to the site, with its full headers. Do not visit the site more than needed, and do not enter any data into it.
- Check the scope. Look at whether the domain has live content, a mail (MX) record, or a valid certificate. A parked page with no content is a different problem from an active phishing site. Look for other domains from the same registrant or on the same server.
- Decide the route. For a live phishing or fraud site, report it first and take legal steps later. For a .uk domain that is parked or used to trade on your name, a Nominet DRS complaint is often the right fit. For other domains, consider a UDRP complaint. A solicitor can advise on a letter before action and on trade mark or passing off claims.
- Send abuse reports. Report the site to the registrar and to the hosting provider. Both usually have an abuse contact listed in the WHOIS or RDAP record. Include the evidence from step one and say why the domain is harmful. You can also report phishing to the National Cyber Security Centre by forwarding the email to report@phishing.gov.uk, and report fraud to Action Fraud.
- File the Nominet DRS complaint where it applies. Nominet's process starts with mediation. If that fails, an independent expert decides the case on the written submissions. Your complaint should set out your rights in the name, why the domain is similar to it, and why the registration is abusive.
- Reduce the risk while you wait. Warn staff and customers about the domain. Block it at your email and web gateways. Publish SPF, DKIM and a DMARC policy at enforcement on your own domain, so attackers cannot send mail that claims to come from your exact domain.
Any of these steps can fail to remove a domain. Registrars and hosts act at different speeds, and a legal outcome depends on the facts of each case.
Finding lookalike domains before they are used
You cannot report a domain you do not know about. Precursor Security's own platform, EdgeProtect brand protection, runs continuous lookalike-domain discovery for the domains you add and records whether each variant is registered and can receive email.