How typosquatting works, and why QR codes make it worse
Typosquatting is impersonation by near-miss. An attacker registers a domain that differs from a real brand by one character — a missing letter, a swapped pair, a zero where an o should be, a different ending — and then uses it in places where the difference is hard to spot. In a browser address bar, a careful reader might catch it. In a QR code, there is no address bar to read: the code is opaque, the destination is hidden, and the scanner shows the URL only after the decision to scan has already been made. That is why lookalike domains are a QR problem first and a typing problem second.
The variant families each exploit a different human weakness. Omissions and duplications exploit fast typing and careless proofreading: a missing letter in a long domain is easy to miss in a hurry. Adjacent swaps exploit the way fingers stumble on a keyboard. Keyboard-neighbour substitutions exploit the same stumble one key over. Homoglyphs exploit vision itself — rn rendered as m, a dotless i, an accented letter that looks identical at small sizes — and they defeat even careful readers. TLD swaps exploit assumption: the reader sees the familiar name, stops reading, and never notices that the ending changed from .com to .co or .xyz.
Defence starts with seeing the neighbours. Generating the variant list for your own brand shows you which lookalikes are closest and therefore most dangerous. The TLD swaps and single-omission variants deserve defensive registration — buy them and point them at your real site, so an attacker cannot. You cannot register every variant, and trying is a losing game against an endless list, so pair registration with monitoring: watch for new registrations resembling your brand, and act fast on the ones that actually get used in codes, messages, or ads.
For the person scanning, the defence is reading the host from the right. The registrable domain is the rightmost part; everything left of it is a subdomain the owner controls. A host such as yourbank.com.attacker.com is attacker.com, no matter how reassuring the left-hand side looks. Check the scheme, look for punycode, and be suspicious of any link that arrives unexpectedly and demands credentials or payment. If a code promises your bank, your inbox, or your payment provider, type the address yourself or use a bookmark instead of trusting the code.
If you find a lookalike impersonating your brand, document it — dates, screenshots, where the code appeared — and report it to the registrar and the hosting provider. Warn your customers through channels they already trust, and report phishing pages to the major safe-browsing programmes. Speed matters: a lookalike domain is cheap, and every day it stays up is a day of scanners who trusted a pattern they could not read.