I should also consider that the misspellings might be intentional to circumvent search engine blocks or to avoid domain takedowns. The "www1" part is a common tactic used in cloned or phishing sites to mimic legitimate domains.