diff --git a/src/impression.js b/src/impression.js
index ee82f1c6d3c1..9e71a06dd60e 100644
--- a/src/impression.js
+++ b/src/impression.js
@@ -31,7 +31,7 @@ const TRUSTED_REFERRER_HOSTS = [
    * Twitter's link wrapper domains:
    * - t.co
    */
-  /^t.co$/,
+  /^t\.co$/,
 ];
 
 /**
diff --git a/test/unit/test-impression.js b/test/unit/test-impression.js
index 3fc85676d859..16e1bd24502f 100644
--- a/test/unit/test-impression.js
+++ b/test/unit/test-impression.js
@@ -481,5 +481,11 @@ describes.realWin('impression', {amp: true}, (env) => {
       test('https://t.com/asdf', false);
       test('https://t.cn/asdf', false);
     });
+
+    it('should not trust lookalike hosts that match an unescaped dot', () => {
+      test('https://taco/asdf', false);
+      test('https://txco/asdf', false);
+      test('https://t-co/asdf', false);
+    });
   });
 });