What is typosquatting and how to protect your brand's domain?

Typosquatting is the practice of registering domain names that are slight misspellings or lookalikes of a real brand's domain, such as exmaple.com or example-login.com, to catch people who mistype the address or don't look closely at a link. Squatters use these domains for phishing, malware, fake shops, ad revenue or intercepting misdirected email. You protect your brand by registering the most likely variants yourself, monitoring new registrations and certificates for lookalikes, locking down email authentication so lookalikes are easier to spot, and using dispute processes such as the UDRP to take over domains that infringe your trademark.

Typosquatting is cheap for attackers and surprisingly effective, because humans are bad at noticing a single swapped letter, especially on a phone. In this article you'll learn the main types of lookalike domain, what attackers do with them, how to find the ones already registered against your brand using DNS and certificate data, and the practical and legal steps to reduce the risk.

Why Typosquatting Works

People make predictable mistakes. They hit the key next to the one they meant, double a letter, swap two letters, or forget the dot after www. At the same time, they skim links in emails and messages rather than reading them character by character. A domain that looks right at a glance is often enough.

For the attacker, the economics are favourable:

• A domain costs a few pounds a year.
• Registration takes minutes and needs little verification.
• Free certificates mean the fake site shows a padlock just like the real one.
• One lookalike domain can be used for a website, email and links in text messages at the same time.

Common Types of Lookalike Domain

Using example.com as the brand, here are the patterns you'll see most often:

Technique	Example	How it catches people
Omission	exmple.com	A missed keystroke
Repetition	exampple.com	A doubled key
Transposition	exmaple.com	Two letters swapped
Adjacent key	exanple.com	n sits next to m on the keyboard
Homoglyph	examp1e.com, exarnple.com (rn for m)	Characters that look alike
IDN homograph	exаmple.com with a Cyrillic а	Unicode characters that look identical
TLD swap	example.co, example.net	Wrong or assumed top-level domain
Missing dot	wwwexample.com, mailexample.com	The dot is forgotten
Hyphenation	ex-ample.com	A plausible-looking variation
Combosquatting	example-support.com, example-billing.com	The real brand plus a convincing word
Subdomain trick	example.com.account-verify.example.net	The brand appears first in a long hostname

Combosquatting deserves special attention. It doesn't rely on typing mistakes at all, because the real brand name is spelled perfectly. Research has repeatedly found it to be more common in phishing than classic misspellings, because example-secure.com looks like something a company might really own.

Internationalised Domain Names

Internationalised domain names (IDNs) let domains use non-Latin scripts, which is essential for many languages. Under the hood, they're encoded in Punycode, an ASCII form that starts with xn--. A domain spelled with a Cyrillic а looks identical to the Latin version on screen, but its real form is different:

python3 -c 'print("exаmple.com".encode("idna"))'

b'xn--exmple-4nf.com'

Modern browsers defend against this by showing the xn-- form when a domain mixes scripts in suspicious ways, but email clients, messaging apps and documents don't always do the same. Many registries also restrict mixed-script registrations.

What Attackers Do With Typosquatted Domains

• Phishing: A cloned login page at examp1e.com collects passwords and one-time codes.
• Business email compromise: An email from accounts@exarnple.com asks your finance team, or your customers, to pay an invoice into a new bank account.
• Fake shops: A copy of your store takes payments and ships nothing.
• Malware delivery: Visitors who mistype a software download site get a trojanised installer.
• Email interception: A lookalike domain with an MX record quietly receives email that people send to the wrong address, which can include contracts, invoices and personal data.
• Ad parking and affiliate fraud: Low-effort squatters fill the page with ads or redirect to affiliate links, earning money from your traffic.
• Reselling: Squatters offer to sell the domain back to you at a high price.

How to Find Lookalike Domains of Your Brand

You can't protect against domains you don't know about. Start by building a picture of what's already registered.

Using dnstwist

dnstwist is a widely used open-source tool that generates permutations of a domain using the techniques above and checks which ones exist in DNS. Install it with pip:

pip install dnstwist

Then list only the variants that are registered:

dnstwist --registered example.com

The output lists each technique, the lookalike domain and the DNS records found, for example:

addition       examplee.com      198.51.100.24 NS:ns1.parking.example MX:mail.parking.example
homoglyph      examp1e.com       203.0.113.77 NS:ns1.hosting.example
transposition  exmaple.com       192.0.2.140 NS:ns1.registrar.example

Pay closest attention to domains that have MX records, since they can receive email, and domains whose A records point at web hosting rather than a registrar's parking page. For a spreadsheet you can sort and share, use CSV output:

dnstwist --registered --format csv example.com > lookalikes.csv

Checking Certificate Transparency Logs

Every publicly trusted TLS certificate is recorded in public Certificate Transparency (CT) logs. Because attackers want a padlock on their phishing sites, CT logs often reveal lookalike domains within minutes of the certificate being issued, sometimes before the site goes live.

The free crt.sh service lets you search them. This command finds certificates for any hostname containing your brand name:

curl -s 'https://crt.sh/?q=%25example%25&output=json' \
  | jq -r '.[].name_value' | sort -u | grep -v '\.example\.com$' | head -50

The %25 is a URL-encoded % wildcard. The grep -v removes your own legitimate subdomains so that only outsiders remain. For ongoing monitoring, commercial brand protection services and several free tools watch CT logs continuously and alert you when a matching certificate appears.

A Simple DNS Check Script

If you want to run your own regular check, this Python script generates common typo variants and reports which ones resolve and which accept email. It uses the dnspython library (pip install dnspython):

#!/usr/bin/env python3
"""Generate common typo variants of a domain and check which exist in DNS."""
import sys
import dns.exception
import dns.resolver

ADJACENT = {
    "a": "qwsz", "b": "vghn", "c": "xdfv", "d": "serfcx", "e": "wsdr",
    "f": "drtgvc", "g": "ftyhbv", "h": "gyujnb", "i": "ujko", "j": "huikmn",
    "k": "jiolm", "l": "kop", "m": "njk", "n": "bhjm", "o": "iklp",
    "p": "ol", "q": "wa", "r": "edft", "s": "awedxz", "t": "rfgy",
    "u": "yhji", "v": "cfgb", "w": "qase", "x": "zsdc", "y": "tghu",
    "z": "asx",
}
ALT_TLDS = ["com", "net", "org", "co", "co.uk", "io", "info"]

def variants(domain: str) -> set[str]:
    name, tld = domain.split(".", 1)
    out = set()
    for i in range(len(name)):
        out.add(name[:i] + name[i + 1:])                      # omission
        out.add(name[:i] + name[i] + name[i:])                # repetition
        if i < len(name) - 1:                                 # transposition
            out.add(name[:i] + name[i + 1] + name[i] + name[i + 2:])
        for key in ADJACENT.get(name[i], ""):                 # adjacent key
            out.add(name[:i] + key + name[i + 1:])
    results = {f"{v}.{tld}" for v in out if v}
    results |= {f"{name}.{t}" for t in ALT_TLDS if t != tld}  # TLD swap
    results |= {f"www{name}.{tld}", f"mail{name}.{tld}"}      # missing dot
    results.discard(domain)
    return results

def lookup(name: str, rtype: str) -> list[str]:
    try:
        answer = dns.resolver.resolve(name, rtype, lifetime=3)
        return [r.to_text() for r in answer]
    except (dns.resolver.NXDOMAIN, dns.resolver.NoAnswer,
            dns.resolver.NoNameservers, dns.exception.Timeout):
        return []

if __name__ == "__main__":
    target = sys.argv[1].lower()
    for candidate in sorted(variants(target)):
        a_records = lookup(candidate, "A")
        mx_records = lookup(candidate, "MX")
        if a_records or mx_records:
            flag = "MAIL" if mx_records else "WEB"
            print(f"{flag:5} {candidate:30} A={','.join(a_records) or '-'} "
                  f"MX={','.join(mx_records) or '-'}")

Run it with python3 typocheck.py example.com. It sends a few hundred DNS queries, so run it on a schedule, such as weekly, and compare results over time rather than hammering your resolver.

Investigating a Suspicious Domain

When you find a lookalike, gather the facts before acting:

dig exmaple.com A +short
dig exmaple.com MX +short
dig exmaple.com NS +short
whois exmaple.com | grep -iE 'registrar:|creation date|abuse'

The creation date tells you whether it's an old parked domain or something registered last week. The registrar's abuse contact is who you'll report it to. Take screenshots of any website and save copies of phishing emails, as evidence for a complaint.

How to Protect Your Brand's Domain

1. Register the Most Likely Variants

Defensive registration is the simplest protection. You can't register every possible typo, so prioritise:

• Your main domain in the most relevant TLDs, such as .com, .co.uk, .net and the country codes you trade in.
• The most common single-character typos of your main domain.
• Obvious combosquats, such as example-login.com or examplepay.com, if your brand is a frequent phishing target.

Point all of these at your main site with a redirect, so typing mistakes land in the right place. Keep them on the same registrar account, with auto-renew and registrar lock enabled, so they don't quietly expire into a squatter's hands.

2. Configure Parked Domains to Reject Email

A defensive domain that doesn't send email should say so, so that receiving mail servers reject anything spoofing it. Publish these records on every parked domain:

exmaple.com.            3600 IN TXT  "v=spf1 -all"
_dmarc.exmaple.com.     3600 IN TXT  "v=DMARC1; p=reject; rua=mailto:dmarc@example.com"
exmaple.com.            3600 IN MX   0 .

The v=spf1 -all record says no server may send for the domain, the DMARC record tells receivers to reject failures, and the null MX record (MX 0 .) states that the domain doesn't accept email, so senders get an immediate bounce instead of a long retry.

3. Strengthen Authentication on Your Real Domain

Typosquatters can't use your real domain if it's properly protected, which forces them onto lookalikes that are easier for filters and people to spot. Make sure SPF, DKIM and DMARC are set up on your main domain with DMARC at p=reject. Once you're at enforcement, BIMI lets supporting mail clients display your logo next to genuine messages, which a lookalike domain can't easily copy.

4. Monitor Continuously

New lookalikes appear all the time. Set up:

• CT log alerts for certificates containing your brand name.
• Scheduled permutation scans with dnstwist or a script like the one above.
• DMARC aggregate reports, which show who's sending email claiming to be your domain.
• A brand protection service if you're a frequent target, since these combine registration feeds, CT logs and takedown support.

5. Educate Staff and Customers

Train finance and support teams to check sender domains carefully on any request involving payments or account changes, and to confirm bank detail changes through a known phone number. Tell customers which domains you use, and that you'll never ask for passwords by email.

6. Block Lookalikes Internally

Add known lookalike domains to your DNS filtering or DNS firewall, and to your email gateway's block list. That stops a phishing email aimed at your staff from working even if someone clicks.

Taking Down Typosquatted Domains

If a lookalike is being actively used for abuse, you have several options, roughly from fastest to slowest:

1. Report to the registrar and host: Use the abuse contacts from WHOIS or RDAP. Phishing and malware reports with clear evidence are often acted on within hours or days.
2. Report to blocklists: Submit phishing URLs to services such as Google Safe Browsing and Microsoft's reporting tools, so browsers start warning visitors.
3. Uniform Rapid Suspension (URS): For clear-cut trademark abuse on many newer generic TLDs, the URS is a quicker, cheaper process that suspends the domain, though it doesn't transfer it to you.
4. UDRP complaint: The Uniform Domain-Name Dispute-Resolution Policy applies to all generic TLDs such as .com. You must show the domain is confusingly similar to your trademark, the registrant has no legitimate interest in it, and it was registered and used in bad faith. A successful complaint transfers the domain to you. Many country-code TLDs, including .uk, run their own dispute services.
5. Legal action: Court action is available in many countries, but it's slow and expensive and usually reserved for serious cases.

Registering your trademark makes every one of these routes easier, and the Trademark Clearinghouse lets trademark holders get early access and alerts when new generic TLDs launch.

---

FAQ: Typosquatting

---

Conclusion

Typosquatting exploits predictable typing mistakes and quick glances at links, using cheap lookalike domains for phishing, invoice fraud, fake shops and email interception. The patterns are well understood, from omitted and swapped letters to homoglyphs and combosquats, which means you can predict and look for most of them.

Register the variants that matter most and make them refuse email, protect your real domain with SPF, DKIM and DMARC at enforcement, and monitor DNS and Certificate Transparency logs for new lookalikes. When a malicious one appears, report it quickly, and keep your trademark registrations up to date so dispute processes such as the UDRP are on your side.