Common typosquatting techniques

  • Omission: exampe.com (a letter left out).
  • Transposition: exmaple.com (two letters swapped).
  • Substitution: examp1e.com (a digit replacing a letter).
  • Repetition: exampple.com.
  • Different top-level domain: example.co instead of example.co.uk.
  • Added words: example-login.com or example-support.com, closely related to lookalike domains.

What attackers use typosquatted domains for

  • Phishing pages that copy your login or payment portal.
  • Business email compromise, sending invoices from a near-identical email domain.
  • Malware distribution and fake software downloads.
  • Ad fraud and traffic resale.

A domain with mail (MX) records configured is a strong warning sign, because it suggests the registrant intends to send or receive email.

How to defend against typosquatting

  1. Monitor newly registered domains for variations of your brand.
  2. Register the most likely variations of your key domains defensively.
  3. Use DMARC, SPF and DKIM so your real domain cannot be spoofed easily.
  4. Request takedowns quickly when a typosquat is used for phishing or fraud.

How DarkInvader helps

DarkInvader's DNS Monitoring detects newly registered typosquats and lookalikes of your domains, shows whether they have web or mail servers configured, and Website Takedowns can handle removal when they are used maliciously.

Explore DNS Monitoring

Frequently asked questions

Is typosquatting illegal?

Registering a misspelled domain is not automatically illegal, but using it to impersonate a brand, phish or defraud people is. In the UK, trade mark owners can also use dispute processes such as Nominet's DRS for .uk domains and UDRP for many others.

What is the difference between typosquatting and cybersquatting?

Cybersquatting is the broader practice of registering domains linked to someone else's brand in bad faith. Typosquatting is a type of cybersquatting that relies specifically on spelling mistakes and visual similarity.

How do I find typosquats of my domain?

Generate likely variations of your domain and check which are registered, then keep watching new registrations. Continuous monitoring matters because attackers often register domains only days before a campaign.

Related terms and reading

Sources