Typosquatting: lookalike domains and how to defend

One missing letter is enough. Someone typing exampelbank.com instead of examplebank.com lands on a site owned by somebody else. In the harmless case it’s an ad page. In the bad case it’s a login form that looks exactly like the real one. That is typosquatting, one of the oldest tricks in domain abuse.

What is typosquatting?

Typosquatting means registering domains that are easy to confuse with a well-known address. The logic is simple: across millions of visits a day, enough people make typos to turn a lookalike domain into a business.

These domains are used for four main things:

• Phishing. The typo domain shows a copy of the real login page.
• Intercepting email. Whoever owns examplbank.com and sets an MX record receives every email where the sender mistyped the address.
• Ads and affiliate links. Visitors are pushed to competitors or ad pages.
• Malware. Developers get caught too, when package names on npm or PyPI are faked the same way.

Common typo patterns

For a made-up brand examplebank.com, the usual patterns look like this:

Then there is combosquatting: the correctly spelled brand plus a word, as in examplebank-login.com or examplebank-support.net. It is popular for phishing because the brand name is spelled right. Telling such addresses apart as a user is covered in spot a phishing domain. One step further are characters from other scripts, used in a homograph attack.

The wrong-extension row deserves attention. .co sits one keystroke away from .com, and plenty of people have typed one for the other. If your brand runs on .com, a defensive .co registration is one of the cheaper insurance policies you can buy.

Finding variants of your own domain

By hand you’ll come up with ten or twenty variants. The open-source tool dnstwist generates hundreds systematically and checks which are registered and have DNS records. It was built for exactly this: letting brand owners and security teams see what exists.

pip install dnstwist
dnstwist --registered examplebank.com

With --registered, only variants that actually exist are shown, with IP addresses and mail servers. Pay most attention to hits with an MX record: they can receive mail meant for you.

When reading results, keep in mind that not every registered variant is malicious. example-bank.com might be a genuine, unrelated company. It gets suspicious when the domain is new, shows a copy of your site or redirects somewhere unrelated.

Typosquatting protection: what to register

Nobody can register every variant. For an eleven-letter name, neighbouring keys, omissions and doubled letters alone produce well over a hundred options, multiplied by every extension. A sensible set for a small or mid-sized business:

1. Your brand under .com plus your home country extension.
2. With and without a hyphen.
3. Two or three typos that are especially likely for your name. Check your server logs or ask support which mistakes customers really make.
4. Variants that have already been used for phishing, as soon as they become available.

The cost is manageable. A .com at betadomain costs €14.99 a year, a .net €16.99, and because the renewal price stays the same there are no surprises in year two. Point defensive domains at your main site with a redirect, and for email publish a null MX record or none at all so nothing gets accepted there.

A search for spelling variants of your brand shows what is still available.

When someone already owns your variant

If you find a typo domain being used for phishing, the fastest route is an abuse report to the registrar and the host. Since April 2024, ICANN-accredited registrars must take prompt action when presented with actionable evidence of DNS abuse, and phishing is explicitly included. How to write the report is covered in report a phishing site.

If it’s about trademark exploitation rather than phishing, the route is longer. For gTLDs like .com there is the UDRP, administered by providers such as the WIPO Arbitration and Mediation Center. The bar is specific: the domain must be confusingly similar to your mark, the registrant must have no legitimate interest, and it must have been registered and used in bad faith. Country-code domains follow their own registry’s policies. This is a job for a lawyer who handles domain disputes.

Monitor what you don’t buy

For everything you don’t register, monitoring helps. Run dnstwist on a schedule and have new hits emailed to you. Watching Certificate Transparency logs for names containing your brand adds an early warning: a new certificate for examplebank-login.com shows up before the first phishing email goes out.

As a next step, spend ten minutes running dnstwist against your main domain and compare the hits with the list of extensions and yearly prices. You’ll know which gaps are worth closing.