Typosquatting and Lookalike Domains: Detect, Monitor, Take Down

One invented brand, many variants

The quickest way to understand the problem is to generate variants for a made-up brand. Take a payments company called AcmePay that owns acmepay.com. Each row below is a registrable name an attacker could buy for a few currency units and point at a fake login page.

Class	What changes	Example
Omission	One character dropped	acmepy.com, amepay.com
Repetition	A character doubled	acmepayy.com, accmepay.com
Transposition	Adjacent characters swapped	camepay.com, acmepya.com
Keyboard neighbour	A key next to the intended one	acmepat.com, scmepay.com
Vowel swap	One vowel replaced	acmepey.com, ocmepay.com
Visual substitution	Letters that look alike	acrnepay.com (r+n reads as m)
Hyphenation	Separator inserted	acme-pay.com
Bit-flip	One bit changed in a character code	ecmepay.com (a to e differ by one bit)
TLD swap	Same label, other extension	acmepay.co, acmepay.net, acmepay.shop
Combosquatting	Brand plus a plausible word	acmepay-login.com, secure-acmepay.com, acmepaysupport.com
Homograph (IDN)	Non-Latin look-alike letters	Cyrillic "а" in place of Latin "a" (see IDN, punycode and homographs)

Strictly, "typosquatting" means the classes that rely on a user's typing mistake (the first five). The rest rely on visual deception, on search or email context, or on a victim who clicks a link and never types anything. In practice security teams use "lookalike domain" for the whole family.

Which classes actually matter

Raw variant counts are huge. A single mid-length label produces thousands of permutations across the classes above, and multiplied by the available TLDs the count explodes. Most of them will never be registered. For monitoring, rank by how an attack is delivered:

• Combosquatting dominates phishing. Links arrive by email or SMS, so nobody has to mistype anything. A name like acmepay-verify.com looks credible in a message and passes a quick glance.
• TLD swaps exploit the "same name, different ending" confusion, especially when the real brand sits on a country-code extension and the attacker takes the .com.
• Classic typos matter for brands with direct traffic, such as consumer sites people type from memory.
• Homographs are rarer but harder to spot visually; browsers and registries restrict many of them.

A monitoring workflow

1. Define the watch terms. Brand names, product names, common misspellings, local-language spellings and well-known abbreviations. Include the strings customers see in emails and apps, not only the legal company name.
2. Generate permutations. Use a permutation generator for the typo classes and add a word list for combosquats (login, secure, verify, support, pay, wallet, account, refund, and the languages of your market). Treat the output as candidates to match against, not as a shopping list.
3. Match against new registrations. Compare candidates, plus fuzzy matches, with each day's additions to TLD zone files. The method for deriving additions is in the guide to newly registered domains; the zone data itself is explained in zone files and CZDS. Certificate Transparency logs add an independent trigger, since phishing sites usually obtain a certificate.
4. Triage. Check the name servers, the registrar and the creation date (via RDAP), what the site serves, and whether mail (MX) records exist. A lookalike with MX records and no website is often preparing email fraud.
5. Classify. Active phishing, parked or for sale, unrelated legitimate business, fan or criticism site, and possible defensive registration by an affiliate. Only the first needs an immediate takedown.
6. Act and log. Add active ones to email and web blocklists, report them, and keep evidence: screenshots, HTML, timestamps, WHOIS or RDAP output.

Triage example: reading a suspect domain

Suppose today's additions include acmepay-verify.top. A quick, repeatable read takes a few minutes and uses only public data:

• Age. Registered yesterday, per RDAP. An established brand's genuine support site would normally sit on the main domain, not a day-old name.
• Delegation. Name servers at a free or bulk DNS service rather than the ones your brand uses. Several sibling domains sharing the same name servers suggests a campaign.
• Mail records. MX present but no website yet: email fraud preparation. Website present with a form posting to another host: credential harvesting.
• Certificate. A certificate issued within hours of registration is normal for phishing kits and also for honest sites, so it only corroborates.
• Content. Copied logo and page layout, urgency wording, a login form. Capture it before it changes, and fetch from a sandbox, not your workstation.

Scoring these signals together, rather than relying on string similarity alone, keeps the false-positive rate manageable. String distance flags many innocent names: a florist named "Acme Pay Flowers" will match your watch list and should be classified, not attacked.

Common mistakes

• Reporting only the domain and forgetting the hosting provider, so the page survives on a new name within hours.
• Treating every parked lookalike as hostile. Parked pages with ads are annoying but usually need a different, slower response.
• Skipping evidence. Registrars and dispute panels want dated screenshots and records, and pages vanish quickly.
• Forgetting your own subdomains and legacy brand names, which are also impersonation targets.

Takedown routes

No single route fits every case. They differ in speed, cost and what you must prove.

Route	Best for	Notes
Hosting provider abuse report	Active phishing or malware	Often the fastest way to remove the content, but the domain remains and can be re-pointed
Registrar abuse contact	Phishing, fraud, trademark abuse	Registrars have abuse-handling obligations under their ICANN agreement; response speed and evidence standards vary widely
Browser and security vendor reports (for example Google Safe Browsing)	Warning users quickly	Does not remove the domain, but browser warnings cut victim traffic fast
UDRP	Cybersquatting where you hold trademark rights	An ICANN-mandated administrative procedure with accredited providers such as WIPO. Complainants must show a confusingly similar name, no legitimate interest, and bad-faith registration and use. Remedy is transfer or cancellation, not damages
URS (Uniform Rapid Suspension)	Clear-cut cases in newer gTLDs	Faster and cheaper than UDRP; applies to domains in new gTLDs that adopt it; the outcome is suspension for the rest of the registration term, not transfer
Court action	Repeat offenders, large harm	Slow and costly; can reach damages and cross-border orders

Before any dispute, confirm that your rights are solid. Weak or generic trademarks, a name that is a common word, or a registrant with a genuine fan or review site can make a complaint fail and may even be labelled reverse domain name hijacking. Check the current rules and fees on the provider's website, because they change.

Defensive registration economics

Buying variants yourself is an insurance decision, not a rule. The cost is per name and per year, and it recurs forever: a defensive portfolio that was cheap in year one is a standing renewal bill later. Some points to weigh:

• Register the high-value few. The main brand on the extensions your customers expect, the one or two most obvious typos, and your brand with the most common combosquat words.
• Avoid chasing every permutation. The space is effectively unbounded, and new TLDs keep adding cases. Detection plus takedown scales better than prevention.
• Prefer cheap prevention for what you do own. Set a strict email policy (SPF, DKIM and DMARC with enforcement) on the defensive domains too, or an unused domain can be spoofed. Keep the important ones locked and on auto-renew; the basics are in protecting your domain from expiring.
• Beware promo-then-renewal pricing. Many new extensions are cheap to register and costlier to renew. Check the renewal price before building a defensive portfolio on them.
• Some registries offer blocking services that cover a trademark across many extensions for a fee. These are options to compare with registering individual names; check each registry for current terms.

Lapsed defensive names are a risk too: if a defensive registration is allowed to expire, someone else can pick it up. The path it takes is described under domain lifecycle.

Frequently asked questions

What is the difference between typosquatting and cybersquatting?

Cybersquatting is the broad term for registering a name that trades on someone else's trademark or identity. Typosquatting is a subset that relies on likely typing errors. Combosquatting and homograph attacks are usually grouped with the broader family.

How do attackers find which typo domains are worth registering?

They generate permutations of popular brands with scripts and register those that are free, often in bulk. For phishing the target is usually chosen first, then names are picked that look right inside an email or SMS, which is why combinations such as brand plus "login" are common.

Is a UDRP complaint worth filing for every lookalike?

Usually not. UDRP takes weeks, costs fees, and returns a domain rather than damages. Active phishing is faster to handle through hosting, registrar and browser reports. Reserve UDRP for valuable names you want to own, where you clearly hold trademark rights.

What is the difference between UDRP and URS?

Both are ICANN-mandated procedures. UDRP is broader, applies to most gTLDs, and can transfer the domain. URS is a faster, narrower route available in new gTLDs that adopt it; it requires clear-and-convincing evidence and results in suspension, not transfer.

Can I monitor lookalikes without paying for a service?

Partly. Generate permutations yourself, match them against zone-file additions where you have access, and watch Certificate Transparency logs for your brand strings. Paid services add scale, screenshots and takedown handling.

Should I register every typo of my brand?

No. Register the main brand on the extensions you need, a few of the most likely typos, and any names you are already seeing abused. Beyond that, detection and takedown are usually cheaper than buying an unbounded list that renews every year.