Domains, platforms, and web abuse
Typosquatting
Typosquatting is the registration of domains that differ from a trusted name by a typing error, a swapped character, a different top-level domain or an added word, in order to catch mistyped traffic or to host phishing and scam content.
How the names are built
Typosquats are generated mechanically from the target name: omit a letter, double one, transpose two, replace one with a neighbouring key, swap a letter for a lookalike, or change the ending. Attackers run the same generators defenders do, so the candidate list for any brand is large and the registered subset changes daily.
Warning signs
- The domain changes, omits, repeats or substitutes one character of a trusted name.
- A familiar brand appears with an unexpected word, top-level domain or non-Latin character.
- DNS, certificate, hosting or page-template evidence links the domain to other abusive infrastructure.
Detection and response
- Record the exact hostname with its registration, DNS, certificate, redirect and page-content evidence.
- Rank by customer harm: active credential collection or payment fraud outranks a parked registration.
- Use registrar, host, browser, search and brand-enforcement channels according to what the domain is doing, and keep watching, because registrations rotate.
Limits of the approach
Permutation scanning only finds names it can generate. A brand name embedded in a longer domain, or placed in a subdomain, will not appear on the list, which is why typosquat monitoring is paired with certificate-transparency and DNS-based discovery.
Related terms
Sources
External guidance is general. Adapt it to your legal, regulatory and operational requirements.