What Is Typosquatting, and How Do You Protect Your Brand?

Fingers slip. Someone types gogle.com, amazom.com, or yourbrand.cm instead of the real thing, and a typosquatter is waiting at the other end with a phishing page, a page of ads, or a mail server quietly collecting misaddressed email. Typosquatting is one of the oldest tricks on the internet, and it still works because the number of possible typos for any domain is large and registrations are cheap. This article explains how typosquatting works, the specific typo patterns attackers use, how to find typo domains targeting your brand with a script or with dnstwist, and the defensive steps that actually reduce the risk. It is a specific form of cybersquatting, so legal remedies are covered there in more depth.

What Is Typosquatting?

Typosquatting (also called URL hijacking) is registering domain names that are common misspellings or mistypings of a popular domain, in order to capture visitors and email intended for the real one. The squatter then uses that traffic to:

• Phish credentials: a copy of your login page on a one-letter-off domain.
• Spread malware: fake downloads or drive-by exploit kits.
• Earn ad revenue: parking pages filled with competitor links.
• Sell counterfeits: storefronts that look like the original.
• Intercept email: a typo domain with MX records receives every email someone sends to the wrong address, which can include invoices, passwords, and confidential documents.
• Run affiliate fraud: redirecting visitors to the real site through an affiliate link to earn commission on purchases they would have made anyway.

Typo domains are also used in business email compromise: an attacker registers yourcompnay.com and emails your finance team as your CEO, or emails your customers with "updated" bank details.

Common Typo Patterns

Typosquatters generate variants systematically. Understanding the patterns helps you predict which domains matter. Using example.com as the target:

Technique	How it works	Example
Omission	A character is left out	exmple.com
Repetition	A character is doubled	exaample.com
Transposition	Two adjacent characters swap	exmaple.com
Adjacent-key replacement	A neighboring keyboard key is hit	exanple.com (n next to m)
Insertion	A neighboring key is added	exampkle.com
Vowel swap	One vowel replaced by another	exampla.com
Homophones and plurals	Sounds alike or adds an s	examples.com
Hyphenation	A hyphen is added	exam-ple.com
Missing dot	The dot after www is dropped	wwwexample.com
Subdomain split	A dot is inserted inside the name	ex.ample.com
TLD typo or swap	The extension is mistyped or changed	example.co, example.cm, example.om
Bitsquatting	A single bit flip in memory changes a character	exampme.com (l to m differs by one bit)
Lookalike characters	Visually similar characters	examp1e.com, rn for m

The TLD typos deserve special attention. .co (Colombia), .cm (Cameroon), and .om (Oman) are one keystroke away from .com, and all have been heavily used for typosquatting over the years.

Lookalike characters, especially non-Latin letters that render identically to Latin ones, are a separate and more deceptive category. They are covered in detail in homograph attacks and lookalike domains.

Generating Typo Variants Yourself

You can generate the most common variants with a short script. This Python example produces omission, repetition, transposition, adjacent-key, vowel-swap, hyphenation, missing-dot, and TLD variants:

import sys

KEYBOARD = {
    "q": "wa", "w": "qeas", "e": "wrsd", "r": "etdf", "t": "ryfg",
    "y": "tugh", "u": "yihj", "i": "uojk", "o": "ipkl", "p": "ol",
    "a": "qwsz", "s": "awedxz", "d": "serfcx", "f": "drtgvc",
    "g": "ftyhbv", "h": "gyujnb", "j": "huikmn", "k": "jiolm",
    "l": "kop", "z": "asx", "x": "zsdc", "c": "xdfv", "v": "cfgb",
    "b": "vghn", "n": "bhjm", "m": "njk",
}
VOWELS = "aeiou"
TLD_TYPOS = ["co", "cm", "om", "net", "org", "cmo", "con"]


def variants(domain):
    name, _, tld = domain.lower().partition(".")
    out = set()
    for i in range(len(name)):
        out.add(name[:i] + name[i + 1:])                     # omission
        out.add(name[:i] + name[i] + name[i:])               # repetition
        if i < len(name) - 1:                                # transposition
            out.add(name[:i] + name[i + 1] + name[i] + name[i + 2:])
        for k in KEYBOARD.get(name[i], ""):
            out.add(name[:i] + k + name[i + 1:])             # adjacent key
            out.add(name[:i] + k + name[i:])                 # insertion
        if name[i] in VOWELS:
            for v in VOWELS:
                if v != name[i]:
                    out.add(name[:i] + v + name[i + 1:])     # vowel swap
        if 0 < i:
            out.add(name[:i] + "-" + name[i:])               # hyphenation
    out.discard(name)
    out = {n for n in out if n and not n.startswith("-") and not n.endswith("-")}
    domains = {f"{n}.{tld}" for n in out}
    domains.add(f"www{name}.{tld}")                          # missing dot
    domains.update(f"{name}.{t}" for t in TLD_TYPOS if t != tld)
    return sorted(domains)


if __name__ == "__main__":
    target = sys.argv[1] if len(sys.argv) > 1 else "example.com"
    for d in variants(target):
        print(d)

Save it as typos.py and run python3 typos.py yourbrand.com. Even a seven-letter name like example produces close to a hundred variants. To find which ones are registered, resolve them. This Bash loop checks for any name server, A record, or MX record:

python3 typos.py yourbrand.com > variants.txt
while read -r d; do
  ns=$(dig +short NS "$d")
  a=$(dig +short A "$d")
  mx=$(dig +short MX "$d")
  if [ -n "$ns$a$mx" ]; then
    printf '%s\tA=%s\tMX=%s\n' "$d" "$(echo $a | tr '\n' ' ')" "$(echo $mx | tr '\n' ' ')"
  fi
done < variants.txt

A domain with MX records is the most urgent finding, because it can receive email meant for you. Note that a domain can be registered without any DNS, so absence of records does not prove a name is available; confirm interesting ones with whois or RDAP.

Using dnstwist

dnstwist is a widely used open-source tool that does all of the above and more, including bitsquatting, homoglyphs, dictionary combinations, and checks for MX records and web page similarity. Install and run it:

pip install dnstwist

# Show only registered permutations
dnstwist --registered yourbrand.com

# Check whether registered lookalikes have mail servers
dnstwist --registered --mxcheck yourbrand.com

# Export to CSV or JSON for tracking over time
dnstwist --registered --format csv yourbrand.com > typos-$(date +%F).csv
dnstwist --registered --format json yourbrand.com > typos-$(date +%F).json

Run it on a schedule and compare results between runs to spot new registrations. A simple diff of two CSV exports works:

diff <(cut -d, -f2 typos-2026-10-01.csv | sort) <(cut -d, -f2 typos-2026-10-26.csv | sort)

Check the CSV header first, since column order can vary between dnstwist versions. A Docker image is also available if you prefer not to install Python packages.

Certificate Transparency Monitoring

Attackers setting up phishing sites almost always obtain a TLS certificate, and every publicly trusted certificate is logged in Certificate Transparency logs. Searching those logs for your brand catches typo and combo domains early, often before the phishing campaign starts:

curl -s "https://crt.sh/?q=%25yourbrand%25&output=json" \
  | jq -r '.[].name_value' | sort -u | grep -v 'yourbrand\.com$'

The %25 is a URL-encoded % wildcard. Broad wildcard queries can be slow or time out on crt.sh; commercial CT monitoring services handle this at scale.

How to Protect Your Brand

1. Register the Highest-Risk Typos Defensively

You cannot register every variant, and you do not need to. Prioritize:

• Your brand in .co, .cm, and any TLD your customers might confuse with yours.
• The most likely keyboard slips and omissions, especially for your login, payment, and email domains.
• www-without-dot variants.
• Any variant that has been registered and dropped before.

Our guide on whether to buy multiple domain extensions covers how to balance cost against coverage.

2. Redirect Defensive Domains

Typo domains you own should send visitors to the right place with a permanent redirect. In Nginx:

server {
    listen 80;
    listen 443 ssl;
    server_name exmaple.com www.exmaple.com examp1e.com www.examp1e.com;

    ssl_certificate     /etc/ssl/certs/typos.pem;
    ssl_certificate_key /etc/ssl/private/typos.key;

    return 301 https://example.com$request_uri;
}

In Apache .htaccess on a host serving the typo domain:

RewriteEngine On
RewriteCond %{HTTP_HOST} !^example\.com$ [NC]
RewriteRule ^(.*)$ https://example.com/$1 [R=301,L]

The certificate must cover every hostname that serves HTTPS, otherwise browsers show an error before the redirect happens. Registrar-level forwarding is another option; see what domain forwarding is.

3. Lock Down Email on Defensive Domains

Domains that never send email should say so explicitly. This stops attackers from spoofing them and stops receivers from accepting mail that claims to come from them. Publish a null MX (RFC 7505), an SPF record that authorizes nothing, and a strict DMARC policy:

exmaple.com.         3600  IN  MX   0 .
exmaple.com.         3600  IN  TXT  "v=spf1 -all"
_dmarc.exmaple.com.  3600  IN  TXT  "v=DMARC1; p=reject;"

On your real domain, enforce DMARC as well, so attackers cannot send mail as your exact domain and are pushed toward obvious typo domains instead. See what a DMARC record is.

4. Monitor Continuously

Schedule dnstwist and certificate transparency checks weekly or daily. Alert on new registrations, new MX records, and new certificates. Track each finding with a status: benign, watch, takedown, or dispute.

5. Train Your People

Most typosquatting damage happens through people, not technology. Teach staff, especially finance and support teams, to check sender domains carefully, to verify bank detail changes by phone using a known number, and to use bookmarks or a password manager, which will not autofill credentials on a lookalike domain.

6. Take Action Against Malicious Typo Domains

When you find a typo domain being used against you:

1. Document it: screenshots, WHOIS/RDAP output, DNS records, and any phishing emails with full headers.
2. Report abuse: to the registrar's abuse contact, the hosting provider, and Google Safe Browsing. Phishing reports are usually acted on faster than trademark complaints.
3. Recover or suspend it: for a trademark-based claim, file under the UDRP (transfer) or the URS for new gTLDs (suspension). Typo domains used for phishing or ads are common, strong UDRP cases.
4. Warn customers: if the domain was used to contact customers, tell them what to look for.

Typosquatting FAQ

Conclusion

Typosquatting exploits a simple fact: people mistype, and every mistyped domain is a potential trap. Attackers use systematic patterns such as omission, transposition, adjacent keys, TLD swaps, missing dots, and bit flips to register the variants of your domain most likely to catch traffic and email, then use them for phishing, fraud, ads, or email interception.

Defense is a combination of a few well-chosen registrations, redirects and locked-down email on those domains, strict DMARC on your real domain, continuous monitoring with tools like dnstwist and certificate transparency, trained staff, and fast action through abuse reports and dispute processes when a malicious domain appears. None of these is expensive on its own, and together they make your brand a much less attractive target.

Here are some useful references for going deeper on typosquatting:

1. GitHub: dnstwist — the open-source domain permutation engine used in the examples above.
2. RFC 7505: A "Null MX" No Service Resource Record — how to declare that a domain does not accept email.
3. RFC 7489: Domain-based Message Authentication, Reporting, and Conformance (DMARC) — the specification behind the DMARC records shown here.
4. WIPO: WIPO Jurisprudential Overview 3.0 — how UDRP panels treat typo domains as confusingly similar.
5. Google: Report phishing page — submit typo domains hosting phishing to Google Safe Browsing.