Guides to typosquatting, domain protection and the public records an investigation rests on. Every guide names its author, cites primary sources, and says what the evidence cannot establish.
Typosquatting registers domains that resemble a real one, exploiting typing mistakes and visual similarity to reach people who meant to go somewhere else. These guides cover the patterns, the evidence each one leaves in public records, and what a check can establish.
Typosquatting, also called URL hijacking, is the registration of domain names that closely resemble an existing name, so that people who mistype an address, misread a link, or trust a familiar-looking brand arrive somewhere the brand does not control.
12 min readA typosquatting pattern is a rule for deriving a confusable name from a real one, such as dropping a character, swapping two, substituting a lookalike from another script, or attaching a keyword.
11 min readA lookalike domain is any registered name designed to be mistaken for another, whether through spelling, characters that render alike, added words, a different ending, or a brand placed inside somebody else’s subdomain.
12 min readTyposquatting protection is the combination of a small defensive registration set, monitoring of everything else, mail authentication, browser and legal safeguards, and a documented response process that limits what a lookalike domain can achieve.
12 min readProtecting a name is a routine, not a purchase. These guides cover what to monitor, what to register defensively, how to keep a portfolio in order, and what the dispute routes actually involve.
Lookalike domain monitoring is the practice of repeatedly checking which names that resemble yours exist, what infrastructure they carry, and what has changed since the last check.
11 min readProtecting a domain from impersonation means securing the names you hold, registering the few variants whose absence would cost you, monitoring the rest, and having a response ready for the day a lookalike turns out to be real.
10 min readDefensive domain registration is registering variants of your own name so that nobody else can, accepting that only a small fraction of the possible variants can ever be bought.
12 min readCybersquatting, also called domain squatting, is registering a domain in bad faith because somebody else has rights in the name; typosquatting describes a name built to be confused with another, whatever the motive.
11 min readThe Uniform Domain-Name Dispute-Resolution Policy is an administrative process, binding on every registrant of a generic domain, through which a trademark owner can seek the transfer or cancellation of a domain registered and used in bad faith.
12 min readEvery conclusion about a domain rests on a public record. These guides explain what each source returns, how to read it, and where it stays silent.
RDAP, the Registration Data Access Protocol, is the standard HTTPS service through which a registry returns a domain's registration record as structured JSON.
12 min readWHOIS is the original port 43 text protocol for querying registration data; RDAP is the structured HTTPS and JSON replacement that generic top-level domain registries and registrars were required to adopt.
10 min readDNS records are the published answers a domain gives about where it lives, how it receives mail, and who is authoritative for it, and on a lookalike domain each one is a piece of evidence about preparation.
11 min readCertificate transparency is a system of public, append-only logs recording certificates as they are issued, so that any certificate for any name can be discovered by anyone.
10 min readInvestigating a suspicious domain without visiting it means establishing what it is from public registration, DNS, certificate and passive records, without sending a request to the site itself.
10 min readA brand is impersonated in more places than it is registered. These guides cover building a response process, choosing between categories of tooling, and what happens after you report a domain.
Reporting a lookalike domain is the act of sending evidence about an abusive registration to the intermediaries that can act on it: the registrar that sponsors the name, the provider that serves what it points at, and the blocklist operators that can warn people away from it.
12 min readBrand protection for domains is a written set of decisions about which names are in scope, which are worth registering, which are only worth watching, and who does what on the day a finding turns out to be real.
11 min readA domain takedown is a request to an intermediary, usually a hosting provider or a registrar, to stop serving or stop resolving a name that is being used abusively, decided under that intermediary's own terms rather than by a court.
12 min readA lookalike domain that sends mail is a different problem from one that hosts a page. These guides cover sender impersonation, what authentication does and does not cover, and how to read mail records on a variation.
Email spoofing is a message whose From header names a domain the sender does not control, while a lookalike domain is a registered name that resembles the real one and sends genuine mail from itself.
12 min readSPF, DKIM and DMARC are mechanisms that let a receiving mail server check whether a message really came from the domain it claims, which is a different question from whether that domain deserves to be trusted.
11 min readMX records are the DNS entries that say where a domain's mail is delivered, published by whoever controls the domain, and on a lookalike they mean somebody made the name capable of receiving mail.
11 min readEvery lookalike is derived from a real name by one rule. These guides take the families one at a time: how the mistake or the trick works, how many candidates it produces for a six-letter domain, what a registered one usually turns out to be, and how the checker ranks it.
Transposition typosquatting registers a domain in which two neighbouring characters of a real name have changed places, so that exmaple.test stands in for example.test.
5 min readOmission typosquatting registers a domain from which one character of a real name has been removed, so that exmple.test stands in for example.test.
4 min readInsertion typosquatting registers a domain in which one character has been added to a real name, inside it, at the end, or as a plural, so that exsample.test, examplea.test and examples.test all stand in for example.test.
3 min readRepetition typosquatting registers a domain in which one character of a real name appears twice in succession, so that exaample.test stands in for example.test.
3 min readKeyboard typosquatting registers a domain in which one character of a real name has been replaced by a key adjacent to it on a keyboard, so that ezample.test stands in for example.test.
4 min readA homoglyph domain replaces one or more characters of a real name with characters that look the same or nearly the same, within the Latin script, such as rn for m and 1 for l, or across scripts, such as a Cyrillic a for a Latin a.
5 min readCombosquatting registers a domain that contains a real brand name unchanged, joined to one or more other words, so that example-login.test, secure-example.test and my-example.test all trade on example.test.
4 min readTLD squatting registers the registrable label of a real domain, unchanged, under a different top-level domain, so that example.net or example.app stands in for example.com.
4 min readA subdomain-split lookalike inserts a dot into a real name so that part of it becomes a subdomain of a different registrable domain, ex.ample.test for example.test; a hyphenated lookalike inserts a hyphen instead, ex-ample.test.
4 min readA hosting-platform lookalike is a real brand name claimed as a subdomain of a public hosting platform, so that example.pages.dev, example.netlify.app or example.github.io stands in for example.com without any domain being registered.
4 min readBitsquatting registers a domain name one bit different from a popular one, so that a hardware error that flips a bit in a stored name, in a computer, a phone or a router, delivers a request to the squatter without any person having typed anything wrong.
4 min read