Reference

Glossary

46 terms used across this site. Where a term has a standard meaning in the field, the definition follows the standard. Where it is this product’s own, the definition is the rule actually applied, so this page and the methodology cannot drift apart.

The practice

What the various kinds of confusable registration are called, and how they differ.

Typosquatting: Registering a domain built to be confused with another, whether through a spelling change, characters that render alike, an added keyword or a different ending. It describes the name, not the motive.
Cybersquatting: Registering or using a name in bad faith when somebody else has rights in it, usually a trademark. It describes conduct, and it is the ground a dispute is argued on.
Domain squatting: A general term for registering names for their value to somebody else, covering cybersquatting and speculative registration for resale.
Combosquatting: A correctly spelled brand combined with another word, such as brand-login or brand-support. Nothing is misspelled, which is what makes it effective inside a message.
Bitsquatting: A name one bit different from the target, exploiting memory errors in machines rather than mistakes by people. A registered bit-flip of a busy domain is a deliberate act.
Brandjacking: Impersonation of a brand across channels generally. Domains are one part of it; display names, social accounts and advertisements are others.

Characters and encoding

Why two names can look identical and not be the same name.

Homograph attack: Using characters that render almost identically to the expected ones, often from another script, so a name is misread rather than mistyped.
IDN: An internationalised domain name: one containing characters outside the basic Latin set. Widely used legitimately, which is why no tool can simply reject them.
Punycode: The ASCII encoding an internationalised name is carried in, beginning xn--. A browser showing you the Punycode form is telling you it considers the name deceptive.
Confusables: Characters Unicode records as visually interchangeable. The published confusables data is what detection of visual lookalikes works from.
Edit distance: How many single-character changes turn one name into another. A small distance means a name is close, not that it is hostile.

Names and ownership

How a name is structured, and who holds what.

Registrable domain: The part of a name somebody actually registers. In www.shop.example.co.uk it is example.co.uk. Everything to the left is a subdomain under the same owner.
Public suffix: The part of a name under which registrations happen, such as com or co.uk. The Public Suffix List is what makes the distinction reliable, since co.uk looks like two labels but behaves as one.
Registry: The operator of an ending, which holds the authoritative record of what is registered under it.
Registrar: The company through which a registration is bought and managed. The registry discloses it in the registration record more often than it discloses the registrant.
Defensive registration: A variation registered by a brand so that nobody else holds it. A large share of the findings on a first check turn out to be these.
Parked domain: A registered name serving a holding page, usually monetised by advertising, with no interest in any particular brand.
Dormant domain: A name that returns nameservers but no address: registered and delegated, with nothing published yet. Worth catching precisely because it is early.

The records

The public sources a finding rests on, and what each one answers.

RDAP: The Registration Data Access Protocol: the structured service through which a registry returns a registration record. It replaced WHOIS for generic endings.
WHOIS: The original text protocol for registration data. Unstructured and inconsistent between providers, which is why it was replaced.
Nameserver: A server the registry has delegated a name to. Nameservers matching your own are a strong hint that a variation is one of yours.
A and AAAA records: The IPv4 and IPv6 addresses a name points at. An address means something is reachable; it does not mean a website exists.
MX record: Where mail for a name is delivered. Publishing mail routing is a deliberate act, so a lookalike that can receive mail deserves attention.
NS record: The delegation in DNS. A name with nameservers is registered even when nothing else is published.
TXT record: Unstructured text, in practice mail authentication policy and service verification tokens.
Certificate transparency: Public, append-only logs of issued certificates. Because a certificate is usually issued before a page appears, the logs give the earliest public warning that a name is being prepared.
Passive evidence: Historical observations of a host recorded by a public scanning service. Evidence gathered by somebody else, which is why consulting it requires visiting nothing.

Reading a report

The vocabulary this product uses, and exactly what each label means.

Finding: One row in a report: a candidate name that exists, with the evidence gathered about it and the rule that ranked it.
Review priority: The order in which findings deserve human attention. It is a documented heuristic, never a verdict about a registrant.
Elevated: An impersonation keyword on a registration under a year old, or active infrastructure on a recent one. The row to look at first.
Review: Some registration or infrastructure evidence exists: registered but dormant, or resolving without the signals that would raise it further.
Low signal: No registry record and no DNS answer were found. Not a statement that a name is available, and not a statement that a brand is safe.
Possibly yours: A variation sharing your registrar and nameservers, or your exact DNS providers. Usually a defensive registration you already own.
Unknown: A source did not answer: a timeout, a rate limit, or an ending with no service. Never reported as a negative result.
Pattern family: The rule a candidate name was derived from, such as a transposition, a lookalike character or a keyword compound.

Using the panel

The parts of the product a guide might refer to.

Watchlist: The domains you keep under watch. Variations found under a watched domain never count towards the limit.
Re-check: Running a check again and saving the report with a list of what changed since the previous one: new, changed priority, changed evidence, gone.
Findings ledger: The record of the decision you made about each finding, with the dates it was first and last seen. A decision sticks to the name, not to the report it was made in.
Discover: The list of candidate names that gave no DNS answer, closest first. No answer is evidence of absence, not proof a name is available to buy.
Rule: A saved query with a severity attached. Every saved report runs the enabled rules; a rule never changes a finding's published review priority.
Alert: A message raised when a rule matches, sent by email or to a webhook depending on plan, with a threshold you set.
API key: A bearer token for the API, scoped to check or read-only, stored only as a hash and shown once when created.

Responding

What happens after a finding turns out to be real.

Abuse contact: The address a hosting provider or registrar publishes for reports. Acting on evidence of current conduct, it is usually faster than any formal route.
Takedown: Getting abusive content removed or a name suspended, normally through the hosting provider or registrar rather than through a dispute.
UDRP: The Uniform Domain-Name Dispute-Resolution Policy: an administrative process to transfer or cancel a name registered and used in bad faith. Three elements must all be established.
URS: Uniform Rapid Suspension: faster and cheaper than the UDRP, with a higher standard of proof, and it suspends a name rather than transferring it.