How is bitsquatting different from a typo?

A typo is a human error at the keyboard. A bitsquat is a hardware error in stored memory. The resulting name looks like a one-letter substitution, but it arrives from devices whose users typed nothing.

How many bitsquats does a domain have?

Only the flips that produce a valid letter or digit count. For example.test the generator finds three.

Did bitsquatting really receive traffic?

In Dinaburg's 2011 experiment, 32 registered bitsquat domains logged 52,317 requests from 12,949 unique addresses in about eight months.

Should I register my bitsquats?

If your name is embedded in software or devices at scale, yes; there are only a few and they are cheap. Otherwise watch them like any other family.

PATTERNS

Bitsquatting: Domains One Bit Away

Nobody mistypes a bitsquat. The machine does. Illustrative lookalikes in this guide use the reserved .test ending, so that no real registration is named.

by Typosquatting.ai Research23 September 20264 min read

Bitsquatting registers a domain name one bit different from a popular one, so that a hardware error that flips a bit in a stored name, in a computer, a phone or a router, delivers a request to the squatter without any person having typed anything wrong.

This guide covers the experiment that named the pattern, why a flipped bit produces a plausible domain, how few candidates the family has, how the checker ranks them, and why a registered bitsquat is almost never an accident.

Family in a report: Bit-flipped character
Sample: ezample.test (one bit flipped)
Candidates for a six-letter domain: 3 of 3,001

What bitsquatting is

Artem Dinaburg's definition from his 2011 research: bitsquatting refers to the registration of a domain names one bit different than a popular domain. A character in a name is stored as bits, and a single flipped bit changes the character; flip one bit of the x in example and it becomes another letter, and the name that results is what a faulty device asks the DNS for. The squatter registers that name and waits.

Dinaburg registered 32 bitsquat domains of major brands and logged the traffic between September 2010 and May 2011: a total of 52,317 bitsquat requests from 12,949 unique IP addresses, from devices that had never been told to visit them. He presented the work at Black Hat 2011 and DEF CON 19.

Why a flipped bit produces a real-looking name

Only some flips produce a valid domain character; flips that produce punctuation or control characters produce no name at all. The ones that do produce a letter or a digit yield a name one substitution away from the original, so a bitsquat looks like a keyboard typo even though its cause is different. The generator keeps only the flips that produce a valid label: three candidates for a six-letter .com.

Domain	Bit-flipped candidate	Candidates for a six-letter label
example.test	ezample.test (one bit flipped in x)	3

What a registered bitsquat usually is

Because nobody types them, a registered bitsquat that is not the brand's own is almost always deliberate: research, as in the 2011 experiment, or an operator collecting whatever a faulty device sends, which can include requests from software that never shows a user a page. That makes intent more likely here than in any typed family, and the report still says review priority, because the record, not the pattern, is what a registrar acts on.

How the checker finds and ranks it

A finding's review priority is a published rule, not a score. A name with an address or a mail record is active; active names registered under 90 days ago are Elevated, and so are active names under a year old that carry an impersonation keyword. Anything else that is active or has a registry record is Review, a name with no registry record and no DNS answer is Low signal, and a lookup the registry refused stays Unknown rather than being counted as a negative.

A bitsquat is one substitution away and wears the nearest distance band; the pattern column says Bit-flipped character so it is not mistaken for a keyboard slip.

What to do with one

Register the few that are available if your name carries significant machine traffic, since three names are cheap and the family is tiny. For a registered one that is active, keep the report and file with the registrar. Never open it.

Common questions

How is bitsquatting different from a typo?: A typo is a human error at the keyboard. A bitsquat is a hardware error in stored memory. The resulting name looks like a one-letter substitution, but it arrives from devices whose users typed nothing.
How many bitsquats does a domain have?: Only the flips that produce a valid letter or digit count. For example.test the generator finds three.
Did bitsquatting really receive traffic?: In Dinaburg's 2011 experiment, 32 registered bitsquat domains logged 52,317 requests from 12,949 unique addresses in about eight months.
Should I register my bitsquats?: If your name is embedded in software or devices at scale, yes; there are only a few and they are cheap. Otherwise watch them like any other family.