Typosquatting.ai
PATTERNS

Insertion Typosquatting: One Letter Too Many

An extra letter is easy to make and easy to miss, and there are more places to put it than there are letters to drop. Illustrative lookalikes in this guide use the reserved .test ending, so that no real registration is named.

by Typosquatting.ai Research23 September 20263 min read

Insertion typosquatting registers a domain in which one character has been added to a real name, inside it, at the end, or as a plural, so that exsample.test, examplea.test and examples.test all stand in for example.test.

This guide covers the three shapes of the added character, why the family is one of the largest a generator produces, which insertions people actually type, how the checker ranks them, and the response that fits.

Family in a report
Inserted character
Sample
exsample.test
Candidates for a six-letter domain
144 of 3,001

The three shapes of an insertion

Inside the label: exsample.test, a stray key struck between two right ones, 144 candidates for a six-letter label because any of 36 characters can land in any of seven gaps. At the end: examplea.test, the appended character, 32 candidates. As a plural: examples.test, one candidate, and the one most likely to be read as a legitimate variant of the brand.

Doubled letters, exaample.test, are their own family, repetition, covered in its own guide.

FamilyExampleCandidates for a six-letter label
Inserted characterexsample.test144
Added characterexamplea.test32
Plural formexamples.test1

Why insertions happen

Damerau's 1964 finding covers this family too: an inserted character is one of the four single errors that account for more than 80 percent of misspellings. On a keyboard the inserted letter is usually a neighbour of one that belongs, struck on the way to it; on a phone it is the letter beside the intended one on a small keyboard. The plural is different in kind: nobody mistypes it, people assume it, and that is why it is registered.

What a registered insertion usually is

Most registered insertions are parked or unused; a family this large has far more members than anybody wants. The ones that matter share a profile: recent, active, with a mail record. The plural is the exception worth reading on its own, because a plural of a brand is often registered by an unrelated business with a plausible claim to it, and the checker's Possibly yours tag will not apply to it. Similarity is not proof of intent, and a plural least of all.

How the checker finds and ranks it

A finding's review priority is a published rule, not a score. A name with an address or a mail record is active; active names registered under 90 days ago are Elevated, and so are active names under a year old that carry an impersonation keyword. Anything else that is active or has a registry record is Review, a name with no registry record and no DNS answer is Low signal, and a lookup the registry refused stays Unknown rather than being counted as a negative.

An inserted or added character is one edit away, the nearest band; the plural is likewise one edit. A report sorted by distance lists them beside the omissions and transpositions.

What to do with one

The plural, if it is available, is worth owning; it is the one variant people type deliberately. For the rest, watch rather than register, and act on the row that turns active and recent. Keep the report as evidence, and never visit the name.

Common questions

Is a plural domain typosquatting?
It is generated as a lookalike because people assume it exists, but a registered plural is often a legitimate unrelated business. Read its registration record before assuming anything.
Why are there 144 inserted-character candidates?
Seven positions in a six-letter label, times the letters, digits and hyphen that can be inserted, minus duplicates. The checker resolves all of them rather than sampling.
Does an insertion change the distance band?
No. One added character is one edit, so it sits in the nearest band alongside omissions, transpositions and single substitutions.
Should I register my brand's plural?
If it is available and you have any public-facing use for it, yes. It is the one insertion that people reach on purpose.

Sources and further reading

  1. Wikipedia: Damerau-Levenshtein distance, on Damerau's 1964 finding
  2. Types of typosquatting: 20 patterns with real examples
  3. Typosquatting.ai methodology: patterns, sources and review rules

Keep reading in Typosquatting patterns