Which keyboard layout does the checker use?

QWERTY, the layout most brand traffic is typed on. Neighbours on other layouts are not generated, and a check cannot know which keyboard a visitor used.

Why is this family so much larger than transposition?

Every position has several neighbouring keys, while a transposition has only one partner per adjacent pair.

Is a keyboard substitution the same as a homoglyph?

No. A substitution uses a key that is physically nearby; a homoglyph uses a character that looks similar. The homoglyph guide covers the second.

Can I register all 175?

You can, at a cost that rarely makes sense. Watching them costs less and catches the day one of them turns active.

PATTERNS

Keyboard Typosquatting: The Neighbouring Key

The x is next to z, s and c. Type fast and one of them is what you get. Illustrative lookalikes in this guide use the reserved .test ending, so that no real registration is named.

by Typosquatting.ai Research23 September 20264 min read

Keyboard typosquatting registers a domain in which one character of a real name has been replaced by a key adjacent to it on a keyboard, so that ezample.test stands in for example.test.

This guide covers the substitution error and the keyboard layouts a generator models, why this family is the largest of the character-level patterns, how the checker ranks its members, and what a registered neighbour-key name usually is.

Family in a report: Keyboard substitution
Sample: ezample.test
Candidates for a six-letter domain: 175 of 3,001

What a keyboard substitution is

Replace one character with one of its physical neighbours on a keyboard. Each position of a six-letter label has several neighbours, so the family runs to 175 candidates for example.test, by far the largest of the character-level families. The generator models the QWERTY layout, which is what most brand traffic is typed on; a name that is typed mainly on other layouts has other neighbours, and a check cannot know which keyboard a visitor used.

A separate family, lookalike characters, substitutes a character that looks similar rather than one that sits nearby. That family has its own guide.

Why the substitution happens

It is the fourth of Damerau's single errors, the substitution, and on a keyboard the substituted character is almost always a neighbour. On a phone the neighbourhood is different and smaller, and autocorrect catches many of these in a text but not in an address bar. The visual result is a word with one wrong letter that keeps its length and shape, which is why it passes a glance.

How many candidates it produces

175 candidates for a six-letter .com. Their size makes this the family a brand cannot practically register in full and the one where monitoring earns its keep: a check resolves all 175 and reports the ones that exist.

Domain	Substitution	Candidates for a six-letter label
example.test	ezample.test	175
example.test	exanple.test	included in the 175
example.test	exampke.test	included in the 175

What a registered substitution usually is

Registered members of a large family are mostly parked or forgotten. Unit 42's December 2019 count found 13,857 squatting domains registered in one month, 450 a day, across every family; 18.59 percent were classified malicious, which leaves most of them doing something else. The row tells you which kind you have: the registration date, whether an address answers, whether mail is routed, whether a certificate has been issued.

How the checker finds and ranks it

A finding's review priority is a published rule, not a score. A name with an address or a mail record is active; active names registered under 90 days ago are Elevated, and so are active names under a year old that carry an impersonation keyword. Anything else that is active or has a registry record is Review, a name with no registry record and no DNS answer is Low signal, and a lookup the registry refused stays Unknown rather than being counted as a negative.

A single substitution is one edit from the real name, the nearest band. Sorted by distance, a report interleaves these with omissions, insertions and transpositions.

What to do with one

Watch the family as a whole rather than trying to own it. Act on the row that is recent, active and mail-routing, with the report as evidence. Never load the name.

Common questions

Which keyboard layout does the checker use?: QWERTY, the layout most brand traffic is typed on. Neighbours on other layouts are not generated, and a check cannot know which keyboard a visitor used.
Why is this family so much larger than transposition?: Every position has several neighbouring keys, while a transposition has only one partner per adjacent pair.
Is a keyboard substitution the same as a homoglyph?: No. A substitution uses a key that is physically nearby; a homoglyph uses a character that looks similar. The homoglyph guide covers the second.
Can I register all 175?: You can, at a cost that rarely makes sense. Watching them costs less and catches the day one of them turns active.