Repetition Typosquatting: The Doubled Letter
A key held a fraction too long, or pressed twice, produces a name that reads as correct because doubled letters are ordinary in English. Illustrative lookalikes in this guide use the reserved .test ending, so that no real registration is named.
Repetition typosquatting registers a domain in which one character of a real name appears twice in succession, so that exaample.test stands in for example.test.
This guide covers the held-key error behind the pattern, its small candidate count, how it differs from the wider insertion family, how the checker ranks it, and what a registered doubled letter usually is.
- Family in a report
- Repeated character
- Sample
- exaample.test
- Candidates for a six-letter domain
- 7 of 3,001
What a repetition is
Double any one character of the registrable label. A six-letter label gives six candidates, fewer where the label already contains a doubled letter, since doubling either of the pair produces the same name. It is a special case of insertion in which the inserted character equals its neighbour, and it is generated as its own family because it is the insertion people make most.
Why the held key is common
Mechanical keyboards repeat a held key; touch screens register a bounce; and English is full of doubled letters, so a reader does not flinch at one more. Damerau's single-error finding applies: one extra character, one edit. The word still reads correctly at a glance, and the address bar does not object.
How many candidates it produces
Seven repetition candidates for a six-letter .com out of 3,001. The family is small enough for a brand to register completely and small enough for an attacker to do the same; the checker resolves every member.
| Domain | Repetition | Candidates for a six-letter label |
|---|---|---|
| example.test | exaample.test | 7 |
| example.test | exampple.test | included in the 7 |
What a registered repetition usually is
The same three cases as any character-level family: the brand's own defensive registration, a parked speculation on mistyped traffic, or a phishing name chosen to pass a glance. A doubled letter carries no keyword and no ending trick, so its priority rests entirely on the registration record and the DNS evidence: age, address, mail routing, certificate.
How the checker finds and ranks it
A finding's review priority is a published rule, not a score. A name with an address or a mail record is active; active names registered under 90 days ago are Elevated, and so are active names under a year old that carry an impersonation keyword. Anything else that is active or has a registry record is Review, a name with no registry record and no DNS answer is Low signal, and a lookup the registry refused stays Unknown rather than being counted as a negative.
A doubled letter is one edit away and wears the nearest distance band.
What to do with one
Tag, watch, or act, in that order of frequency. The active, recent, mail-routing repetition is the one to file on, with the report as evidence. Do not open it.
Common questions
- Is repetition the same as insertion?
- It is a special case: the inserted character is the same as its neighbour. It is generated separately because it is the insertion people make most often.
- Do doubled letters get noticed?
- Rarely. English has many legitimate doubled letters, so one more does not look wrong at a glance.
- How many repetitions does my domain have?
- One per character in the registrable label, fewer where a letter is already doubled. The checker resolves each one.
- Is a parked repetition dangerous?
- Not on its own. Watch it; the change that matters is a mail record or a certificate appearing.
Sources and further reading
Keep reading in Typosquatting patterns
- Transposition Typosquatting: Two Letters Swapped
- Omission Typosquatting: One Letter Missing
- Insertion Typosquatting: One Letter Too Many
- Keyboard Typosquatting: The Neighbouring Key
- Homoglyph Domains: Letters That Look Alike
- Combosquatting: Your Brand Plus a Keyword
- TLD Squatting: Your Name Under a Different Ending
- Subdomain and Hyphen Lookalikes: ex.ample and ex-ample
- Lookalikes on Hosting Platforms: yourbrand.pages.dev
- Bitsquatting: Domains One Bit Away