Is a transposed domain always typosquatting?

No. Some are defensive registrations by the brand, some are parked by speculators, and a few are unrelated businesses whose name happens to be a transposition of yours. The registration record and the DNS evidence separate the cases; the name alone does not.

How many transpositions does a domain have?

One per adjacent pair of characters in the registrable label, so a six-letter label has five, and the generator adds hyphen variants where they produce a distinct name. The checker resolves every one.

Why do transpositions get past spellcheck?

Every letter of the intended word is present; only two are in the wrong order. Browsers do not reorder what you type into the address bar.

Should I register the transpositions of my own domain?

The handful nearest to your name, yes, if they are available and cheap; they are the ones people mistype. Watching the rest costs less than owning them, and the defensive registration guide works through the trade-off.

PATTERNS

Transposition Typosquatting: Two Letters Swapped

Of every character-level pattern, the swap is the one most people have made themselves. That is exactly why it is registered. Illustrative lookalikes in this guide use the reserved .test ending, so that no real registration is named.

by Typosquatting.ai Research23 September 20265 min read

Transposition typosquatting registers a domain in which two neighbouring characters of a real name have changed places, so that exmaple.test stands in for example.test.

This guide covers why transpositions are among the most common typing errors, how many candidates the pattern produces for a domain, what a registered transposition usually turns out to be, how the checker finds and ranks one, and the response that fits the evidence.

Family in a report: Transposed characters
Sample: exmaple.test
Candidates for a six-letter domain: 6 of 3,001

What a transposition is

Take any two characters that sit next to each other in a domain label and exchange them. For a six-letter label that gives five candidates, one per adjacent pair, and the checker adds the variant with a hyphen removed or inserted where that produces a distinct name. Each candidate is then resolved over DNS and searched for in certificate transparency logs; only those that exist reach the report.

The mistake is a timing error between two fingers rather than a wrong key, which is why it survives autocorrect on the keyboard and spellcheck in the browser: both letters are right, only their order is wrong, and an address bar does not correct order.

Why the swap is so common

Frederick Damerau's 1964 study of spelling errors in an information retrieval system found that more than 80 percent of misspellings were a single error of one of four kinds: one letter inserted, one deleted, one substituted, or two adjacent letters transposed. The transposition is the only one of the four that leaves every letter of the intended word present, which makes it the hardest to notice on a second glance.

Speed makes it worse. The faster a name is typed, the more often the second of two letters lands before the first, and a familiar brand is typed fast.

The four Damerau error types are the four character-level families in this cluster: omission, insertion, substitution and transposition. Repetition is a special case of insertion.

How many candidates it produces

For a six-letter .com the generator yields six transposition candidates out of 3,001 in total, one of the smallest families. Small is not the same as safe: a family with few members is one an attacker can register completely, and the checker resolves every one of them rather than a sample.

The table of every family and its count is in the examples guide.

Domain	Transposition	Candidates for a six-letter label
example.test	exmaple.test	6
example.test	examlpe.test	included in the 6
example.test	xeample.test	included in the 6

What a registered transposition usually is

Three things register transpositions: the brand itself, defensively; a speculator who parks the name and serves advertisements to mistyped traffic; and a phishing operator who wants a name that reads correctly in an email at a glance. The registration record separates them better than the name does. A transposition that shares your registrar and nameservers is tagged Possibly yours. One created in the last few weeks with an address and a mail record is the one to read first.

Similarity is not proof of intent. A transposition of a short, common word can be an unrelated business, and the report says so rather than calling the owner a squatter.

How the checker finds and ranks it

A finding's review priority is a published rule, not a score. A name with an address or a mail record is active; active names registered under 90 days ago are Elevated, and so are active names under a year old that carry an impersonation keyword. Anything else that is active or has a registry record is Review, a name with no registry record and no DNS answer is Low signal, and a lookup the registry refused stays Unknown rather than being counted as a negative.

Transpositions carry a distance of two edits from the real name, so they wear the nearest distance band in a report and sort to the top when the table is ordered by closeness.

What to do with one

Read the row before deciding. If it is yours, tag it Owned and the ledger remembers. If it is dormant, delegated but without an address, watch it: a dormant transposition that gains a mail record is the change an alert rule should catch. If it is active, carries a certificate and was registered recently, keep the report as evidence and follow the response guide: registrar abuse first, host second, a UDRP only when the record supports bad faith.

Do not visit it. The report already holds the registration, DNS and certificate evidence, which is what a registrar or host asks for.

Common questions

Is a transposed domain always typosquatting?: No. Some are defensive registrations by the brand, some are parked by speculators, and a few are unrelated businesses whose name happens to be a transposition of yours. The registration record and the DNS evidence separate the cases; the name alone does not.
How many transpositions does a domain have?: One per adjacent pair of characters in the registrable label, so a six-letter label has five, and the generator adds hyphen variants where they produce a distinct name. The checker resolves every one.
Why do transpositions get past spellcheck?: Every letter of the intended word is present; only two are in the wrong order. Browsers do not reorder what you type into the address bar.
Should I register the transpositions of my own domain?: The handful nearest to your name, yes, if they are available and cheap; they are the ones people mistype. Watching the rest costs less than owning them, and the defensive registration guide works through the trade-off.