LúminaKite

Technical guide

What is typosquatting and how do you detect it?

Typosquatting registers or uses names that exploit likely typing mistakes. Detection combines language, keyboard models, and technical signals.

LuminaKite Security TeamPublished: 6 min read

The problem

A user may mistype a domain while signing in, paying, or contacting support. An attacker can use that route to imitate a page, collect data, or receive misdirected email.

Risks and assumptions

Credential theft through imitation pages.

Payment diversion and customer fraud.

Email intended for the company arriving at a typo domain.

Procedure

Model human mistakes

Include missing, doubled, swapped, and adjacent-key characters.

Review homographs and IDNs

Normalize punycode and compare visually similar characters carefully.

Look for added trust terms

Brand plus login, support, or billing may be as effective as a typo.

Prioritize activity

DNS, MX, certificates, and visible content increase review priority.

Limits of a manual approach

Low edit distance does not prove abuse.

Naive generators produce too many irrelevant variants.

Intent attribution needs more context than technical metadata.

Example

Swapping adjacent letters preserves a familiar shape and mirrors a common typing error. If the variant also publishes MX, it could receive accidentally addressed mail.

Common mistakes

Testing only one-character substitutions.

Ignoring domains with added words.

Blocking domains internally without recording the reason.

Recommendations

Watch the most plausible variants over time.

Teach users to verify domains and use password managers.

Apply reviewed evidence to mail and browsing controls.

Frequently asked questions

Are typosquatting and homograph attacks the same?

No. One exploits typing mistakes; the other uses visually similar characters, though they can overlap.

Is registering a similar domain illegal?

That depends on jurisdiction, use, and trademark rights and requires legal assessment.

How does a password manager help?

It normally will not autofill on a different domain, creating a useful warning signal.

Detect new typo domains

Move from a one-time list to ongoing monitoring of variants and activity signals.

Explore the module

Related content