Technical guide
What is typosquatting and how do you detect it?
Typosquatting registers or uses names that exploit likely typing mistakes. Detection combines language, keyboard models, and technical signals.
The problem
A user may mistype a domain while signing in, paying, or contacting support. An attacker can use that route to imitate a page, collect data, or receive misdirected email.
Risks and assumptions
Credential theft through imitation pages.
Payment diversion and customer fraud.
Email intended for the company arriving at a typo domain.
Procedure
Model human mistakes
Include missing, doubled, swapped, and adjacent-key characters.
Review homographs and IDNs
Normalize punycode and compare visually similar characters carefully.
Look for added trust terms
Brand plus login, support, or billing may be as effective as a typo.
Prioritize activity
DNS, MX, certificates, and visible content increase review priority.
Limits of a manual approach
Low edit distance does not prove abuse.
Naive generators produce too many irrelevant variants.
Intent attribution needs more context than technical metadata.
Example
Swapping adjacent letters preserves a familiar shape and mirrors a common typing error. If the variant also publishes MX, it could receive accidentally addressed mail.
Common mistakes
Testing only one-character substitutions.
Ignoring domains with added words.
Blocking domains internally without recording the reason.
Recommendations
Watch the most plausible variants over time.
Teach users to verify domains and use password managers.
Apply reviewed evidence to mail and browsing controls.
Frequently asked questions
Are typosquatting and homograph attacks the same?
No. One exploits typing mistakes; the other uses visually similar characters, though they can overlap.
Is registering a similar domain illegal?
That depends on jurisdiction, use, and trademark rights and requires legal assessment.
How does a password manager help?
It normally will not autofill on a different domain, creating a useful warning signal.
Detect new typo domains
Move from a one-time list to ongoing monitoring of variants and activity signals.
Explore the moduleRelated content
Digital impersonation
Brand protection and lookalike domain monitoring
Detect lookalike domains, typosquatting variations, and impersonation signals that may affect customers, employees, and reputation.
Technical guide
How to detect lookalike domains
Identify typos, homographs, and domains combining a brand with trust words, then prioritize technical signs of abuse.