Typosquatting: How to Detect Domains Copying Your Brand

Typosquatting is the practice of registering a domain name that closely resembles a legitimate one, usually to capture users who mistype a URL or misread a link. Attackers use it to harvest credentials, deliver malware, intercept email, and impersonate brands. The registrations are cheap, the volume is high, and most of them never announce themselves. Detecting them is a data problem, not a legal one, and the data you need sits in DNS records, certificate transparency logs, and registration histories.

This chapter covers how attackers generate lookalike domains, what large-scale measurement actually shows about them, and a repeatable workflow for finding the ones that target your brand. It also covers where registration data falls short, because knowing the blind spots matters as much as knowing the method.

How Attackers Generate Typosquatted Domains

Lookalike domains are not invented by hand. Attackers run your domain through generation algorithms that produce thousands of candidates, then register the ones that are available and plausible. Understanding the generation techniques tells you what to look for, because each technique produces a different shape of domain.

Academic measurement work published at IFIP Networking 2025 grouped these into eight techniques. The Squatspotting study applied all eight to 721 domains from the Tranco top 1,000 and probed the results against a corpus of 3.3 billion DNS records.

The distribution matters for prioritisation. Edit distance 1 combined with TLD-squatting produced by far the largest set of resolving domains in that study, at 1,135,578, followed by combo plus TLD-squatting at 612,227. The three hybrid techniques together accounted for over 75% of everything found. Pure sound-squatting produced almost nothing, with 52 resolving domains.

The practical takeaway is that a monitoring programme checking only single-character misspellings of your .com is watching the smallest part of the problem. Hybrid patterns, particularly a small spelling change paired with a different TLD, are where the volume actually sits.

What the Data Shows About Lookalike Domains

Most guidance on this topic treats every lookalike registration as an active attack. Large-scale measurement does not support that, and the difference changes how you should triage.

The Squatspotting study identified 2,305,556 distinct typosquatting domains that were registered and resolved to an IP address, generated from just 721 popular domains. Of those, domains flagged as malicious by Google SafeBrowsing accounted for 3,727, or 0.16%. A further 2,012 were classified as malicious through infrastructure correlation, bringing the total to roughly a quarter of one percent.

The bulk of the population falls elsewhere. Around 311,000 were parked pages serving ads or soliciting purchase offers. Another 230,390 were legitimate unrelated businesses whose names happened to resemble a popular domain. Only 10,575 were defensive registrations held by the brand owner itself.

The largest single category is the quietest one. Over 1.1 million domains, 48% of the total, returned no HTTP response at all. A registered lookalike domain that serves no web page is not harmless and it is not yet an attack. It is inventory. Attackers register in bulk and activate later, which is why detection at registration time is worth more than detection at attack time.

This reframes the job. You are not looking for a small number of obviously malicious sites. You are looking at a large population of mostly dormant registrations and deciding which few deserve attention.

How to Find Lookalike Domains Targeting Your Brand

This workflow moves from a wide candidate list to a short list worth acting on. Each step removes domains that do not warrant attention, so the expensive checks only run against a small remainder.

Step 1: Generate the candidate set. Start from your primary domain and produce variants across all eight techniques, not just simple misspellings. Cover character insertions, deletions, substitutions and transpositions, alternate TLDs, appended words such as "login", "secure", "pay" and "support", and combinations of a spelling change with a different suffix. The typosquatting lookup tool generates these permutations for a domain you supply.

Step 2: Keep only what resolves. Most generated permutations were never registered. Query each candidate for an A record and discard everything that does not resolve. A DNS lookup confirms whether a candidate points at live infrastructure. This is the step that turns thousands of theoretical variants into a working list, and it is also the step that separates a dormant registration from one with a server behind it.

Step 3: Pull registration details on what survived. For each resolving candidate, retrieve the registration record: creation date, registrar, registrant details where available, and nameservers. A WHOIS lookup returns these fields. Registration age is the strongest single triage signal. A domain resembling your brand that was registered in the last thirty days deserves attention ahead of one registered six years ago.

Step 4: Check for a certificate. A lookalike domain with a valid TLS certificate is being prepared for use, because a browser warning defeats the purpose of impersonation. An SSL certificate lookup shows whether a certificate has been issued and by whom. Certificate issuance is often the earliest reliable indicator that a dormant registration is about to become active.

Step 5: Check the mail configuration. A domain with MX records configured but no website is usually set up to receive email rather than serve pages. For a lookalike of your domain, that pattern points at invoice fraud or credential collection through replies rather than at a phishing page. This check catches a category the web-focused checks miss entirely.

Working through these five steps by hand is reasonable once. Doing it continuously across a domain portfolio is not, which is where brand monitoring replaces the manual pass with scheduled checks and alerting on new registrations.

How Many Lookalike Domains Target a Real Brand

Numbers from a research paper describe the problem in aggregate. The more useful question for a security team is narrower: how many lookalike domains exist right now for one specific brand name.

The WhoisFreaks typosquatting checker answers that directly. It generates every common typo, lookalike, and homoglyph variant of a keyword, then checks each one against a database of 936.4M+ registered domains across 1,529 TLDs, of which 683.7M+ are currently active. Every match returns the registration record and DNS records, so the output is not a count but a working list.

Here is what five heavily impersonated brands return.

Source: WhoisFreaks domain typosquatting checker, queried 21 August 2026. Each figure is the count of registered domains matching generated typo, lookalike, and homoglyph variants of the brand keyword across all tracked TLDs. Counts change daily as domains are registered and dropped, so the linked pages will show current figures rather than these.

Two things stand out. The first is the floor: no brand here returns fewer than 1,278 registered lookalikes, averaging roughly 1,700 across the five. A defensive registration programme covering twenty or thirty variants is not addressing a problem of this size.

The second is that brand prominence does not set the number. PayPal returns fewer lookalikes than Apple despite being one of the most phished brands on the internet, and Microsoft returns fewer than Amazon. Name length, spelling, and how many plausible variants exist matter more than how well known the company is. A short, commonly misspelled brand name generates a larger candidate space than a long distinctive one, whatever its market cap.

What the results actually look like

Counting is the least interesting part. Running the Microsoft query returns rows like these:

Read those four rows against the triage method above and the differences matter. m-crosoft.com was registered in 2004 and is paid up to 2027, which is the profile of a long-held defensive or parked asset rather than an active threat. m-icrosoft.net expired in 2014 and has never been observed resolving. m0crosoft.site is the one worth attention: a digit-for-letter substitution on a cheap TLD, registered in 2024, seen resolving in 2025.

That is the whole argument for working from data rather than counts. The number tells you the scale of the candidate space. The registration and DNS fields tell you which four or five of those 1,365 deserve an analyst's time this week.

Doing this for one brand runs in a browser. Doing it across a portfolio on a schedule is a different engineering problem, with its own signals and thresholds, covered in how typosquatting and homoglyph attacks are detected at scale.

Where Registration Data Falls Short

Any honest account of this method has to state what registration data cannot tell you, because building a detection programme on an assumption that does not hold produces silent gaps.

Registration records are incomplete for exactly the domains you care about most. The researchers behind the Squatspotting study built their classification on nameserver and DNS data rather than registration records, and stated their reason directly: records were found for under half of their candidate domains, and many of those that existed were private. Privacy protection services mean registrant name and email are frequently redacted.

Three consequences follow.

Registrant identity is not a reliable pivot. Correlating domains by registrant email works well when the field is populated, and fails silently when it is not. Treat a match as strong evidence and a non-match as no evidence, rather than as an all-clear.

Nameservers are the more dependable signal. They are public, they are always present for a resolving domain, and they cluster. Attackers registering in bulk tend to reuse infrastructure, so a nameserver shared across several lookalikes of your brand is a stronger indicator than any individual registration record.

Creation date carries the most weight per field. It is nearly always present, it is hard to falsify, and it maps directly to the risk question you are asking. Sort by it first.

What to do with a confirmed malicious lookalike

Document before you act. Capture the registration record, DNS configuration, certificate details, and a page capture, all with timestamps, before anything changes. Registrations get updated and pages get taken down, and evidence gathered after the fact is weaker.

Then choose a route. A domain hosting a phishing page can be reported to the hosting provider and the registrar, which is usually the fastest path to removal. A domain registered in bad faith against a trademark you hold is a UDRP matter, which is slower but transfers the domain rather than just disabling it. A parked domain with no active abuse often warrants monitoring rather than action, since roughly a quarter of one percent of the measured population showed actual malicious behaviour.

An attacker registering a lookalike of your domain is a different problem from an attacker taking control of your actual domain. For the second scenario, see domain hijacking.

Frequently Asked Questions

What is the difference between typosquatting and cybersquatting?

Typosquatting registers misspellings and near-variants of a domain to catch users who mistype or misread it. Cybersquatting registers a domain containing an exact trademark, usually to resell it to the brand owner. Typosquatting targets user error. Cybersquatting targets the trademark itself.

How quickly should a new lookalike domain be reviewed?

Review new registrations within days rather than weeks. Attackers commonly register domains in bulk and activate them later, and certificate issuance or a change in DNS configuration is often the first sign a dormant registration is being prepared for use.

Can I find typosquatted domains without a paid tool?

Yes, for a single domain. Generate variants, check which resolve in DNS, then pull registration details on the survivors. The limitation is repetition rather than capability, since the same checks across a portfolio on a daily schedule is more work than manual review supports.

Does a privacy-protected registration mean a domain is malicious?

No. Privacy protection is standard on a large share of registrations and is not evidence of intent. Use it as a reason to weight other signals more heavily, such as registration age, nameserver overlap with known lookalikes, and whether a certificate has been issued.

Are most lookalike domains actually dangerous?

No. In the Squatspotting measurement of 2.3 million resolving lookalike domains, those showing malicious behaviour accounted for roughly a quarter of one percent. Most were parked, dormant, or unrelated legitimate businesses. Triage by signal strength rather than treating every match as an incident.