Typosquatting: what it is, how it works and how to defend your brand

You type your own web address a little too fast, drop a letter, and land on a page that looks like yours but is not. Or a customer receives an email from a domain almost identical to yours, with an invoice to pay to a new bank account. Typosquatting lives in exactly that gap: one keystroke between the name you have built and a copy someone else registered to profit from it. This guide explains what it is, the forms it takes, and how to build a proportionate defence without spending a fortune on domains you will never use.

What typosquatting is

The word blends typo and cybersquatting. It describes registering domain names that reproduce a known brand or site with small variations, betting that a share of users will land there by mistake or fail to notice the difference.

People do it for four main reasons:

• Monetising traffic: parked pages with ads, redirects to affiliates or competitors.
• Phishing and fraud: clone sites that harvest credentials or card data, or divert payments.
• Resale: the domain is offered back to the rightful owner at an inflated price.
• Reputational damage: criticism pages, embarrassing content, malware tied to your name.

Lost traffic is the smaller problem. A single phishing campaign run from a domain resembling yours can cost far more than years of defensive registrations, in refunds, support load and eroded trust.

The variants you need to know

Typosquatters do not work at random. They generate the most probable permutations with automated tools. Knowing them helps you decide what to cover.

Variant type	Example on "namesapiens.com"	How it arises
Omission	namesapens.com	a dropped letter
Transposition	namesaipens.com	two letters swapped
Adjacent-key substitution	namesapiems.com	a neighbouring key
Doubling	namessapiens.com	a repeated letter
Vowel swap	namesapiuns.com	similar-sounding vowels
Homograph	nameسapiens.com (non-Latin characters)	visually identical letters from other scripts
Hyphenation	name-sapiens.com	hyphen added or removed
Alternative TLD	namesapiens.co, namesapiens.it, namesapiens.net	same name, different extension
Deceptive subdomain	namesapiens.com.login-verify.net	your name used as a subdomain of another domain
Added word	namesapiens-support.com, namesapiens-login.com	a reassuring suffix

Two categories deserve special attention. Homographs exploit internationalised domain names (IDNs): a Cyrillic "a" is indistinguishable from a Latin "a" in many browsers' address bars, yet identifies an entirely different domain. And alternative TLDs are the most common case of all: .co instead of .com, or the .it that an Italian company never registered because it only uses .com.

Before: preventive defence

The good news is that the best defence is built when you choose the name, not afterwards. Some names are structurally more exposed than others.

Pick a robust name

Long names, double letters, ambiguous vowel sequences and "creative" spellings (Flickr, Tumblr) are a gift to typosquatters because users genuinely misspell them. A short, pronounceable name with a single plausible spelling shrinks the attack surface. If you are still weighing alternatives, this criterion matters as much as whether the .com is available.

Cover the variants that matter

You do not need a hundred domains. You need the ones with a real chance of being typed or weaponised against you:

1. The main TLDs in your market: .com and .it for an Italian business, plus .eu if you operate across Europe. NameSapiens' quick check across 12 extensions shows at a glance which are still free.
2. The 3-5 most likely misspellings of your main name, especially if it has double letters or easily swapped pairs.
3. Hyphenated and unhyphenated versions, if the name is made of two words.
4. The service suffixes most sensitive in your sector: -login, -support, -pay, if you handle accounts or payments.

Every defensive domain should redirect to your main site and, crucially, carry restrictive SPF and DMARC records even though it never sends mail. A defensive domain without DMARC can still be used for spoofing.

Register the trademark

A defensive domain protects one variant. A registered trademark protects the name in all its confusingly similar forms, and gives you the legal standing to act when a typosquatter shows up anyway. Without a mark, procedures such as the UDRP or .it reassignment become much harder to win.

During: monitoring

However well you cover the ground, someone will eventually register a variant you did not anticipate. The realistic goal is not to prevent it but to detect it in hours rather than months. Three sources are decisive.

New domain registrations. Monitoring services generate permutations of your name and periodically check zone data for new matches. This is the baseline.

Certificate transparency. Every TLS certificate issued by a public Certificate Authority is recorded in publicly searchable logs. A typosquatter preparing an HTTPS phishing site, which is now the norm, leaves a trace the moment they request the certificate, often days before the page becomes visible. Watching CT logs for your name and its variants is one of the earliest signals available, which is why NameSapiens' brand protection plans include it alongside similar-trademark, social and marketplace monitoring.

Customer reports. Make it easy to report suspicious emails or sites: a dedicated address, a page explaining how to recognise your official communications. The first person to spot a clone is often a customer.

After: what to do when you find one

Once you find the domain, resist the urge to email the registrant straight away. Work through it in order.

1. Document

Save dated screenshots of the site, the WHOIS output (even when privacy-masked, the registrar and dates remain visible), DNS records and, if there was an email campaign, full message headers. Without evidence, every subsequent step is weaker.

2. Triage severity

• Active phishing or fraud: maximum urgency. Report to the host and registrar (abuse@), to browser safe-browsing services and, if there are victims, to law enforcement. The goal is rapid takedown, not domain recovery.
• Parked with ads or redirecting to competitors: moderate harm but bad faith is often evident. A good candidate for a recovery procedure.
• Dormant domain: weigh the opportunity cost. You might buy it, or simply keep watching it.

3. Choose the recovery route

For gTLDs (.com, .net, .org and the new extensions) the route is the UDRP, which requires showing identity or confusing similarity with your mark, the registrant's lack of rights, and registration and use in bad faith. For .it domains there is the Registro .it reassignment procedure through accredited PSRD providers; for .eu domains, EURid's ADR. In every case you need a right in the name, ideally a registered trademark. Typosquatting on a trademark is among the most straightforward cases to win, because the similarity is the very essence of the wrong.

Alternatively, where bad faith cannot be proven or the registrant is simply a domainer who picked up a plausible word, an anonymous acquisition through an intermediary stops the price from jumping the moment the seller realises who is asking.

This is general information, not legal advice: where fraud is ongoing or damages are significant, consult a professional.

A proportionate plan

In summary, a sensible anti-typosquatting defence for a small or mid-sized business looks like this:

• a name chosen partly for its resistance to misspelling;
• the trademark registered in the relevant classes;
• 5-15 defensive domains (main TLDs and likely variants), all redirected and DMARC-protected;
• continuous monitoring of new registrations and TLS certificates;
• a written internal procedure for what happens when an alert fires.

All of this costs a fraction of a single incident. And if it sounds like a lot to manage, the Sapi assistant can generate the list of variants worth covering from your name and your market's TLDs, so you at least start with a clear map of what is missing.