Domain security
Typosquatting protection: audit your domains
Audit the domains you own, find the lookalikes others registered, and decide what to buy, watch or hand to counsel.
Key takeaways
- You cannot protect domains you have not listed, so inventory comes first.
- Lookalikes use misspellings, other endings and lookalike characters.
- Certificate Transparency logs show new certificates that use your name.
- Register a short list of high-risk variants, not every possible typo.
- UDRP complaints and ACPA suits are work for counsel, not marketing.
Typosquatting protection means finding and limiting domains that imitate your brand. Start with an audit of every domain you own, then check misspellings, swapped or lookalike characters and other top-level domains for live registrations. Register the few that matter most, monitor the rest, and leave UDRP complaints and ACPA suits to counsel.
What is typosquatting?
Typosquatting is registering a domain that a person can mistake for yours: a misspelling, a swapped letter, an extra word or the same name under a different ending. The FBI has warned that spoofed sites often use "an alternate spelling of a word" or "an alternative top-level domain", and that criminals use them to collect usernames, passwords and other personal data.[1]
Definition
A lookalike domain is any domain built to be confused with a real brand's domain, through misspelling, a different top-level domain, added words or characters from another alphabet that look the same on screen.
Lookalike characters deserve a mention of their own. Unicode's security standard gives the example of "paypal" written with a Cyrillic "a" that looks identical to the Latin one.[2] To a reader the two addresses are the same; to a browser they are different domains.
Why do lookalike domains hurt B2B?
B2B deals run on email, invoices and logins shared between companies, so a lookalike domain is a ready-made way to impersonate you to customers and suppliers. A message from a domain one letter off your own can ask for a changed bank account, a password reset or an urgent payment approval. Our guide to executive impersonation attacks covers how those requests are framed.
Email authentication such as SPF, DKIM and DMARC protects the domains you own. It does nothing for a domain someone else registered, which is why a lookalike review belongs next to your anti-phishing brand protection work.
What goes into a domain portfolio audit?
A domain portfolio audit is a complete list of what you own, who controls it and what it points to. Build it from registrar accounts, invoices and DNS records, not from memory.
| Check | What to record |
|---|---|
| Ownership | Registrar, account holder, the legal entity named on the domain |
| Renewal | Expiry date, auto-renew status, payment card on file |
| Access | Who can log in, whether multi-factor authentication is on |
| DNS | Where each record points, and whether you still control that host |
| Use | Live site, redirect, parked, email only or unused |
Two quieter risks sit inside this list. The first is the forgotten subdomain: a campaign or test site whose DNS record still points to a cloud resource you no longer hold, which someone else can claim. Our guide to subdomain takeover explains that gap. The second is the expired domain still named in old email footers, documents or code, which anyone can register once it lapses.
For the domains that matter most, add registrar and registry locks. See DNS and registry locking.
Who is using a domain that looks like yours?
The free brand risk check asks six yes or no questions on email authentication, domains, company accounts and leavers. Your answers stay in your browser.
How do you find lookalike domains?
Start from your main brand names and product names, then check common variant patterns for live registrations:
- Misspellings: a missing, doubled or swapped letter.
- Other endings: the same name under other top-level domains, including country codes where you sell.
- Added words: your name plus "login", "support", "invoice" or a region.
- Lookalike characters: letters from other alphabets, or a digit that resembles a letter.
Open-source variant generators can produce these lists, and a DNS lookup shows which variants exist. For each live one, note whether it has a website, mail records or a parking page, without entering any data on it.
Certificate Transparency adds an early signal. It publicly logs TLS server certificates as they are issued, so anyone can audit what certificate authorities have signed.[3] A watch on those logs for certificates containing your brand name can show a lookalike site before it is used against your customers.
Which lookalikes should you register?
A short list, not every typo. Registering every variant is expensive and still leaves gaps, because the number of possible combinations is open-ended. Prioritize:
- Variants of your main domain under the endings where you sell.
- One-letter misspellings of the domain your customers type most.
- Variants that combine your name with payment or login words.
Register defensively only against your own marks. Registering variants of another company's brand exposes you to the same dispute and court claims described below.
What can you do about a hostile domain?
Collect evidence first: screenshots, the registration date, mail records and any messages sent from it. Then escalate along two tracks.
Abuse reports. Where a domain is used for phishing, you can report it to the registrar and the hosting provider through their abuse contacts. Our domain takedown procedures guide covers what to include.
Legal routes. Under ICANN's Uniform Domain Name Dispute Resolution Policy (UDRP), a complainant must show three things: the domain is identical or confusingly similar to its mark, the holder has no rights or legitimate interests in it, and it was registered and is being used in bad faith.[4] The only remedies are cancellation or transfer.[4] WIPO is one of the dispute providers, and notes that the UDRP applies to all domain names in generic top-level domains such as .com, .net and .org.[5]
In the US, the Anticybersquatting Consumer Protection Act, 15 U.S.C. 1125(d), makes a person liable who, with a bad faith intent to profit from a mark, registers, traffics in or uses a domain that is identical or confusingly similar to it.[6] The owner may elect statutory damages of "not less than $1,000 and not more than $100,000 per domain name, as the court considers just."[7]
UDRP complaints and ACPA suits are filed by counsel or specialist firms that you contract with. We do not file takedowns or legal actions.
How do you keep watch after the audit?
Make the audit a standing process with named owners:
- Keep the inventory in one place, with an owner for each domain and its renewal date.
- Run Certificate Transparency alerts and periodic lookalike checks for your main names.
- Route suspected lookalikes to security and legal through one shared queue.
- Repeat the full audit after any rebrand, acquisition or launch.
Our domain security service covers the inventory, lookalike checks and renewal hygiene as part of our digital asset security work.
Sources
- Spoofed FBI Internet Domains Pose Cyber and Disinformation Risks (I-112320-PSA)
- Unicode Technical Standard #39: Unicode Security Mechanisms
- RFC 9162: Certificate Transparency Version 2.0
- Uniform Domain Name Dispute Resolution Policy
- Domain Name Disputes
- 15 U.S. Code 1125: False designations of origin, false descriptions, and dilution forbidden
- 15 U.S. Code 1117: Recovery for violation of rights
Written under our Editorial and AI Policy. Sources checked 19 Oct 2026. Reviewed by DGo Digital on 19 Oct 2026.
FAQ
Questions about typosquatting
Run a full inventory and lookalike review at least once a year, and again after a rebrand, an acquisition or a major product launch. Between audits, keep continuous watches running, such as Certificate Transparency alerts for your brand name, so new lookalikes show up when they are created rather than months later.