Typosquatting is the registration of domain names that imitate a brand’s real domain closely enough that a person typing quickly, reading an email, or glancing at a link will not notice the difference. It is one of the oldest abuses in the domain name system and one of the most persistent, because a variant costs a few dollars and the payoff ranges from parked advertising revenue to a successful wire-fraud scheme. This guide defines typosquatting, explains what the variants are used for, reviews the research on its scale, and sets out how to protect against typosquatting through legal remedies, detection, prevention and email controls. It is part of our domain name security guide and pairs with the broader lookalike domains guide.
What typosquatting is
A typosquatted domain is generated from a target domain by a predictable transformation. The simplest is a misspelling: transposed, missing or doubled letters. Keyboard-adjacent substitutions replace a character with one next to it on a standard keyboard, so that a brand with an “o” acquires a variant with an “i” or a “p”. Omitted punctuation turns a hyphenated name into a run-together one. Wrong-TLD variants keep the brand spelled correctly but place it in a different extension, so that a .com brand is imitated in .co, .net or one of the hundreds of newer extensions. The most deceptive class is the homoglyph (a character that looks like another, such as a capital I for a lowercase l, or a Cyrillic letter rendered identically to its Latin counterpart in an internationalized domain name), which can produce a variant that is visually indistinguishable from the original in many fonts.
Typosquatting is a subset of cybersquatting, the broader practice of registering a domain that trades on someone else’s mark. What distinguishes it is the reliance on error.
What typosquatted domains are used for
The original business model was advertising: a user mistypes a popular address, lands on a parked page of pay-per-click links, and the squatter earns a fraction of a cent per click. Moore and Edelman, in a study based on 2009 data, estimated at least 938,000 typosquatting domains targeting the top 3,264 .com sites, an average of 281 typo domains per popular site, and found that 79.4 percent of the typo domains they could classify displayed pay-per-click advertising, according to their paper Measuring the Perpetrators and Funders of Typosquatting. The same study found that ads for the correctly spelled site appeared on 36 percent of typo domains, meaning brands were, in effect, paying to recover their own mistyped traffic.
The uses have since become more dangerous. A typosquatted domain is the natural home for a phishing page that clones a login form and harvests credentials. It can serve malware to visitors who believe they are on a trusted site. In affiliate fraud, the squatter routes mistyped traffic through an affiliate link so the brand pays commission on its own customers. The most expensive abuse requires no website at all. A typosquatted domain with mail configured receives every message that a customer, vendor or employee sends to a mistyped address, which can include invoices, contracts and credentials. In the other direction, the squatter sends email from the lookalike to impersonate the brand in business email compromise, the fraud in which an attacker poses as an executive or supplier to redirect a payment. The FBI’s Internet Crime Complaint Center recorded 21,442 business email compromise complaints with losses of more than 2.77 billion dollars in 2024, according to the FBI 2024 Internet Crime Report. Lookalike domains are a standard ingredient of that fraud.
What the research says about scale
The Moore and Edelman figures above are from 2009 and the parked-advertising model has since declined, so they are best read as a historical baseline. The most current academic measurement applied eight name-generation techniques to 721 popular domains from the Tranco top 1,000 and found more than 2.3 million registered typosquatting candidates resolving to an IP address, of which about 311,000 pointed to parking services and 48 percent did not resolve to any web page, according to the 2025 study Squatspotting: Towards the Systematic Measurement of Typosquatting Techniques. The same study found overtly malicious activity, as flagged by Google Safe Browsing, in only 0.24 percent of candidates. That is not reassurance: a domain that resolves to nothing today can host a phishing page tomorrow, and a domain with no website can still receive mistyped email.
Industry measurement of large brands points the same way. CSC reported that 80 percent of homoglyph domains resembling Forbes Global 2000 brands are owned by third parties, and that 42 percent of those third-party domains had MX records in 2024, up from 40 percent in 2023, according to the CSC 2024 Domain Security Report. An MX record on a lookalike domain has one purpose, which is to handle email.
Phishing data shows where the registrations go. Interisle counted 1,963,390 phishing attacks between May 2024 and April 2025, found that 77 percent of phishing domains were registered maliciously rather than compromised, and found that new generic top-level domains hold 11 percent of the domain market but 51 percent of phishing domains, according to Interisle’s Phishing Landscape 2025. The APWG recorded 892,494 phishing attacks in the third quarter of 2025 alone, according to the APWG Phishing Activity Trends Report for Q3 2025. The inexpensive new extensions that squatters favor are the same ones where brand owners rarely hold defensive registrations.
Legal remedies
Typosquatting has clear legal remedies in the United States and under ICANN policy. The Anticybersquatting Consumer Protection Act (ACPA, 15 U.S.C. 1125(d)) creates civil liability for registering, trafficking in or using a domain name that is identical or confusingly similar to a distinctive mark with a bad-faith intent to profit, and its drafters explicitly contemplated misspellings of famous marks. The statute allows statutory damages of between 1,000 and 100,000 dollars per domain name at the court’s discretion, according to the Senate Judiciary Committee report on the ACPA. Litigation is the right tool when the squatter is identifiable and the brand wants damages or an injunction rather than only the domain.
For most typosquatted domains, the faster and cheaper route is the UDRP (Uniform Domain-Name Dispute-Resolution Policy, the ICANN procedure under which a panel can order a domain transferred to the trademark owner). A UDRP complaint against a typosquatted domain is usually straightforward: the domain is confusingly similar by design, the registrant has no legitimate interest in a misspelling of someone else’s brand, and parking, phishing or mail interception is evidence of bad faith. Our cybersquatting guide explains how panels treat typo variants, and the UDRP hub covers the procedure from complaint to transfer.
Detection
You cannot act against a typosquatted domain you do not know about, and the useful window is the short period between registration and first use. Two data sources cover most of it. The first is new domain registration data, monitored for permutations of your brand across all extensions. The second is Certificate Transparency, the public log of issued TLS certificates, because a phishing page needs a certificate to show a padlock and the certificate request often precedes the page going live. Our DNShield domain name monitoring service watches both sources and reports new lookalikes with their registrar, nameservers and mail configuration, so a domain with MX records goes to the top of the list. The phishing domain monitoring guide explains how to triage what the monitoring finds.
Prevention: defensive registration versus domain blocking
The traditional defense is to register the most likely variants yourself. For a short list of high-probability typos in .com and the brand’s home country extension, defensive registration remains sensible; the domains redirect to the real site and their mail can be forwarded to the right people. The limitation is arithmetic. With eight or more generation techniques and hundreds of extensions, the number of plausible variants runs into the thousands, and no brand can register them all.
Domain blocking services address that gap. Rather than registering each variant, a block instructs participating registries to refuse registration of a protected label across all of their extensions. GlobalBlock covers hundreds of extensions in one subscription, and its GlobalBlock+ tier adds automatic blocking of homoglyph variants, so the brand is protected against the most deceptive class of lookalike without listing each one. NameBlock, BrandLock and AbuseShield apply the same principle across different sets of participating registries, and AbuseShield pairs blocking with abuse response. Each product is described on its own page: GlobalBlock, NameBlock, BrandLock and AbuseShield. Our domain blocking guide compares them with defensive registration on cost and coverage, and the online brand protection hub places both within a wider program.
In practice we recommend both: defensive registrations for the variants that carry real traffic, and a blocking service for the long tail of extensions.
Email controls, and what they do not do
Three email authentication standards are often cited as protection against domain impersonation, and it is worth being precise about what they do. SPF (Sender Policy Framework) publishes which mail servers may send email for your domain. DKIM (DomainKeys Identified Mail) signs outgoing messages so a receiver can verify they were not altered and came from an authorized system. DMARC (Domain-based Message Authentication, Reporting and Conformance) tells receivers what to do when SPF or DKIM fails and sends you reports on who is sending as your domain. Together, at an enforcing DMARC policy, they stop exact-domain spoofing: an attacker cannot send a message that claims to be from your actual domain and have it delivered by a receiver that checks.
They do nothing about a lookalike domain. A squatter who registers a one-letter variant publishes their own SPF, DKIM and DMARC records for that variant, and every check passes, because the message genuinely comes from the domain it claims to come from. The only defenses are human attention and making sure the variant is never registered by anyone else, which brings the problem back to monitoring and blocking. Deploy SPF, DKIM and DMARC on every domain you own, including dormant defensive registrations, which should carry a DMARC reject policy and an SPF record that authorizes no senders. Then treat lookalike domains as a separate problem.
What DNAccess does about typosquatting
DNAccess monitors client brands for typosquatted and lookalike registrations through DNShield, prioritizes the ones configured for email or showing phishing indicators, and pursues them through registrar abuse channels, the UDRP and, where appropriate, ACPA litigation. On the prevention side we provide GlobalBlock, NameBlock, BrandLock and AbuseShield and advise on the right mix of defensive registrations and blocking, as part of our online brand protection service. To find out which variants of your brand are already registered and by whom, contact DNAccess.