Typo patterns
How typosquatting works
Typosquatting is registering the domains people reach by mistake when they try to reach yours. Here is how those mistakes happen, and what squatters do with them.
One wrong letter, a different owner
A domain name is exact. example.com and exmaple.com are as unrelated as two names can be: different registrations, different owners, different servers. A browser doesn't know which one you meant.
Squatters register the variants that people are most likely to reach by accident, or that look most like the real thing in a link. Every visitor who lands there is one you lose, and some of them hand over a password or an email on the way.
Someone types
exmaple.comThe five families
Five patterns behind every lookalike
Each pattern page explains one family in depth, with live examples you can try on your own domain.
- 01
Common mistakes
Skipped letters, swapped letters and fat-fingered keys.
example.comexmaple.com- Missing letter
- Swapped letters
- Neighbouring key
- Extra keystroke
- Double letter
- Wrong vowel
- Plural
- Hyphen
- Dot slip
- 02
Homoglyphs
Characters that look the same but aren't: rn and m, 0 and o.
example.comexamp1e.com- Look-alike
- Other alphabet
- 03
TLD confusion
The right name on the wrong ending: .co, .cm, .om.
example.comexample.co- Wrong ending
- 04
Combosquatting
Your name plus a word like login, support or pay.
example.comexample-login.com- Brand + word
- 05
Bitsquatting
A single flipped bit in memory sends the request elsewhere.
example.comexampme.com- Bit flip
What squatters do
Where the traffic goes
A typo domain is cheap to register. These are the ways it pays.
Parked ads
The most common use. The domain shows a page of pay-per-click ads, often for your competitors, and earns from every visitor who mistyped.
Phishing
A copy of your login or checkout page on a name one letter off. Look-alike names are sent in emails and texts, where they pass a quick glance.
Email interception
A typo domain with a mail server receives every email someone misaddresses to it: invoices, password resets, contracts.
Resale and redirects
Some are held to sell back to the brand. Others bounce visitors through redirect chains to scams or malware.
Defence
Protecting your name
- 1
Scan your domain
See the likely variants and which ones are already registered. Start with high-likelihood names and any that receive email.
- 2
Register the likely ones and redirect them
A handful of names covers most real traffic. Point each one at your site with a permanent (301) redirect so the visitor still arrives.
- 3
Watch what you can't register
Check registered look-alikes from time to time, especially any with mail servers, and warn your customers about the ones used for phishing.
- 4
Take back the abusive ones
For names registered in bad faith against your trademark, ICANN's UDRP (and the equivalent policies of many country registries) lets you ask for them to be transferred.
Start with your own domain
Every pattern, scored and checked for registration, in one scan.