Typosquatting
What is Typosquatting?
Typosquatting is registering a domain that is a misspelling of a trusted one, with a dropped, doubled or swapped letter, a digit in place of a letter, or a different TLD, to catch users' typing errors or fool a quick reader. AdminKit's WHOIS / RDAP lookup shows who registered a suspect domain, and when.
By AdminKit team, Netbase JSC · Updated
Typosquatting relies on people making typing mistakes or reading too quickly. Someone registers a name one slip away from a real one, such as a missing letter, two letters swapped, an extra letter, a key next to the right one, the digit 0 instead of the letter o, or the same label under another TLD, and uses it for phishing pages, credential theft, ad traffic or look-alike email senders. The WIPO overview of UDRP panel views describes the practice in section 1.9: a domain consisting of a common, obvious or intentional misspelling of a trademark is considered confusingly similar to it, and the examples include adjacent keyboard letters and number-letter swaps. Section 1.11 adds that panels normally disregard the TLD when comparing the names.
How is typosquatting different from a homograph attack?
A typo domain is a genuinely different ASCII string, so the evidence is visible on screen to anyone who reads carefully. A homograph attack uses characters from another script that look identical to Latin letters. Under the IDNA framework of RFC 5890 such a name is stored in the DNS as an xn— A-label, a Punycode form that shows the trick, and Unicode Technical Standard #39 catalogues those confusable characters. Typosquatting needs none of that: it uses only letters, digits and hyphens, so script and confusable checks rarely catch it.
AdminKit’s IDN homograph check shows a domain’s Punycode and Unicode forms and flags mixed scripts, non-ASCII characters and a small curated set of confusables, including the classic digit-for-letter swap. For a plain ASCII lookalike, AdminKit’s WHOIS / RDAP lookup shows the registrar, registration and expiry dates, status and nameservers, which tell you how new the domain is and who operates it. Typosquatting is part of AdminKit’s DNS cluster; the full AdminKit glossary lists other related terms.
Frequently asked questions
Is a typo domain the same thing as a homograph domain?
No. A typosquatted domain is a different spelling made from ordinary ASCII letters, digits and hyphens, so a careful reader can see the difference. A homograph domain uses characters from another script that look identical, such as Cyrillic 'а' for Latin 'a', so it can read correctly and still be fake; in the DNS it travels as an xn-- A-label.
What are the common kinds of typo domains?
Omitting a letter, doubling one, swapping two neighbours, hitting an adjacent key, replacing a letter with a similar-looking digit (0 for o, 1 for l), adding or removing a hyphen, and registering the same name under another TLD. WIPO's UDRP overview lists adjacent keyboard letters, similar-looking characters and number-letter swaps among the misspellings panels treat as typosquatting.
Can a brand owner get a typosquatted domain back?
For gTLDs and many ccTLDs the owner of a trademark can file a complaint under ICANN's Uniform Domain-Name Dispute-Resolution Policy (UDRP). WIPO's overview of panel decisions says a common, obvious or intentional misspelling of a trademark is considered confusingly similar to it, though the complainant must still show the registrant has no legitimate interest and acted in bad faith.
Will an IDN homograph checker catch a typo domain?
Usually not. A typo domain built only from ASCII has no Punycode form and no mixed scripts, so a homograph check has little to flag beyond digit-for-letter swaps. Compare the name with your real domain by eye and look up its registration instead.