Typosquatting: Mechanics and Mitigation

Mechanics of Typosquatting

Typosquatting targets users who incorrectly type a website address into their web browser or click a deceptively similar link in an email. The classic attack vectors include:

• Omission: exampe.com instead of example.com
• Transposition: exmaple.com instead of example.com
• Substitution: exanple.com instead of example.com
• Insertion: exxample.com instead of example.com
• TLD swapping: example.co instead of example.com

Detection

Proactive detection requires monitoring certificate transparency (CT) logs and newly registered domains (NRDs). You can use our Typo Generator to create a baseline of domains to monitor.

The Dangers of Homoglyphs

An Internationalized Domain Name (IDN) homograph attack uses characters from different scripts that look visually identical. For example, the Cyrillic small letter "a" (U+0430) looks exactly like the Latin small letter "a" (U+0061). Use our Homoglyph Generator to identify these threats.

Mitigation Strategy

Do not attempt to defensively register every typo. It is mathematically impossible and economically ruinous. Instead:

1. Register only the most common high-risk typos (e.g., top 10 Levenshtein distance 1 variants).
2. Monitor the rest via NRD feeds.
3. Issue UDRP (Uniform Domain-Name Dispute-Resolution Policy) takedowns for domains that display bad faith registration (e.g., setting up MX records).