Typosquatting Detection: How to Find Lookalike Domains

Typosquatting detection is a two-part job. First you generate or watch for domains that look like yours (misspellings, swapped letters, lookalike characters). Then you investigate each candidate to decide whether it is harmless, parked, or staged for phishing. The first part is mostly automation. The second is where analysts lose hours, and where a fast OSINT workflow pays off.

This guide covers both parts: the patterns attackers use, concrete examples, the signals that separate a dangerous domain from a dull one, and a step-by-step triage routine you can run today.

TL;DR

• Typosquatting means registering a misspelling or lookalike of a legitimate domain to catch mistyped URLs or to impersonate a brand in phishing and malware campaigns.
• Detection starts with generating likely variants (omissions, transpositions, substitutions, homoglyphs) and watching new registrations and certificates for matches.
• A match alone proves nothing. Registration data, DNS, hosting, certificates and linked email addresses decide whether a domain is a threat.
• Detection is continuous, not a one-off scan, because attackers stage infrastructure before a campaign starts.
• You can triage suspects for free with Inquerely, which gives every user up to 30 searches a day with no card or subscription.

Table of Contents

• What typosquatting is, and why detection matters
• Typosquatting examples by technique
• How detection works in practice
• Signals that separate a threat from noise
• A 10-minute triage routine for a suspect domain
• Is typosquatting illegal? Takedown routes
• What we think about typosquatting detection
• Using Inquerely for the investigation step
• Building a continuous program
• FAQ
• Sources

What typosquatting is, and why detection matters

Typosquatting, also called URL hijacking, is a form of cybersquatting that relies on mistakes users make when typing a web address. Microsoft's own explanation uses a simple case: tailspintoy.com standing in for tailspintoys.com, with the final "s" missing.

The risk is wider than a visitor who fat-fingers a URL. Lookalike domains are used for phishing, malware distribution and brand impersonation. The domain is often sent directly to the victim in an email or text message, so nobody has to mistype anything. That is why detection belongs to brand protection, fraud, SOC and threat intelligence teams alike.

Typosquatting examples by technique

Most lookalike domains fall into a handful of families. The examples below are illustrative patterns, the same ones documented in recent academic work, not accusations against any real registrant.

The homoglyph family deserves special attention. Attackers are moving beyond crude typos toward tricks like replacing "m" with "rn" or using Cyrillic characters, designed to survive a quick glance and sometimes even automated checks. If your detection only measures edit distance on plain ASCII, you will miss them. Internationalized domain names appear in DNS in their Punycode form (starting with "xn--"), so decode them before comparing.

How detection works in practice

No single feed catches everything. Effective programs layer several methods, and the overview below follows that logic.

1. Generate variants and check what exists

The most direct method is permutation: take your domain, generate every plausible variant from the families above, and check which ones resolve or are registered. Open-source permutation generators and free public scanners do this well. Run it against your primary domains, your product names and your executives' most-used brand terms.

The limitation is volume. A single short domain can produce thousands of permutations, and most registered ones will be harmless, parked or owned by unrelated businesses with similar names. Generation tells you what exists, not what is dangerous.

2. Watch new registrations and certificates

Permutation is a snapshot. Attackers register new domains every day, so you also need a stream: newly registered domain feeds, zone file changes, and certificate transparency logs. Phishing sites usually want HTTPS, so a certificate issued for a name containing your brand is an early warning that something is being staged.

This fits the guidance that detection is not a one-time setup: threat actors stage infrastructure ahead of time, so you want to see registrations and certificates before the campaign launches rather than after the first victim reports it.

3. Score candidates with similarity models

Classifiers can rank candidates so analysts see the likely threats first. One published example, a cross-encoder built on the CANINE-c transformer, reports accuracy as high as 97.4% when classifying typosquatting domains. Treat such figures as a benchmark on a specific dataset, not a promise for your own traffic. Models still produce false positives and still need a human to confirm.

4. Look at DNS behavior

Network-side signals help too. The same model documentation suggests monitoring DNS query logs for anomalous patterns and flagging domains with unusually low TTL values or high IP diversity in DNS responses. CISA's joint advisory on fast flux recommends a multi-layered approach to detection rather than a single technique, which is a good rule for typosquatting as well.

5. Investigate the domain itself

This is the step that turns a suspicious string into a decision. It is covered in detail below.

Signals that separate a threat from noise

Once you have a candidate, you are looking for evidence of intent and capability. Rank these roughly in order of how much they tell you.

• Active content. Does the domain serve a login form, a clone of your site, a download, or a redirect chain? A clone or credential form is high confidence.
• Mail capability. MX records on a lookalike domain that has no website suggest it may be used to send or receive email as you, a pattern used in business email compromise.
• Registration age. A domain registered days ago that closely resembles your brand is far more suspicious than one registered a decade ago.
• Infrastructure overlap. Shared IP addresses, name servers or hosting with other known-bad domains link a candidate to an existing campaign.
• Certificate details. Recently issued certificates, often several at once for many variants, hint at a batch being prepared.
• Registrant clues. Privacy services hide ownership, but attackers frequently misconfigure them, leaving traces in DNS and certificate logs. Aggregating DNS, WHOIS and certificate events works better than trusting any single database.
• Conditional behavior. Some operators show a harmless sales page or a different site depending on visitor location or request type. If a domain looks clean from your office network, that is not proof it is clean.
• Linked identities. Email addresses, phone numbers or usernames attached to the registration or the site can connect the domain to other infrastructure.

Note that being a lookalike is not the same as being malicious. Many near-matches belong to unrelated companies, fan sites or defensive registrations made by the brand owner itself.

A 10-minute triage routine for a suspect domain

Here is a repeatable routine. It assumes you have already got a candidate from a scanner, a certificate alert, a user report or a suspicious email.

1. Record the evidence safely. Note the exact string, including any Punycode form, and the time you found it. Do not browse to it from a corporate workstation. Use an isolated environment.
2. Pull registration and infrastructure data. Check registrar, creation date, name servers, MX records and hosting. A domain intelligence lookup returns breaches, infrastructure and WHOIS context in one place instead of four tabs.
3. Resolve the hosting IP. Run the address through an IP lookup to see the network owner and location, and compare it to infrastructure you already know to be hostile.
4. Check linked contacts. If the registration or the page exposes an email address, run an email OSINT lookup. Breach and account-presence data can show whether the address is long-lived, throwaway, or tied to other services.
5. Pivot on handles and numbers. If a username or phone number appears in the site code or the whois record, a username search across 50+ services or a phone number lookup can reveal other assets controlled by the same person.
6. Decide and document. Classify the domain as benign, monitor, or act. Export the findings so that whoever files the report has the evidence in hand.
7. Act on the result. Block it at the DNS and email gateway, warn staff if the domain was mailed to them, and report it to the registrar or hosting provider. For trademark-based claims, see the next section.

With a few practice runs, the routine becomes a short checklist rather than an investigation.

Is typosquatting illegal? Takedown routes

The answer depends on intent and jurisdiction. Cybersquatting is not inherently illegal in every context, but it is commonly handled as a trademark problem. ICANN's Uniform Domain-Name Dispute-Resolution Policy (UDRP) gives brand owners an administrative path. The complainant must show that:

1. The domain is identical or confusingly similar to their trademark.
2. The registrant has no rights or legitimate interests in the name.
3. The domain was registered and is being used in bad faith.

The UDRP applies directly to open generic TLDs such as .com, .net and .org, plus some country-code TLDs that adopt it. The same source notes that common-law rights established through commercial use are often enough, so a registered trademark is not always required. The procedure is limited to deliberate, bad-faith abusive registrations, so a lookalike with a plausible legitimate use may not qualify.

This is where your triage notes matter. Evidence of a cloned login page, active mail setup or shared infrastructure with known phishing sites supports the bad-faith element far better than a bare similarity argument. For a legal strategy on a specific domain, speak to trademark counsel. The routes above are a general outline, not advice on your case.

What we think about typosquatting detection

We build Inquerely for people who have to answer a narrow question quickly: is this thing connected to something bad? Typosquatting is a perfect example, and from where we sit, a few things stand out.

First, finding lookalikes is the cheap part. Generators and certificate streams will hand you hundreds of candidates. The scarce resource is analyst time spent deciding which five deserve attention. We see the bottleneck at the lookup stage: registration data, hosting, linked emails, breach exposure, all scattered across separate tools.

Second, signals only mean something in combination. A new registration is common. A new registration with mail records, a fresh certificate and a hosting IP shared with other suspicious domains is a pattern. That is why we put email, IP, phone, username and domain research behind one search interface rather than treating them as separate products.

Third, volume matters. Teams that verify large lists, such as a customer testimonial that describes checking 50,000 email addresses in an hour, need speed and exports, which is why results can be saved as PDF, CSV or JSON and reached through the API.

Finally, we believe basic OSINT should not sit behind a procurement process. Up to 30 free searches a day, no subscription and no credit card, means a one-person security team can run the same triage as a large one.

— Toba

Using Inquerely for the investigation step

Inquerely does not replace the tools that generate variants or stream certificates. It covers what comes next: turning a suspicious domain into evidence. Start from the domain intelligence tool for breaches, infrastructure and WHOIS, then pivot to IP, email, phone and username searches as clues appear. Search history is tracked, so you can retrace how you reached a conclusion, and exports make handoff to legal or takedown teams simple.

Every user gets up to 30 free searches per day. You can try it on inquerely.com with no payment details.

Building a continuous program

One-off scans age quickly. A lasting setup has four parts.

• Scope. List primary domains, product names, key brand terms and the TLDs you care about. Include defensive registrations you already own so they are excluded from alerts and so you can track their expiry and contact details.
• Feeds. Combine scheduled permutation checks with newly registered domain and certificate monitoring. Check feeds daily if you can.
• Triage. Use the routine above with a standard severity scale, so analysts reach consistent decisions.
• Response. Define who blocks, who reports, who contacts the registrar, and who decides to file a UDRP complaint. Research on defensive domain registration notes that owners must also monitor expiry dates and keep contact information current for the domains they register.

Finally, close the loop. Feed confirmed bad domains and their infrastructure back into your blocklists and SIEM so that the next lookalike from the same actor is recognized sooner.

FAQ

What is typosquatting detection?

It is the practice of identifying lookalike domains registered to exploit typing errors or visual confusion, then assessing whether they are being used for phishing, malware or impersonation. It combines variant generation, monitoring of new registrations and certificates, and manual investigation of each suspect.

Why is typosquatting illegal?

It is not automatically illegal everywhere. It becomes actionable when a domain confusingly similar to a trademark is registered and used in bad faith, which can be pursued through the UDRP or through the courts. Using the domain for fraud or malware can also trigger criminal and consumer protection laws, depending on the country.

Can you give me an example of typosquatting?

A classic pattern is paypa1.com, where the letter "l" is replaced with the digit "1", or gogle.com, where a letter is omitted. Microsoft's own illustration is tailspintoy.com in place of tailspintoys.com. Attackers also use homoglyphs such as "rn" for "m".

Is a free scan enough to protect my brand?

A scan shows what is registered today. Attackers register new domains continually, so you need ongoing monitoring plus a way to investigate each hit. A free lookup workflow handles the investigation side well, but you still want a feed for new registrations and certificates.

Sources

• Typosquatting, Wikipedia
• What is typosquatting? Microsoft Support
• Typosquatting detection study, ScienceDirect
• Fast Flux: A National Security Threat, CISA
• Anvilogic CE-Typosquat-Detect, Hugging Face
• Acquire Infrastructure: Domains (T1583.001), CISA
• UNCTAD document on UDRP and cybersquatting
• Defensive Domain Registration Practices, TMA 2024

Created with BabyLoveGrowth AI