Typosquatting, Brandjacking, and Domain-Based Brand Abuse

By Hank FasthoffJuly 4, 2026

Typosquatting is the registration of domain names that exploit predictable user errors, misspellings, transpositions, missing characters, and wrong TLD extensions, to intercept traffic intended for a trademark owner's legitimate site. It's one of the most common forms of cybersquatting, and it's also one of the hardest to police because the number of possible permutations for any given brand name runs into the hundreds or thousands.

Measurement studies have found that roughly 95 percent of the top 500 websites have at least one typosquatting domain registered against them. Across the top 3,264 .com sites, researchers identified at least 938,000 typosquat domains. For brand owners, typosquatting is an ongoing enforcement problem that requires monitoring, prioritization, and a strategy that matches the response to the type of abuse.

How Typosquatting Works

Typosquatters register domains that capture common errors users make when typing a URL. The techniques fall into several categories, and most active typosquatting campaigns deploy multiple variants simultaneously.

Character omission removes a letter from the legitimate domain. "Gogle.com" instead of "google.com." Character transposition swaps two adjacent letters. "Amazno.com" instead of "amazon.com." Character substitution replaces a letter with one adjacent on the keyboard. "Fscebook.com" instead of "facebook.com." Character addition inserts an extra letter. "Googgle.com." Wrong TLD replaces the correct extension with a plausible alternative. "Amazon.co" instead of "amazon.com," or "brand.org" instead of "brand.com."

Each technique targets a different kind of mistake, and sophisticated typosquatters register dozens or hundreds of variants for a single brand. A typosquatting campaign against a Fortune 500 company might include every common misspelling across .com, .net, .org, and country-code TLDs, creating a net of domains that captures traffic from every predictable error.

Homoglyph and IDN Attacks

Internationalized Domain Names (IDNs) allow registration of domain names in non-Latin scripts, including Cyrillic, Greek, and other Unicode character sets. Some characters in these scripts are visually identical to Latin letters. Cyrillic "а" looks the same as Latin "a" but is a different Unicode character. An attacker can register "аpple.com" using a Cyrillic "а," and in many contexts it's indistinguishable from the real domain.

These homoglyph attacks (sometimes called IDN homograph attacks) are particularly dangerous because they can defeat visual inspection. A user looking at the URL bar sees what appears to be the legitimate domain. Modern browsers display IDN domains as Punycode (the "xn--" format) when mixed scripts are detected, but older browsers, some mobile apps, and many email clients don't apply that protection.

ICANN and individual registries have adopted rules restricting mixed-script registrations, but homoglyph attacks using characters from a single non-Latin script can still slip through. Enforcement against homoglyph domains follows the same UDRP and ACPA framework as standard typosquatting, but detection requires monitoring tools that generate and check homoglyph variants rather than relying on simple string matching.

Combosquatting

Combosquatting adds words, prefixes, or suffixes to a legitimate brand name to create a plausible-looking domain. "Amazon-deals.com," "face-book-login.com," or "paypal-security.com" are typical examples. Unlike traditional typosquatting, combosquatting doesn't rely on a typing error. It relies on the user's assumption that a domain containing the brand name, combined with a descriptive term, belongs to the brand.

Combosquatted domains are widely used in phishing campaigns because they can reference specific functions ("login," "security," "support," "verify") that lend credibility to fraudulent emails directing users to the domain. They're also harder to detect through automated monitoring because the number of possible word combinations is essentially unlimited, unlike the finite set of typo permutations for a given brand.

How Typosquatters Monetize Captured Traffic

Not every typosquatting domain is a phishing site. Typosquatters monetize captured traffic through several methods, and the method determines both the severity of the harm and the appropriate enforcement response.

Pay-per-click parking pages display advertising links related to the brand's products or industry. Each click generates revenue for the domain holder. This is the most common form of typosquatting monetization and the form most frequently addressed through UDRP complaints, because it falls squarely within paragraph 4(b)(iv)'s bad faith factor (using the domain to attract Internet users for commercial gain by creating confusion).

Affiliate redirect sends the user to a competitor's website through an affiliate link. The typosquatter earns a commission on any purchase the redirected user makes. The brand owner loses the customer and the sale, and the competitor may not even know its affiliate program is being exploited this way.

Phishing and credential harvesting present a login page that mimics the brand's legitimate site, capturing usernames, passwords, payment information, or other sensitive data. Phishing typosquats are the most harmful variant and the most urgent to address, because every hour the domain remains active exposes more users to credential theft.

Malware distribution serves malicious software to users who visit the typosquatted domain. Some typosquatting domains initiate drive-by downloads that install malware without user interaction beyond visiting the page.

Resale to the brand owner registers the domain and waits for the brand owner to offer to buy it, which is classic cybersquatting and independently actionable under both the UDRP and the ACPA regardless of the typosquatting element.

Detecting Typosquatting Domains

You can't enforce against domains you don't know exist, and manual monitoring doesn't scale. A brand with a seven-character .com domain has hundreds of plausible typo variants across just the major TLDs, and that number multiplies when you add homoglyph variants, combosquatting, and country-code extensions.

Brand monitoring services generate permutations of your domain name, check registration databases for matches, and alert you when new typosquatting domains are registered. Some services also monitor DNS records, SSL certificate transparency logs (which reveal when certificates are issued for typosquatted domains, often a sign of phishing preparation), and WHOIS changes.

WHOIS and RDAP lookups remain the starting point for investigating a suspected typosquatting domain. Registration date, registrant information (if available), name server configuration, and registrar identity all inform the enforcement strategy. A typosquatting domain registered yesterday through a privacy service and pointed at a parking page presents different enforcement options than one registered five years ago by an identifiable registrant with a live website.

Enforcement Strategies

Enforcement against typosquatting domains should match the type of abuse.

For pay-per-click parking pages and passive holding, a UDRP complaint is typically the fastest and most cost-effective remedy. Typosquatting domains that incorporate a trademark satisfy the confusing similarity element almost by definition, the registrant rarely has a legitimate interest in a misspelled version of someone else's brand, and monetizing trademark-related traffic through PPC advertising supports bad faith under paragraph 4(b)(iv). WIPO panels have transferred typosquatting domains in thousands of cases on exactly these facts.

For phishing, malware, and credential harvesting, speed is more important than a dispute proceeding. Registrar abuse reports can take down a phishing domain within hours, because most registrars' terms of service prohibit phishing and malware distribution. Reporting the domain to the registrar's abuse contact, to Google Safe Browsing, and to anti-phishing organizations like the Anti-Phishing Working Group (APWG) can achieve immediate suspension while a UDRP or ACPA action proceeds in parallel.

For serial typosquatters who've registered dozens or hundreds of infringing domains, ACPA litigation in federal court provides remedies the UDRP can't match. Statutory damages of up to $100,000 per domain name under 15 U.S.C. § 1117(d) create financial consequences that deter future registrations, and injunctive relief can prohibit the defendant from registering additional domains incorporating the plaintiff's marks.

For combosquatting and homoglyph domains, enforcement follows the same framework but requires more attention to the confusing similarity analysis. A combosquatted domain like "brand-support.com" is confusingly similar to the "BRAND" trademark, but the added descriptive term may give the registrant a (usually weak) argument that the domain references a concept rather than targeting the mark. Homoglyph domains are almost always bad faith by their nature, because the registrant's choice to use visually identical characters from a different script demonstrates intent to deceive.

Defensive Registration

Monitoring and enforcement address typosquatting after it happens. Defensive registration addresses it before it happens by registering the most common typo variants of your brand before squatters do.

You can't register every possible permutation. A realistic defensive registration strategy focuses on the highest-risk variants, common misspellings identified through web analytics (your server logs show which misspelled URLs users try), the major alternative TLDs (.net, .org, .co, and any industry-specific extensions), and any variants that could be used for phishing (combinations with "login," "secure," "support," or "pay").

Defensive registrations cost roughly $10 to $15 per year per domain for standard TLDs. Registering 20 to 50 high-risk variants costs a few hundred dollars annually, which is a fraction of the cost of a single UDRP complaint (starting at $1,500) or an ACPA lawsuit. For brands with significant online traffic, the economics favor defensive registration for the most obvious variants and monitoring plus enforcement for everything else.

Building an Enforcement Record

Consistent enforcement against typosquatting domains creates a record that strengthens future cases. A brand owner who has successfully recovered dozens of typosquatting domains through UDRP proceedings has a portfolio of decisions demonstrating that panels consistently find confusing similarity, no legitimate interest, and bad faith for misspellings of the brand's mark. That record makes future complaints faster to draft and more predictable in outcome.

It also deters future squatters, because the UDRP decisions are published and searchable. A registrant considering whether to register a typosquatting variant of a particular brand can search WIPO's database and find a history of successful complaints, which signals that the brand owner monitors, enforces, and wins.

Ignoring typosquatting has the opposite effect. A brand that doesn't enforce signals to squatters that its domains are safe to register, and the problem compounds over time.