Typosquatting

Typosquatting is the practice of registering domains that look like legitimate brand domains but contain a typo, a homoglyph, or a transposed character. Attackers use them for phishing, ad fraud, or just to grab traffic from typos.

Examples:

• gooogle.com (extra o).
• paypa1.com (number 1 for lowercase l).
• microsott.com (typo).
• аpple.com (the a is the Cyrillic а, U+0430). This is a homoglyph attack, also called IDN homograph or Punycode attack.
• appleid-login.com (subdomain-style trickery in the apex).

What attackers do with them

• Phishing. Send mail from support@paypa1.com with a login link. Victims who don't look closely click and enter credentials.
• Drive-by malware. Visitors get pushed an "update your Flash player" payload that's actually a trojan.
• Ad fraud. Squatted domains run search and display ads, monetizing typo traffic.
• Brand pressure. Sometimes the squatter doesn't do anything malicious; they just hold the domain hoping the brand will buy it for $10k.

Defenses for a brand

Defensive registration

The "easy" defense: register the common misspellings yourself. For a brand with N letters, there are roughly 25N typos at single-character distance plus dozens more at two-character distance. You can't register them all, but you can register the obvious ones across .com, .net, .org. Costs $10-50/year per domain.

Some brands also register the homoglyph variants. microsoft.com plus a few Cyrillic-а variants in Punycode.

Brand-protection services

CSC Global, MarkMonitor, Brandsight, Identity Digital Brand Services monitor newly registered domains for ones that look like your brand. They flag matches and recommend action: defensive registration, UDRP, or trademark complaint. Annual cost: $5k-$50k+ depending on coverage.

UDRP

The Uniform Domain-Name Dispute-Resolution Policy. If someone registers a confusingly similar domain in bad faith, you can file UDRP through WIPO or NAF. Successful UDRP takes 2-3 months and costs $1,500-$5,000. The domain gets transferred to you (or canceled).

Useful for clear cases. Doesn't work against legitimate similar names (random people happen to register similar things).

Trademark Clearinghouse (TMCH)

For new gTLDs, registering your trademark in TMCH gives you Sunrise priority and at least 60 days of notice when someone tries to register a name matching your mark. Doesn't apply to .com and other older TLDs.

In a SaaS

If you're a brand:

• Register .com, .net, .org of your name and 5-10 common typos. Costs ~$300-500/year.
• Watch your DMARC reports for spoofing attempts from look-alike domains.
• If you sell branded subdomains (<customer>.yoursaas.com), have a reserved-words list that blocks customers from registering common brand names as their subdomain. Otherwise your platform becomes a typosquatting playground.

If you're a SaaS that lets customers register domains: surface a typosquatting warning when their input looks dangerously close to a known brand. Most registrars don't do this; it's a differentiator and a customer-trust signal.