What is typosquatting? Real examples and how to check yours

Someone registers your domain with one letter moved, points it at a copy of your checkout page, and waits. No exploit, no breach, no access to anything you own. They bought a keyboard slip and monetised it. If you sell a book, a course, or software from a domain your buyers type by hand, that slip costs you sales, and sometimes costs your customers their card details.

What typosquatting is

Typosquatting, also called URL hijacking, is the registration of a domain close enough to yours that a mistyped address or a skimmed link delivers a visitor to the squatter instead of to you. It works because people read the shape of a word rather than its letters. clamdpown.ai and clampdown.ai look the same at a glance in a browser bar, in an email, and on a phone.

Two neighbours are worth separating from it:

• Cybersquatting takes the exact name you would want, often before you register it, then offers to sell it back at a markup.
• Brandjacking copies your name onto social profiles, app stores, and marketplaces rather than onto a domain. We cover that side in fake accounts impersonating your brand.

Typosquatting is the domain-level version, and the registration itself is cheap. A squatter can hold forty variants of a name for less than the price of one month of hosting.

The patterns squatters use

Every technique below is a documented family, not a one-off trick. Using clampdown.ai as the example:

• Adjacent-key swaps. clamdpown.ai, clampdoen.ai. The two letters sit next to each other on a QWERTY keyboard, so the error rate is high and the result still scans as the original.
• Dropped or doubled letters. clamdown.ai, clamppdown.ai. Readers skip both without noticing.
• Punctuation and plurals. clamp-down.ai, clampdowns.ai. These catch people who half-remember the name rather than people who mistype it.
• Homoglyphs. A Cyrillic а substituted for the Latin a produces a string that renders identically in most fonts and resolves to a different domain. Browsers defend against this with punycode warnings, and the warnings only fire when the browser detects a mixed script.
• TLD swaps. clampdown.com, clampdown.co, clampdown.net. The sharpest version drops the c from .com and lands on .om, Oman’s country code, which registrars have sold to squatters running lookalike pages.
• Subdomain masquerades. clampdown.ai.account-verify.net. The real name appears first, the registrable domain sits at the end, and the reader stops scanning before reaching it.

What squatters do with the traffic

Registering the domain is step one. What follows determines how much damage it does and how fast you can remove it.

Parking pages fill the domain with ads or affiliate links and take a cut of every click. This is the most common outcome and the least urgent.

Phishing pages copy your login or checkout screen and harvest what visitors type. When your product sits behind an account, this is the version that turns into support tickets and chargebacks.

Fake download pages offer your software, ebook, or course files, and ship malware or a pirated copy instead. Buyers who land here believe they bought from you, and they come to you when it breaks.

Resale holding keeps the domain blank while the owner waits for an offer. Nothing visible happens, which makes it the hardest case to argue as abuse.

How to check your own domain

This takes about twenty minutes for a single brand.

1. Write out the variants. Walk the keyboard: every adjacent-key swap, every dropped letter, every doubled letter, the hyphenated form, the plural form. Twenty to forty strings is a normal list for a one-word brand.
2. Check which ones exist. Run each through ICANN Lookup to see registration status, registrar, and creation date. A domain created shortly after your launch is a stronger signal than one registered years earlier.
3. Look at the live ones from a clean browser. Open registered variants in a private window. Do not sign in, do not download anything, and do not enter an email address. You are checking what the page claims to be, not testing it.
4. Sweep the TLDs. Check .com, .net, .co, .io, .app, and your own TLD’s near neighbours. Add .om if your primary domain ends in .com.
5. Search for the copy, not the domain. Query your brand name alongside login, download, free, and discount. Phishing and pirated-copy pages rank for those terms even when the domain looks nothing like yours.
6. Watch certificate logs. Every TLS certificate issued for a domain gets published to public certificate transparency logs, searchable at crt.sh. Searching your brand string there surfaces lookalike domains the moment someone puts HTTPS on one, which is usually before the page goes live.

Repeat the sweep quarterly. Squatters register in waves after a launch, a funding announcement, or a press mention.

Getting a typosquatted domain removed

Match the route to what the page is doing.

Phishing or malware is the fastest path. Report the domain to its registrar’s abuse contact, listed in the ICANN Lookup record, and to the hosting provider behind its IP address. Registrars suspend phishing domains within days, because their own accreditation depends on responding. Report the URL to Google Safe Browsing as well, which pushes a red interstitial in front of Chrome, Firefox, and Safari users while the suspension goes through.

A pirated copy of your work is a copyright matter rather than a trademark one, so it follows the DMCA route: notice to the host, notice to the CDN, and a search de-indexing request. Our walkthrough of what to do when someone steals your content covers the sequence, and our site-by-site removal guides cover the hosts that come up most.

A parked page with ads rarely moves through abuse channels, because the registrar sees a domain doing nothing illegal. This is where trademark rights matter.

A domain dangled for resale at an inflated price is the classic bad-faith case, and the one arbitration panels understand best.

When a UDRP complaint is worth filing

The Uniform Domain-Name Dispute-Resolution Policy is the arbitration process built into every gTLD registration agreement. You file with a provider such as WIPO, and a panel can order the domain transferred to you without a court appearance.

You have to prove three things at once:

1. The domain is identical or confusingly similar to a trademark you hold rights in.
2. The registrant has no legitimate interest in the name.
3. They registered and are using it in bad faith.

The trademark requirement is the one that stops most creators. Unregistered common-law rights can work if you can evidence real commercial use of the name, and a registration through a body like the USPTO makes the case far cleaner. WIPO’s published fee schedule starts at roughly $1,500 for a single-panelist case covering a small set of domains, so the maths works when the squatter holds several variants or when the domain is actively taking your sales.

For a single parked domain with no traffic, filing costs more than the harm. Document it, keep the record, and revisit if the page goes live.

How Clampdown helps

Clampdown watches for copies of your work across piracy sites, marketplaces, and lookalike domains, verifies each match belongs to you, and files the removals. The part that matters for typosquatting is the watching: variants get registered in bursts, sit dormant, and turn into phishing or download pages months later. Catching that shift the week it happens is the difference between a removal and a support queue full of buyers who paid someone else.

FAQ

Is typosquatting illegal? Registering a misspelling is not itself a crime. It becomes actionable when the domain infringes a trademark or hosts phishing, malware, or pirated material. In the US the Anticybersquatting Consumer Protection Act gives trademark holders a civil claim against bad-faith registration, separate from the UDRP arbitration route.

Should I just buy every variant of my domain myself? Buy the handful a customer would plausibly type: the common misspelling, the plural, the hyphenated form, and the .com if you run a different TLD. Buying forty is a recurring bill that still misses the homoglyph and subdomain versions, which no defensive registration covers.

Do browsers block homoglyph domains? Chrome, Firefox, and Safari show the punycode form (xn--...) when a domain mixes scripts, which makes the substitution visible. A domain built entirely in one non-Latin script can still render cleanly, and links clicked from email or chat apps bypass the address bar entirely.

How do I know a lookalike domain is targeting me and not a coincidence? Compare the creation date against your launch or press coverage, check whether the page reproduces your copy or branding, and look at what else the registrant holds. A registrant sitting on eight variants of one brand is not a coincidence.

If lookalike domains and pirated copies of your work keep surfacing faster than you can file, start with a free piracy audit to see what is already live, or talk to Clampdown about handling the finding and filing.