Typosquatting is the registration of a domain that differs from yours by a predictable slip: a dropped letter (mailshrne.com), swapped letters, an adjacent key, a missing hyphen, a plural, or the same name on a different extension. A lookalike domain is the broader category, including names that add a word (mailshrine-support.com) or swap a letter for one that renders the same (rnailshrine.com, where r-n imitates m). Both exist for one reason: some fraction of your customers, suppliers and staff will type or click the wrong one, and whoever owns it decides what happens next.
The question owners actually ask is not "what is it" but "how many of these should I register before it becomes silly?" The answer depends on how your domain is used. A name that only ever appears on business cards has a different risk profile from one that receives wire-transfer instructions by email every day.
MailShrine Domains lets you check variants quickly with the availability checker, register them at the same renewal price you see up front across 150+ extensions, and keep them locked and private for free. Variants you register can point their DNS at your main site, and because email DNS is written at registration, you can also receive mail that was mis-addressed to them.
Real-life example: Léa's import business
Léa Diouf runs an import and distribution company in Dakar on dioufimports.com. Her suppliers in Casablanca and Istanbul receive payment instructions from finance@dioufimports.com. Last quarter a supplier was emailed from finance@dioufimport.com, singular, with new bank details, and only a phone call stopped the payment. The lookalike had been registered three weeks earlier.
Léa's goals this week:
- Work out which variants of her name an attacker would realistically use.
- Decide which to buy, which to monitor and which to ignore.
- Make the real domain harder to impersonate regardless of what she buys.
The common variant types
| Variant type | Example for dioufimports.com | Typical use by attackers | Worth buying? |
|---|---|---|---|
| Singular / plural | dioufimport.com | Email fraud, phishing | Usually yes |
| Dropped letter | dioufimorts.com | Typo traffic, ad parking | Only for high-traffic sites |
| Adjacent key | dioufimporta.com | Typo traffic | Rarely |
| Transposition | dioufimoprts.com | Typo traffic | Rarely |
| Hyphenated | diouf-imports.com | Email fraud, phishing | Often yes |
| Different extension | dioufimports.co, .net, .sn | Email fraud, brand confusion | Yes for your market's main extensions |
| Added word | dioufimports-pay.com, dioufimportsgroup.com | Phishing | Cannot buy them all; monitor instead |
| Homoglyph / IDN | dioufirnports.com, díoufimports.com | Phishing | Monitor; buying is impractical |
The first, fifth and sixth rows cover the vast majority of real fraud cases against small businesses. Attackers want a name a busy accounts clerk will accept, not one that merely catches typos.
The economics
At roughly $12.99 a year for a .com, ten variants cost about $130 a year. Compared with one diverted supplier payment, that is nothing. Compared with the thousands of possible variants, it is also nothing, which is the point: buying variants is not a complete defence and was never going to be. Buy the handful that fraud actually uses, and spend the rest of the effort on controls that work for every variant, including the ones you have not thought of.
Three such controls:
- DMARC with a reject policy on your real domain. This stops exact-domain spoofing, which is the other half of invoice fraud. It does nothing for lookalikes, but it removes the easier attack. MailShrine writes SPF, DKIM and a starter DMARC record at registration; tightening to
p=rejectis your job once mail is flowing. - A payment-change procedure that does not depend on the domain. Any change of bank details is confirmed by phone to a known number. This is the control that actually saved Léa.
- Monitoring. Open-source tools such as
dnstwistgenerate the variant list for a domain and check which are registered, with what nameservers and MX. Run it monthly.
What you need before you start
| You need | Why |
|---|---|
| Your exact domain and the extensions your customers expect | The variant list is generated from these |
| A sense of how the domain is used | Payment emails raise the stakes; a brochure site lowers them |
| A budget decision | Roughly $13 per variant per year for .com; ccTLDs vary |
| Access to your registrar | To register, lock and point the variants |
Step 1: Generate the list
Run dnstwist yourdomain.com or use a web equivalent. You will get hundreds of permutations with a flag for each that is already registered. Export it.
Step 2: Triage
Delete anything no human would accept in an email address. Keep singular/plural, hyphenated and un-hyphenated, the top two or three extensions for your market (for Léa: .com, .sn, .net), and any variant already registered by someone else with MX records, which means it can receive or send mail.
Step 3: Register the defensive set
Buy the free ones from your shortlist. Register them for the same term as the main domain so they expire together, and leave transfer lock and privacy on. On MailShrine both are free and default.
Step 4: Point them somewhere useful
For each defensive domain, set DNS so web traffic lands on your real site and, if you want to catch mis-addressed mail, set MX records so it reaches a mailbox you check. Alternatively, publish an SPF record of v=spf1 -all and a DMARC p=reject on domains that should never send email; that tells receivers to reject anything claiming to come from them.
Step 5: Deal with already-registered lookalikes
If a variant is parked with ads, leave it. If it has MX records or hosts a copy of your site, you have options. Report it to the registrar's abuse contact shown in the lookup. If your name is a registered trademark, the UDRP lets you file a complaint with WIPO or another provider for a fee starting at $1,500 for a single-panelist case covering up to five domains, with a decision in around two months. For clear-cut phishing, hosting providers and registrars often suspend within days of an abuse report without any filing.
Step 6: Schedule the re-run
Put the monitoring tool on a monthly reminder. New lookalikes are registered when attackers find a target, and the variant that matters is the one registered next week.
Léa's checklist
- Ran the variant generator and found 412 permutations, 9 already registeredCompleted
- Registered
dioufimport.com,diouf-imports.comanddioufimports.snon a 3-year termCompleted - Reported
dioufimport.com's previous phishing use to the registrar's abuse address, then registered it after it droppedCompleted - Set
v=spf1 -alland DMARC reject on the defensive domainsNot completed - Moved the main domain's DMARC policy from
nonetorejectNot completed - Wrote the "confirm bank changes by phone" rule into the supplier termsNot completed
Common mistakes
Buying fifty typo domains and no DMARC. You have paid $650 a year to be exactly as spoofable as before on your real domain.
Letting defensive domains expire quietly. A dropped defensive domain is a pre-vetted phishing name. Register them for the same term as the main domain and keep auto-renew on.
Leaving defensive domains with no DNS at all. A domain with no SPF or DMARC can still be used in From headers. Publish the null SPF and a reject DMARC.
Assuming a trademark is required to do anything. Abuse reports for active phishing need no trademark. UDRP does, but most lookalike takedowns never reach it.
Buying your name in every one of 150 extensions. Nobody is tricked by dioufimports.fishing. Buy the extensions your customers would believe.
Check your work
Send a test email from an outside account to a defensive domain and confirm it either reaches your catch mailbox or bounces, never silently disappears. Spoof a test message claiming to be from your main domain using a DMARC testing tool and confirm receivers reject it. Run the variant generator and confirm every entry with MX records is either yours or has been reported. If those three hold, you have done what buying domains can do, and the rest is procedure.
FAQ
How many lookalike domains should a small business buy?
Typically three to eight: singular/plural, hyphenated/un-hyphenated, and the two or three extensions your customers would expect. Beyond that, monitoring and DMARC give better protection per dollar than more registrations.
Is typosquatting illegal?
Registering a confusingly similar name in bad faith to profit from a trademark is actionable under the UDRP and, in the US, the Anticybersquatting Consumer Protection Act, which allows statutory damages of $1,000 to $100,000 per domain. Registering a typo of a non-trademarked name for parking is generally legal, if unwelcome.
Can MailShrine redirect my defensive domains to my main site?
You control the DNS for every domain you register, so you can point a defensive domain's records at the same destination as your main site. How the destination handles the hostname is up to the site or service you point at.
Does WHOIS privacy stop people registering lookalikes?
No. Lookalikes are generated from the domain name itself, which is public by definition. Privacy protects your contact details, not your name.
What is the difference between typosquatting and cybersquatting?
Cybersquatting is registering someone's brand name itself, usually to sell it back. Typosquatting is registering variants of it to catch mistakes. Both are forms of bad-faith registration and both can be challenged under the UDRP.
Next steps
- Domain Renewal Scam Letters and Emails: How to Spot Them — the "someone wants to register your brand in Asia" email and why it is not a lookalike threat.
- How to Stop Domain Hijacking — protecting the real domain, which matters more than any variant.
- What Is WHOIS Privacy and Do You Need It? — what the lookup of a suspicious lookalike will and will not tell you.
Citations & References
- Reference: ICANN: Uniform Domain-Name Dispute-Resolution Policy
- Reference: WIPO: Schedule of fees under the UDRP
- Reference: RFC 7489: Domain-based Message Authentication, Reporting, and Conformance (DMARC)
- Reference: dnstwist: domain name permutation engine
Written by Samira K., small-business editor. Samira writes for owners who run the business and the IT at the same time, and need the answer that saves money and time.