Skip to content
RIHTANHow it worksContact
Threat · DOMAIN

Typosquat domains

A typosquat domain is a near-miss of a brand's real domain — a dropped letter, a keyboard neighbor, or a predictable suffix like -shop or -official — registered by someone else to catch the brand's customers. For every brand we generate between 589 and 880 plausible variants — dropped letters, doubled letters, keyboard neighbors, hyphenations, and the predictable suffixes: shop, store, official, outlet, sale, us.

How we scan for these, daily

DetectVerifyRemoveReport— a person at every step.
What we look for

The signals that make a case.

Resolved against authoritative DNS

A local resolver will happily answer for domains that do not exist. We query authoritative servers and discard private-range answers, or 99% of a report is fiction.

Live is not the same as dangerous

Parked and for-sale pages resolve too. We separate them out and say so, rather than counting them to make a number look serious.

Watched, not forgotten

A domain sitting on “Launching soon” is tomorrow's clone. It stays on the watchlist and we file the day it starts selling.

Bad neighborhoods

When a clone appears in an address block that already hosts template scam shops, that pattern is worth knowing and worth watching.

What we do about it

The action,
once you approve it.

Registrar and host complaints where a site is live; monitoring with a standing brief where it isn't.

Always

Nothing goes out unauthorized

Every typosquat domains case waits for your written approval. You can stop any of them at any point, and a seller you tell us to leave alone is never raised again.

Common questions

Asked before the first scan.

A lookalike domain is parked — is it a threat?

Not yet, and we won't count it as one. Parked and for-sale pages are reported as exactly that. But a domain sitting on “Launching soon” is tomorrow's clone, so it stays on the watchlist and we file the day it starts selling.

How many variants do you check?

Between 589 and 880 plausible variants per brand — dropped letters, doubled letters, keyboard neighbors, hyphenations and the predictable suffixes — resolved against authoritative DNS so parked fictions don't inflate the count.

See if this is happening to you.