See how Truviss’s Domain Scanner flags character-swap, TLD-swap and homoglyph domains the moment they’re registered.
Book a demo
- Typosquatting is a naming trick, not a full clone site: character-swap, TLD-swap and homoglyph domains built to be mistaken for a brand’s real address.
- A fixed watchlist of known misspellings always falls behind, since the technique’s value is in producing variations no list anticipated.
- Truviss’s Domain Scanner generates those same pattern variants and checks new domain registrations against them continuously, rather than reacting to complaints.
- Typosquatting is only the opening move; the full takedown process lives in the Domain Phishing complete guide.
Swap one letter in a brand’s web address and most people will never notice. amaz0n instead of amazon. A doubled letter, a missing one, a .net where a .com should be. None of it looks wrong at a glance, which is exactly the point. This is typosquatting: registering a domain built to be mistaken for a real brand’s own address, not to be found on its own but to catch the people already looking for the real thing.
It’s one specific technique inside the wider problem of domain phishing, not the whole picture. If you need the full lifecycle, from how these domains get weaponised through to takedown, see Domain Phishing: The Complete Guide (2026). This piece stays narrower: how the naming trick itself works, and how a brand actually catches it before a customer does.
The three ways a typosquat domain is built
Typosquatting isn’t random misspelling. It’s a small, repeatable set of patterns, which is exactly why it can be detected systematically rather than guessed at.
Character-swap, omission and transposition. The domain drops a letter, doubles one, swaps two adjacent letters, or substitutes a number for a similar-looking letter, the kind of typo a thumb makes on a phone keyboard or an eye makes reading quickly.
TLD-swap. The brand name is spelled correctly, but the ending is wrong: the same word registered on .net, .co or .shop instead of the real .com. No misspelling at all, just a different door with the same nameplate.
Homoglyph domains. The hardest to catch by eye. A character from a different script or encoding stands in for a Latin letter it renders almost identically to, so the domain looks correct even under close inspection, because visually it is.
All three exist for the same reason: to sit one careless glance away from the real thing.
Why this is different from a phishing clone site
Typosquatting is about the name fooling the eye before a visitor ever reaches a page. A phishing clone site is about the page itself fooling them once they arrive, a copied login screen, a fake checkout, a mirrored layout built to harvest details. The two often travel together, but not always. A typosquat domain can sit registered and unused. A clone site can be reached through a link that has nothing to do with a misspelled domain at all. Treating them as one problem misses that they need different detection logic, and the full clone-site and enforcement picture is exactly what the complete guide to domain phishing covers in depth.
Why brands can’t just watch for exact-name matches
The natural first instinct is to keep a list of known misspellings of the brand name and check for those. It works for about as long as it takes an attacker to try a variation that isn’t on the list. A fixed watchlist goes stale the moment a new TLD, a new character combination or a homoglyph pairing nobody thought to add shows up, and the technique’s whole value to an attacker is that the possible variations are numerous enough that a hand-built list will never keep pace.
That’s the actual argument for pattern-based detection over list-based detection: the defence has to generate and check variations at the same rate the technique can produce them, not react to the ones that already caused a complaint.
How a domain scanner actually catches these
This is what Truviss’s Domain Scanner is built to do: it systematically generates the character-swap, TLD-swap and homoglyph variants of a brand’s real domain, then checks new domain registrations against that pattern set continuously, rather than watching a static list of known misspellings. It’s part of the same 24/7 surveillance that covers lookalike and typosquatted domains, phishing sites and cloned websites as one connected channel, so a new registration close enough to the brand’s real address gets flagged as it appears, not weeks later once it’s already live and doing damage.
See how Truviss’s Domain Scanner catches character-swap, TLD-swap and homoglyph domains the moment they’re registered.
Explore Domain ScannerWhat to do when a scanner flags one
A flag isn’t automatically an attack. The first step is verifying the domain isn’t owned by the brand itself or by an authorised reseller or regional partner, something that happens more often than brands expect once a portfolio spans several markets. Once a domain is confirmed as unauthorised, it gets documented (Truviss’s case management keeps the metadata and evidence trail intact for exactly this) and routed into takedown.
That takedown process, the actual detect-verify-enforce sequence and how to build one that holds up under scrutiny, is covered in full in Domain Phishing: The Complete Guide (2026). The naming trick is only ever the opening move. What a brand does in the minutes after it’s spotted is what decides whether it stays a near-miss or becomes a customer’s bad day.
Mithileshkumar leads growth at Truviss, working every day to make sure the brands losing the most to counterfeits, fraud and digital impersonation are the ones who find out about a fix first. He’s spent his career believing that good marketing isn’t about noise, it’s about showing up right when someone needs the answer. Off the clock, he’s usually chasing the same instinct in something entirely unrelated to work.