Typosquatting is when someone registers a domain that looks almost like yours to catch your mistyped traffic, pose as your brand, or run scams against your customers. When you run a typosquat scan, TLDTrack generates the look-alike names a scammer would use and checks which of them are already registered, so you can decide what to do before your customers are caught out.
What it is
Read more
.net or .co in place of your .com. It then checks each one to see whether it is actually registered, whether it has live DNS or a mail server set up, and roughly how risky it looks. The registered ones are listed for you to review; names nobody has taken are not listed. It does not judge intent for you, because the same trick can be an unrelated business, a harmless parked name, or a deliberate impersonation.Why it matters
Read more
What a look-alike domain is
A typosquatted domain is one deliberately chosen to be mistaken for yours. Common tricks include:
- A common misspelling of your name.
- An extra, doubled or swapped letter that is easy to miss.
- A different ending, such as
.netor.coinstead of your.com.
Whoever registers it might be harmlessly parking the name, or they might be using it to catch your mistyped traffic, impersonate your brand, or run phishing against people who trust you.
How the scan works
Typosquat monitoring runs as an on-demand scan rather than on a fixed schedule. A scan runs when you switch it on and whenever you press Re-scan in the Similar domains panel on the site's Hosting and Domain tab. It works in a few steps:
- It generates the variants. TLDTrack builds the set of plausible look-alike names around your domain, using the common misspelling and letter-swap patterns above and a range of alternative endings.
- It checks each one. For every variant it looks up whether the name is actually registered, whether it has live DNS or a mail server behind it, and who the registrar is.
- It sorts them. Registered look-alikes are listed as threats to review, with a rough risk level. Unregistered variants are not listed.
Not every match is a threat
What you need before you start
- A domain added to TLDTrack. See Add your first website if you have not yet.
- Typosquat monitoring switched on for that site. It is a per-site toggle, and it needs to be on before you can run a scan.
- A moment to review the results. A scan produces a list to work through, not a single yes-or-no answer, so it pays to look at it rather than just switch it on.
What you will see
After a scan finishes, the Similar domains panel lists the registered look-alike domains it found around your brand, the ones that actually exist, each with a risk level and tags showing whether it has DNS or a mail server. The panel shows the five highest-risk names. Work down the list and weigh each one: an obvious misspelling that has a mail server set up, or one that redirects to a rival or a login page, deserves attention, while an unrelated company that happens to share a word probably does not. Once you have dealt with a look-alike, you can dismiss it so it drops off your list of things to review.
Because a fresh look-alike can be registered at any time, and because this is an on-demand scan rather than a background watch, it is worth re-running it now and again rather than only when you first switch the check on.
What you can do about one
When a look-alike is flagged, you have a few sensible options depending on how much of a risk it looks:
- Report it to the registrar or relevant authorities if it is clearly impersonating you or phishing your customers.
- Buy it defensively so nobody can use it against you later, if the current owner will sell.
- Ignore it if it is plainly unrelated and harmless, and dismiss it so it stops cluttering your list.
How to switch it on and run a scan
-
1
Open the website from your Domains list.
-
2
Go to the Hosting and Domain tab and switch on Monitoring in the Similar domains panel.
-
3
The first scan starts straight away. TLDTrack generates the look-alike variants and checks each one, which takes a short while.
-
4
Review the results, then report, buy, or dismiss each look-alike. Press Re-scan from time to time to catch newly registered names.
Impersonation and blacklisting are related reputation problems, so it is worth pairing this with blacklist monitoring too. To choose who is told about your monitoring alerts, see alerts and notifications.
Where to set this up
Open a site to review look-alike domains.
Learn moreSee the full monitoring stack.
Good to know
- Typosquat monitoring is an on-demand scan you run yourself, not a fixed-schedule background check, so re-run it now and again.
- For each look-alike, the scan shows whether it is registered and whether it has DNS or a mail server set up, which helps you gauge the real risk.
- Only registered look-alikes are listed. Names nobody has registered are not shown.
- You can dismiss a look-alike once you have dealt with it, to keep your review list clean.
For a full breakdown of what each plan includes, see plans and levels.