Typosquatting & Brand Domain Protection Guide

This guide is for brand owners, in-house counsel, and domain portfolio managers. It explains how typosquatting and lookalike domains work, how to decide what to register versus what to watch, how to monitor, and when to enforce. If you already know a domain is being abused, go straight to the enforcement section.

Quick answer: how to protect a brand domain before and after abuse

Brand domain protection is not about buying every possible domain. It is a three-tier discipline: register the core, block or watch the long tail, and monitor the rest. The economics are stark — a defensive registration costs $10–20 per year, while a single UDRP dispute starts at $1,500 in filing fees before legal costs, and a phishing-initiated breach averages $4.88 million. The protection stack combines defensive registration, continuous monitoring with registration, DNS, and certificate triggers, ICANN rights-protection mechanisms such as the Trademark Clearinghouse, and targeted enforcement through URS, UDRP, ccTLD policies, or court. The 2026 gTLD round will expand the namespace by hundreds of extensions, making prioritisation more important than ever.

Key facts at a glance

The threat landscape in 2026

Typosquatting

Typosquatting is the registration of a domain that is a misspelling or slight variant of a trademark. The common patterns are:

• A transposed letter (e.g., brnad.com for brand.com).
• A doubled character (e.g., braand.com).
• A missing letter (e.g., brnd.com).
• A wrong extension (e.g., .co where customers expect .com).
• A hyphenated variant (e.g., brand-name.com).

Typosquatting is often combined with pay-per-click monetisation, traffic diversion, or phishing. The defence is to register the closest, highest-risk variants and block or monitor the rest.

Lookalike and doppelganger domains

Lookalike domains are built to host phishing or send fraudulent email. Examples include yourbrand-support.com, yourbrand-login.net, and yourbrand-secure.com. They often use:

• Brand + a trust keyword (“support”, “login”, “secure”, “verify”).
• Brand + a geographic term.
• Brand + a number.

The defence is monitoring and takedown, supported by a strict DMARC policy to neutralise the email vector.

Homoglyph (IDN) domains

Homoglyph domains swap a Latin character for an identical-looking character from another script — for example, a Cyrillic “а” for a Latin “a”. The result is a lookalike that cannot be spotted by eye.

The defence is homographic blocking at the registry or registrar level, combined with monitoring. Brand owners should check whether their core domains have IDN variants and whether the relevant registry offers blocking.

Phishing and email spoofing

Phishing is the most damaging use of a lookalike domain. A phishing site harvests customer credentials; a spoofed email sends fraudulent invoices. The IBM 2025 Cost of a Data Breach Report puts the average cost of a phishing-initiated breach at $4.88 million.

The defences are layered:

• DMARC, SPF, and DKIM on the legitimate domain.
• Monitoring for lookalike domains with active MX records.
• Takedown through the registrar, hosting provider, or a dispute procedure.

AI-generated lookalikes

In 2025, WIPO recorded the highest number of domain disputes in its history and observed early signs of automation and AI being used to generate high-quality lookalike domains and content. AI can produce plausible variants and polished phishing content at scale. The defence is continuous monitoring and fast enforcement, not a one-off audit.

The 2026 gTLD expansion

ICANN’s 2026 new gTLD round opened applications in April 2026. Hundreds of new extensions are expected to be delegated over the coming months and years. The number of top-level domains has already grown from a handful to well over a thousand, and no brand can own its name across all of them without an unmanageable renewal bill.

The 2026 round makes the three-tier model more important, not less. The answer to an expanding namespace is not to buy everything; it is to register the core, block or watch the long tail, and monitor the rest.

Not sure where your brand is exposed? We map the namespace, the variants, and the active threats. Start a domain exposure assessment →

The economics: $12 domain vs $1,500 dispute

The cost asymmetry

The numbers are simple and brutal:

The asymmetry is the argument for defensive registration. A single UDRP costs roughly 100 domain-years of registration. A single phishing breach costs more than a lifetime of defensive registrations.

The breach cost multiplier

The breach cost is the number that changes the boardroom conversation. A $12 domain that prevents a $4.88 million breach is not a cost; it is insurance. The challenge is that the probability of an attack on any given variant is low. That is why the tiering matters: buy where the probability is high enough that you would realistically file; watch the rest.

When buying wins

Buying wins when:

• The domain is an exact-match of the brand on a core extension (.com, .net, .org).
• The domain is a high-risk typo that search data shows customers actually make.
• The domain is a lookalike that a phishing campaign would realistically use.
• The domain is in a market where you have customers and enforcement is slow or expensive.

When watching wins

Watching wins when:

• The domain is a plausible but low-probability permutation.
• The domain is a hyphenation or keyword add.
• The domain is a secondary TLD that your customers do not type.
• The domain is in the combinatorial long tail — obscure TLDs, double typos, multi-keyword mashups.

Buying the long tail is “where budgets go to die”; watching it costs almost nothing per domain.

One UDRP costs roughly 100 domain-years of registration. We model the trade-off for your portfolio. Ask for a cost-benefit assessment →

The three-tier defensive registration model

Tier 1 — Register the core

Tier 1 is the buy-and-hold layer. It includes:

• The exact-match .com — non-negotiable for nearly every business.
• Core gTLDs — .net, .org, .co — where the risk of confusion or diversion is high.
• Local ccTLDs where your customers actually are — .co.uk, .ca, .de, etc.
• High-risk typos that search data shows customers make.
• Commerce endings that counterfeit storefronts favour — .shop, .store — for your exact name.

Typical size: 5–20 domains.

Tier 2 — Block or watch the long tail

Tier 2 is the watch layer. It includes:

• Hyphenations — your-brand.com.
• Keyword adds — yourbrand-official.com, yourbrand-support.com.
• Homoglyph variants.
• Secondary TLDs that your customers might type.

The long tail can contain hundreds of candidates. Buying them is wasteful; watching them costs nothing per domain. The watch needs three triggers: registration, DNS resolution, and certificate issuance.

Tier 3 — Monitor and enforce

Tier 3 is the act layer. It includes:

• Obscure TLDs.
• Double typos.
• Multi-keyword mashups.

These need no pre-emptive spend and no daily attention. They are acted on only when they become active — a live phishing page, a monetised parking page, or a fraudulent email campaign.

The extension hierarchy

A purely domestic US business can usually deprioritise Tier 3 entirely. A business serving UK customers should own the .co.uk regardless of its .com presence.

Redirect strategy

Every defensive domain should redirect to the primary site. A 301 permanent redirect:

• Consolidates traffic and search signals into one authoritative destination.
• Captures mistyped traffic.
• Avoids the “abandoned domain” signal that an unforwarded defensive domain sends.

Do not leave defensive domains parked on raw DNS pages. An unforwarded defensive domain looks abandoned or suspicious, undermining the trust you registered it to protect.

Register the core. Block the long tail. Monitor the rest. We build the tiering with you, and we revisit it as your markets and threats change. Start a portfolio review →

Monitoring: what to watch and how

Registration triggers

A registration trigger fires when a new domain matching your brand pattern is registered. This is the earliest signal of a potential threat. The trigger should cover:

• Exact-match variants.
• Typo patterns.
• Keyword-add patterns.
• Your brand in new gTLDs.

DNS resolution triggers

A DNS resolution trigger fires when a watched domain starts resolving to an IP address. This is the signal that the domain is active — a website, a parking page, or a mail server. A domain that resolves is a higher priority than one that does not.

Certificate issuance triggers

A certificate issuance trigger fires when a watched domain obtains a TLS/SSL certificate. This is a strong signal that the domain is being prepared for a live website or a phishing page. Certificate transparency logs make this trigger reliable and fast.

Monitoring tools compared

Pricing note: VigilDNS publishes self-serve pricing; most enterprise platforms quote on request. Pricing typically scales on the number of trademarks, brand terms, and named executives monitored, plus whether takedown execution is included.

Building a watchlist

A watchlist is not a list of every possible domain. It is a prioritised list of domains that are plausible enough to warrant monitoring. Build it from:

1. Permutation generation — typos, homoglyphs, keyword adds, hyphenations.
2. Search data — typos that customers actually make.
3. Threat intelligence — patterns seen in your industry.
4. Prior incidents — domains that have been used against you before.

The watchlist should be reviewed quarterly, and after any significant brand, product, or market change.

A watchlist without triggers is noise. We define registration, DNS, and certificate triggers, and we connect them to an enforcement decision tree. Build a monitoring plan →

ICANN rights-protection mechanisms

Trademark Clearinghouse (TMCH)

The Trademark Clearinghouse is ICANN’s central repository of verified trademark records. It provides:

• Sunrise priority — the right to register your trademark in new gTLDs before general availability.
• Trademark Claims — alerts when someone attempts to register your exact trademark string in a participating TLD.
• Ongoing notifications throughout the trademark’s validity period.

Enrollment requires proof of trademark registration and an annual fee. The TMCH does not replace defensive registration; it complements it for new extensions.

Sunrise periods

A Sunrise period is a pre-launch window in which trademark holders can register their marks in a new gTLD before the general public. The TMCH record is the key that unlocks Sunrise. Brand owners should monitor new gTLD launches and register in Sunrise where the extension is relevant to their business.

Trademark Claims

The Trademark Claims service notifies a prospective registrant that a domain matches a recorded trademark, and notifies the trademark holder of the registration. It does not block the registration, but it creates a record of notice that can support a bad-faith finding later.

URS and UDRP

The URS and UDRP are the enforcement backstops. The URS is a fast suspension procedure for new gTLDs; the UDRP is the standard transfer procedure for gTLDs and selected ccTLDs. Both are covered in detail in the enforcement section.

The 2026 gTLD round and updated TMCH requirements

ICANN’s 2026 new gTLD round brings updated TMCH requirements. The revised requirements were published on 12 March 2026, implementing recommendations on Trademark Claims (2, 5, 6) and Sunrise (8). New gTLD registry operators under the 2026 Base Registry Agreement must comply with the updated requirements.

The RPM Phase 1 PDP proposed enhancements to improve the effectiveness of rights-protection mechanisms, and the IPC supports the proposed updates as improving the effectiveness, consistency, and fairness of Sunrise and Trademark Claims. Brand owners should ensure their TMCH records are current and that their watchlists include the new gTLDs as they delegate.

ICANN’s mechanisms only work if your records are current. We audit TMCH records, Sunrise eligibility, and watchlist coverage ahead of the 2026 delegations. Audit your RPM coverage →

Enforcement: when and how to act

Registrar and hosting takedown

The fastest route for an active phishing page is often the registrar or hosting provider’s abuse channel. A registrar can suspend a domain for abuse; a hosting provider can take down the site. These are not legal remedies, but they can stop the harm in hours or days. They do not transfer ownership.

URS

The URS is the right route when:

• The domain is in a new gTLD.
• The case is clear-cut — clear and convincing evidence.
• Suspension is enough — you do not need ownership.

The filing fee is ~$360–375 at Forum and ADNDRC, or €175 at MFSD. The process can be resolved in weeks.

UDRP

The UDRP is the right route when:

• The domain is in a gTLD.
• You need transfer.
• You have trademark rights and can prove the three elements.

The filing fee starts at $1,500 at WIPO for a single panelist and up to five domains. WIPO’s 2026 fast-track offers a decision in about one month for $4,000 for 1–5 domains. WIPO also reduced its early withdrawal fee to $100 for 1–5 domains when the complaint is withdrawn before formal notification.

ccTLD policies

Each ccTLD has its own policy and fee. The right route depends on the extension: Nominet DRS for .uk, auDRP for .au, CDRP for .ca, .eu ADR for .eu, INDRP for .in, CNDRP for .cn, SACI-Adm for .br, usDRP for .us.

Court and ACPA

Court is the right route when you need damages or an injunction. In the US, the ACPA allows in personam actions with statutory damages of $1,000–$100,000 per domain, and in rem actions against the domain itself where the registrant cannot be found.

Bulk enforcement

When a single actor controls hundreds of domains, a bulk UDRP complaint can be efficient. Panels are willing to deal with hundreds of domains where the complainant can demonstrate a coherent pattern of control. The L’Oréal decision (705 domains), Empower (537 domains), and Novartis (350+ domains) show that consolidation is viable where the evidence supports it.

Remedy choice at scale: L’Oréal requested cancellation rather than transfer for all 705 domains, because managing and renewing hundreds of domains carries cost. But cancellation introduces re-registration risk — cancelled domains can be picked up by new squatters. A split strategy — transfer the high-risk domains, cancel the low-value ones — may be preferable.

When abuse is confirmed, the route matters. We match URS, UDRP, ccTLD, or court to the harm, and we handle bulk filings where the pattern supports consolidation. Start an enforcement assessment →

The brand-protection policy

Ownership across the organisation

Brand protection is not a single team’s job. It requires:

• Legal — trademark rights, TMCH records, enforcement decisions.
• Security — monitoring, DMARC, takedown.
• Marketing — brand guidelines, domain strategy.
• Finance — budget, renewal management.
• Executive — decision rights for enforcement spend.

Budget and prioritisation

The budget should be split across the three tiers:

• Tier 1 — registration and renewals.
• Tier 2 — monitoring subscriptions.
• Tier 3 — enforcement reserve.

A basic portfolio costs under $100/year; a monitoring subscription starts at $79/month; an enforcement reserve should cover at least one UDRP or URS filing per year.

Decision rights

Define who can:

• Register a defensive domain.
• Approve a monitoring subscription.
• File a URS or UDRP.
• Authorise a court action.

Without clear decision rights, threats fall between teams.

Review cadence

• Quarterly — review the watchlist and the threat landscape.
• Annually — review the portfolio and the budget.
• Event-driven — after a new gTLD launch, a merger, a product launch, or an incident.

Case studies

L’Oréal and 705 domains (WIPO D2026-0199)

L’Oréal filed a single UDRP complaint against 705 domain names that combined the L’ORÉAL mark with recruitment-related terms. The domains were registered in a short window between 23 December 2025 and 15 January 2026. Despite differing registrant details, the panel found common control based on shared infrastructure, repeated email addresses, and batch-style registration. L’Oréal requested cancellation of all 705, which the panel granted.

Lesson: Bulk enforcement works where the evidence shows a coherent pattern of control. But cancellation carries re-registration risk; a split strategy may be better.

Empower and 537 domains (WIPO D2026-0344)

Empower, a financial services company, recovered 537 domains in a large-scale typosquatting operation used as part of a sophisticated phishing scheme.

Lesson: Typosquatting at scale is often tied to phishing. The enforcement strategy should address both the domains and the phishing infrastructure.

Novartis and 350+ domains

Novartis recovered over 350 domains across two complaints in 2025. The cases show that consolidation is viable where the domains share a common target and a common pattern of abuse.

Lesson: A documented pattern supports consolidation, which reduces cost per domain and increases the efficiency of enforcement.

Common mistakes

1. Buying the long tail

Registering hundreds of permutations “just in case” is wasteful. Most of the permutation space will never be abused. Buy the core, watch the rest.

2. Leaving defensive domains parked

An unforwarded defensive domain looks abandoned or suspicious. Every defensive domain should redirect to the primary site.

3. Monitoring without triggers

A watchlist without registration, DNS, and certificate triggers is noise. Define the triggers and connect them to a decision.

4. Ignoring ccTLDs

A .com win does not transfer a .co.uk, .com.au, or .ca. Each extension requires its own proceeding.

5. Filing on a weak case

A complaint that cannot satisfy the elements invites denial and, potentially, an RDNH finding. Test the case before filing.

6. Underestimating the breach cost

A $12 domain that prevents a $4.88 million breach is not a cost. Frame the budget in breach terms, not domain terms.

7. Forgetting renewal

A lapsed defensive domain is a gift-wrapped attack surface. Manage renewals centrally.

Brand protection checklist

• Tier 1: Register the exact-match .com, core gTLDs, and key ccTLDs.
• Tier 1: Register high-risk typos that search data shows customers make.
• Tier 2: Build a watchlist of hyphenations, keyword adds, homoglyphs, and secondary TLDs.
• Tier 2: Set registration, DNS, and certificate triggers.
• Tier 3: Monitor the long tail and act only when a domain becomes active.
• Redirect: Point every defensive domain to the primary site with a 301.
• TMCH: Record trademarks and review Sunrise and Trademark Claims coverage.
• DMARC: Enforce a strict DMARC policy on the legitimate domain.
• Monitoring: Subscribe to a tool or build an internal process with triggers.
• Enforcement: Define the route (registrar, URS, UDRP, ccTLD, court) for each threat type.
• Budget: Allocate registration, monitoring, and enforcement reserves.
• Review: Quarterly watchlist review; annual portfolio review.

Ready to build the programme? We audit the exposure, design the tiering, and connect monitoring to enforcement. Start a brand protection assessment →

How counsel.domains can help

If you are building a brand-protection programme, we audit the exposure, design the tiering, and connect monitoring to a decision tree.

If a lookalike domain is active, we assess the fastest route — registrar takedown, URS, UDRP, ccTLD, or court — and act.

If you face a bulk typosquatting operation, we build the consolidation case and manage the filing.

If the case spans multiple extensions, we coordinate parallel proceedings on one evidence record.

counsel.domains Domain name disputes, worldwide. Start a brand protection assessment → · [email protected]

Disclaimer: This website provides general information about domain name dispute resolution. It is not legal advice and does not create a professional relationship. Procedures and fees change; check the relevant policy and provider before acting. counsel.domains is not affiliated with ICANN, WIPO, Forum, Nominet, auDA, CIRA, EURid, NIXI, CNNIC, NIC.br, or any registry or dispute-resolution provider.