Typosquatting
Typosquatting is the registration of domains that differ from a real domain by a typo, a swapped or extra letter, a hyphen or another TLD, to catch mistyped visits and to make phishing links look familiar.
How it works
Variants are produced systematically: omission, repetition, transposition, keyboard-neighbour replacement, added words such as -login or -support, and alternative TLDs.
The same lists are used defensively: monitoring which variants of a brand domain get registered and start resolving.
Example from the PhishDestroy database
- coinbasw.com: Look-alike domain found by typo-variant monitoring, first detected 2026-09-04.
- coimnbase.com: Look-alike domain found by typo-variant monitoring, first detected 2026-09-03.
- colnbase.com: Look-alike domain found by typo-variant monitoring, first detected 2026-09-01.
How to protect yourself
- Watch the exact spelling and TLD of sites that handle money or logins.
- Brand owners can generate variants of their domain and monitor new registrations.