# Typosquatting

Typosquatting is the registration of domains that differ from a real domain by a typo, a swapped or extra letter, a hyphen or another TLD, to catch mistyped visits and to make phishing links look familiar.

## How it works

Variants are produced systematically: omission, repetition, transposition, keyboard-neighbour replacement, added words such as -login or -support, and alternative TLDs.

The same lists are used defensively: monitoring which variants of a brand domain get registered and start resolving.

## Example from the PhishDestroy database

- [coinbasw.com](https://phishdestroy.io/domain/coinbasw.com/): Look-alike domain found by typo-variant monitoring, first detected 2026-09-04.
- [coimnbase.com](https://phishdestroy.io/domain/coimnbase.com/): Look-alike domain found by typo-variant monitoring, first detected 2026-09-03.
- [colnbase.com](https://phishdestroy.io/domain/colnbase.com/): Look-alike domain found by typo-variant monitoring, first detected 2026-09-01.

## How to protect yourself

- Watch the exact spelling and TLD of sites that handle money or logins.
- Brand owners can generate variants of their domain and monitor new registrations.

## Related tools

- [Lookalike Domain Generator](https://phishdestroy.io/developer-tools/lookalike-generator)
- [Homoglyph Checker](https://phishdestroy.io/developer-tools/homoglyph-checker)
- [DestroyList Check](https://phishdestroy.io/developer-tools/destroylist-check)

## Related terms

- [Homoglyph](https://phishdestroy.io/glossary/homoglyph/)
- [Punycode](https://phishdestroy.io/glossary/punycode/)

## Further reading

- [Newly Registered Domains: Phishing Risk Guide](https://phishdestroy.io/newly-registered-phishing-domains)

## Glossary

- [All terms](https://phishdestroy.io/glossary/)

Canonical: https://phishdestroy.io/glossary/typosquatting/