The term is narrower than the problem
Typosquatting, strictly defined, is the registration of a domain that a user might reach by mistyping a legitimate one. The academic models are precise: character omission (exmple.com), transposition (exapmle.com), substitution with a keyboard-adjacent letter (exanple.com), and doubling (exaample.com).
That definition describes a minority of the problem. In practice the term is used loosely to cover at least six structurally distinct techniques, which differ in whether the deception exploits a typing error, a perceptual error, a semantic assumption, or — in one unusual case — a hardware fault.
Combosquatting keeps the brand intact and adds a word: brand-login, secure-brand, brand-billing. It is by a wide margin the largest family. A longitudinal study across 468 billion DNS records identified 2.7 million combosquatting domains targeting just 268 trademarks — roughly a hundred times more prevalent than classical typosquatting, and around ten thousand variants per brand.
Homograph or IDN attacks substitute Unicode characters that are visually confusable with ASCII. The canonical demonstration renders a familiar brand entirely in Cyrillic characters that appear identical in most fonts.
Alternate-TLD abuse keeps the label and changes the suffix. Registration price drives the distribution: across 765,910 phishing domains observed between 2021 and 2024, .com accounted for between 31% and 55% depending on the sample, with cheap TLDs such as .top taking substantial share. When Freenom stopped free registrations in 2023, .tk phishing domains collapsed from 10,931 to 52 in a year while .cn rose from 764 to 7,060 — evidence that registry pricing policy, not user awareness, determines attacker TLD choice.
Domain embedding nests the real domain inside a hostname the attacker controls, as in yourbank.com.example.net, relying on the reader stopping at the familiar string.
Bitsquatting registers domains differing by a single bit from the target, exploiting random memory errors rather than human ones. It is a small category but a real one: an early proof of concept logged over 52,000 requests in eight months across thirty registered domains.
The practical consequence of this taxonomy is that a monitoring approach built on one model misses the others. Edit distance catches typos and misses combosquatting entirely. Confusable-character matching catches homographs and misses everything in ASCII.
Why email authentication cannot help
This is the point most often misunderstood, and it is worth stating on the protocol's own terms rather than as a vendor assertion.
DMARC operates by testing identifier alignment: it compares the domain in the message's From header against the domain authenticated by SPF or DKIM, and the receiving mail server retrieves the applicable policy from the From-domain's own DNS records.
An attacker who has registered a lookalike domain owns that domain. They publish their own DMARC record, configure their own SPF, sign with their own DKIM key, and the message aligns correctly. It passes authentication — and because it passes, it is more likely to be delivered than an unauthenticated message would be.
DMARC does exactly what it was designed to do: it closes exact-domain spoofing of domains you control. That is precisely why attackers stopped spoofing your domain and started registering ones that look like it. The rise of lookalike registration is best read as a displacement effect of DMARC adoption rather than as a failure of it.
A useful corollary: most business email compromise does not use a lookalike domain at all. Industry reporting puts free webmail at around 69% of BEC attacks. Lookalike domains concentrate in the remaining share, where they are considerably more convincing.
The operational timeline
The assumption that attackers register domains and let them age before use is not supported by recent large-scale measurement.
In a study of 15,126 newly registered phishing domains observed between July 2023 and May 2024, phishing content was deployed essentially as soon as the domain was registered. Average operational lifetime was 8.6 days, but that mean is misleading — 89.45% were active for under two days. The distribution is heavily skewed and the median is what matters.
Two further findings from that dataset shape detection strategy. 79.3% obtained a TLS certificate, with Let's Encrypt issuing 77.3% of them. And 25.7% of the domains had been registered before, meaning WHOIS creation dates can understate a domain's history.
The defending side moves considerably slower. Across 765,910 phishing domains observed over 39 months, median time from registration to detection was 16.3 days for maliciously registered domains and 86 days for compromised legitimate ones. Detection to deregistration averaged 11.5 days overall — but 23 days for squatting-style domains specifically, which survive takedown longer than algorithmically generated names.
Set those figures side by side and the structural problem is visible. The campaign runs for under two days. Detection arrives at around two weeks. Removal follows three weeks after that.
There is a second speed worth noting. Combosquatting domains used for slower brand-adjacent monetisation rather than credential harvesting behave differently: roughly 60% persisted beyond 1,000 days. The two-speed model is real, and a monitoring programme should expect both shapes.
What actually detects them
Because near-100% of weaponised domains now obtain a certificate, and because Let's Encrypt logs issuance to Certificate Transparency within minutes, CT functions as a near-real-time registration feed for this threat class. It is the single highest-yield free detection source available.
Its blind spots are structural rather than incidental. CT records certificate issuance, not domain registration — a domain parked without a certificate is invisible, which is roughly one in five weaponised domains. Wildcard certificates disclose nothing about the subdomains beneath them, so domain-embedding attacks are largely absent from CT. And CT is signal, not verdict: a naive brand-substring alert generates heavy false positives.
A practical signal stack, in rough order of precision:
An MX record on a lookalike domain is the strongest single indicator that email abuse rather than web-only impersonation is intended. A parked squat has no reason to provision mail. This is a well-established practitioner heuristic; we are not aware of a published precision measurement for it.
Certificate issuance, via CT, with a roughly 79% base rate among weaponised domains.
A and AAAA records resolving to content rather than to a parking page.
Registration age under about thirty days, adjusted for re-registration history given that a quarter of malicious domains are recycled.
Registrar and hosting concentration, recognising that this signal drifts annually — the dominant abusive registrars in 2024 were not those of 2022.
String distance, last rather than first. Levenshtein and Damerau-Levenshtein suit typo families; prefix-weighted measures such as Jaro-Winkler suit combosquatting; homographs require normalising to a confusable skeleton before comparison. But edit distance is a candidate generator, not a detector. It produces enormous false-positive volume on short brand names and misses combosquatting by construction.
One scoping caveat worth stating plainly: because roughly a third of phishing uses compromised legitimate domains rather than registered lookalikes, a lookalike-monitoring programme addresses at most about two-thirds of the phishing problem by domain count.
Why browser protection favours large brands
Chrome applies a thirteen-step algorithm to each domain label and renders the label as raw Punycode when the checks fail. Separately, it shows a lookalike interstitial based on three heuristic families: edit distance, target embedding, and IDN homographs.
Both layers are weaker than they appear for a regional organisation. The interstitial is personalised by browsing history — Chromium's documentation states that warnings are shown partly on the basis of what the user has visited, and that suggested alternatives are drawn from well-known or previously visited sites. A regional brand that is not on Chrome's top-domains list, impersonated to a victim who has never visited the real site, produces neither a warning nor a "did you mean" suggestion.
Chromium's own documentation concedes that the checks "are not always right." The interstitial is informational and bypassable rather than a block.
One actionable detail: Chrome exempts defensive registrations that issue an HTTP 301 or 302 redirect to the canonical domain. If you buy defensive domains, redirect them rather than parking them.
The limits of takedown
Since April 2024, ICANN's Global Amendments have required registrars and registries to take appropriate mitigation action against domains where there is actionable evidence of DNS abuse, to make abuse contacts accessible, and to acknowledge reports.
Two limitations matter. The amendments explicitly exclude website content abuse, which means a lookalike domain that merely exists with a brand-adjacent name and no active payload is generally not actionable through that route. And registrars retain discretion over what mitigation to apply, with no mandated service level.
The legal route is UDRP, and it is busy: WIPO administered over 6,200 domain name cases in 2025, its highest caseload on record, from a cumulative total exceeding 80,000 over twenty-five years. It is also slow relative to a two-day campaign.
The honest conclusion is that takedown is a cleanup and deterrence function, not a protective control. The protective controls are pre-delivery detection — CT and newly-registered-domain monitoring feeding your mail gateway and proxy blocklists directly — and authentication that does not depend on the user recognising a domain. Origin-bound credentials such as passkeys are immune to lookalike credential harvesting by construction, because the browser will not release a credential to a domain it was not registered against.
Defensive registration, scoped honestly
Defensive registration is rational for a narrow set and irrational beyond it.
Worth buying: the handful of single-character typos of your primary brand, the brand in your two or three most credible alternate TLDs — typically .com, your national ccTLD and .eu — and exact homograph variants of the brand string.
Not worth attempting: the combosquatting space. With roughly ten thousand variants observed per trademark and an unbounded keyword axis, and with 190 distinct TLDs abused in a single eleven-month dataset, the namespace cannot be bought. ICANN's 2026 new gTLD round will expand it further.
What this means in practice
Do not rely on DMARC for this threat. It is necessary and it does not apply. Confirm your own DMARC posture, then treat lookalike domains as a separate problem with separate controls.
Monitor Certificate Transparency. Roughly four in five weaponised domains announce themselves there within minutes of certificate issuance, and the feed is public.
Treat an MX record as escalation. A lookalike domain provisioning mail is preparing to send.
Move before delivery. Given a two-day campaign window against a sixteen-day median detection lag, the only intervention that changes the outcome is blocking the domain at the mail gateway and proxy before the first message arrives.
Buy narrowly and redirect. A small defensive portfolio configured as 301 redirects; nothing beyond that.
We published a worked example of this pattern in our analysis of the Albania e-Visa impersonation campaign, where a government advisory had named one fraudulent domain and monitoring identified eight.