# How do you build a defensive domain list for your brand?

> Build a defensive domain list in five steps: seeds, extensions, variants, ranking, budget. A core set of six costs $128.94 a year.

- URL: https://wardmint.com/guides/build-a-defensive-domain-list/
- Last updated: 2026-11-12
- Publisher: Wardmint (https://wardmint.com)

A defensive list is a ranked set of names you register for your own brand. This guide gives the method, the order of priority and the yearly cost of each tier.

**Quick answer — How do you build a defensive domain list for your brand?**

To build a defensive domain list, start from your name and ticker, add the core extensions, then the finance words and the endings phishers use, then the typo and look-alike variants found by search, and rank them by risk and price. **Wardmint** prices the core set of 6 extensions at $128.94 a year.

## Four tiers, ranked, with yearly prices

*Prices per year at Wardmint, the same on renewal. Sets are suggestions, not bundles: each name goes into the cart on its own.*

| Tier | Names | Price per year |
| --- | --- | --- |
| 1. Core | .com, .net, .org, .io, .xyz, .app | $128.94 ($386.82 over 3 years) |
| 2. Token launch | .com, .io, .xyz, .app, .finance, .network | $195.94 |
| 3. Finance words | .finance, .exchange, .money, .cash, .capital, .fund | $296.94 |
| 4. Endings phishers use | .xyz, .pro, .info, .shop, .online, .icu, .click, .live, .support | $212.41 |

## Single extensions to add by budget

| Extension | Price per year | Why it earns a place |
| --- | --- | --- |
| .co | $33.49/year | One letter away from .com |
| .dev | $13.49/year | Fits developer-facing projects |
| .ai | $88.49/year (2 years at a time) | Fits AI and agent projects |
| .click | $11.49/year | In the endings phishers use set |
| .link | $7.99/year | Second smallest yearly price of the 29 extensions |

## Five steps from a brand to a ranked list

1. **Write the seed names** — List the project name, the ticker, the app and docs names, and any spelling people use in chat. Each seed gets its own pass.
2. **Pick the extensions in tiers** — Start with the core set, then add finance words and the endings phishers use as budget allows. The table above has the yearly price of each tier.
3. **Find the variants that exist** — Run the search from the look-alike discovery guide. Names that are free are candidates; names that are taken are watch items.
4. **Add the words users add** — Phishing domains often combine the brand with a word such as login, claim, airdrop, support or wallet. Check which combinations are free under .com and register the likeliest.
5. **Rank, load the cart and set the defaults** — Rank by risk and price, enter up to 50 names in one bulk search, pay in one top-up, then switch on the no-email DNS template, URL forwarding to your main site and auto-renew for every name.

## Which names belong at the top of the list?

**The exact name and ticker under .com, .net, .org, .io, .xyz and .app belong at the top, because attackers try them first.** Those six extensions form the core set, and a core set costs $128.94 a year at Wardmint. The reasoning for each extension is in [which domains a crypto project should register](https://wardmint.com/which-domains-should-a-crypto-project-register/ "Which domains should a crypto project register?").

Next come the extensions that match the project's own words. A launch-focused set, .com, .io, .xyz, .app, .finance, .network, costs $195.94. A project that uses the word finance, exchange or capital in its pitch also gains from the finance words, since a visitor will try them.

## Which extensions do phishers use most?

**By count, .com leads, and .top, .cn, .pro, .info and .xyz follow.** Interisle's data for 1 May 2025 to 30 April 2026 counted 869,180 phishing domains under .com, 375,514 under .top, 167,651 under .cn, 130,945 under .pro, 99,602 under .info and 93,987 under .xyz. By rate per delegated domain, .xin, .win and .icu rank highest.

The count shows where phishers buy the most names, and the rate shows which endings are most abused relative to size. Wardmint does not sell .top (no room under Namecheap's renewal price), .cn, .vip or .cc. The endings phishers use set, .xyz, .pro, .info, .shop, .online, .icu, .click, .live, .support, covers the ones it does sell. The full ranking is on the [most abused extensions page](https://wardmint.com/most-abused-tlds-for-phishing/ "Which domain extensions are most used for phishing?").

## How many variants should you register?

**Register the variants a visitor is most likely to type or follow, and stop where the cost stops being proportionate.** One bulk search takes 50 names; a first pass of a core set plus a handful of typos and word combinations fits in that. Typos of the exact name under .com come first, then hyphenated and combined forms, then the other core extensions.

Look-alikes that use other characters (homoglyphs) deserve a separate pass: the [look-alike types page](https://wardmint.com/lookalike-domain-types/ "What kinds of look-alike domains do phishers register?") explains them. Register only variants of your own brand. Wardmint refuses look-alikes of someone else's brand, and its acceptable-use policy bans them.

## What does a list cost over three years?

**The core set costs $386.82 over three years, and the finance words $890.82.** The price stays the same each year: first year, renewal and transfer cost the same, and each extension is under Namecheap's regular renewal price read on 12 November 2026. We do not claim to be the cheapest.

According to Wardmint's survey of 12 November 2026, its four suggested sets list 27 extension slots but only 21 distinct extensions, because .xyz, .com, .io and .app repeat across sets. A list that repeats an extension is bought once. The [cost page](https://wardmint.com/defensive-domain-registration-cost/ "How much does defensive domain registration cost?") compares these totals with one UDRP complaint.

## How do you keep the list from lapsing?

**Switch on auto-renew for every name, and keep a balance that covers a year of renewals.** A lapsed variant is a free name that an attacker can register. Wardmint offers automatic renewal from your balance, switched on or off for each domain. The part of a top-up added only to reach the $25 minimum is refundable on request within 30 days in USDT or USDC if unspent, and the rest of the balance never expires.

## Questions about defensive domain lists

### How many domains should a crypto project register?

Start with the core set of 6 extensions, then add the launch and finance extensions that match the project. Every name beyond that is a judgement on risk against price.

### Should I register .top?

Wardmint does not sell .top. It has the second most phishing domains by count in Interisle's 2025-26 data, so a project that needs it should buy it elsewhere, or watch it with the search in the look-alike guide.

### Do I need every extension?

No. Rank by risk and price. The core set covers the names attackers try first, and the rest of the list can grow as budget and evidence allow.

### Can I register typos of a competitor's name?

No. Wardmint registers a brand's own variants for that brand only; registering look-alikes of another brand is typosquatting and is banned by the acceptable-use policy.

### What should each defensive domain do once registered?

It should forward to your main site and publish a no-email DNS template, so it cannot be used to spoof your mail. Wardmint provides a "no email" DNS template (null MX, SPF -all, DMARC p=reject) so a defensive domain cannot be used to spoof your mail, free URL forwarding to send every variant to your main site, and automatic renewal from your balance so no variant lapses.

**In summary**

- Start from seeds: name, ticker, app names and common spellings.
- Core set: .com, .net, .org, .io, .xyz, .app at $128.94 a year.
- Token launch set: .com, .io, .xyz, .app, .finance, .network at $195.94 a year.
- Finance words $296.94 and endings phishers use $212.41 a year.
- Interisle counted 869,180 phishing domains under .com in 2025-26; Wardmint does not sell .top.
- One bulk search takes up to 50 names; set auto-renew on every name.
- Register only variants of your own brand.

## Sources

1. [Phishing activity in TLDs, May 2025 to April 2026](https://www.cybercrimeinfocenter.org/phishing-activity-in-tlds-may-april-2026) — Cybercrime Information Center (Interisle data) (read 2026-11-12)
2. [Namecheap regular renewal prices as listed by domainoffer.net](https://domainoffer.net/tld/com/namecheap) — domainoffer.net (read 2026-11-12)

---

Wardmint: Wardmint registers the defensive domains a crypto project needs — its own name across the extensions phishers use, its own typo and look-alike variants — paid in crypto with no KYC: no ID, only one verified email per domain. It is run by DomaineGoat LLC, a company registered in Panama; domains are registered through its ICANN-accredited registrar partner. A .com costs $12.49/year, the same price every year.