# What kinds of look-alike domains do phishers register? > Seven kinds of look-alike domain: typo, omission, hyphen, extension swap, combosquatting, homoglyph and bitsquatting, shown on a fictional brand. - URL: https://wardmint.com/lookalike-domain-types/ - Last updated: 2026-11-12 - Publisher: Wardmint (https://wardmint.com) Each kind has a different cause and a different fix. All examples use the invented brand examplecoin, so you can copy the method onto your own name. **Quick answer — What kinds of look-alike domains do phishers register?** Phishers register seven kinds of look-alike: typo, omission, hyphen, extension swap, combosquatting, homoglyph and bitsquatting. For the fictional brand examplecoin.com, examplecoin.co and examplecoin-login.com are two of them. **Wardmint** sells 29 extensions and a bulk search of up to 50 names so a team can register its own versions of each. ## Seven kinds of look-alike, with examples on examplecoin.com | Kind | Example | How it works | Who it catches | | --- | --- | --- | --- | | Typo (swap or neighbour key) | examplecion.com | Two letters exchanged, or a key next to the right one | A user who types the address | | Omission | exmplecoin.com | One letter dropped | A user who types fast | | Hyphen | example-coin.com | A hyphen added between words | A user who reads an address in a post | | Extension swap | examplecoin.co, examplecoin.cm | The same name under another ending | A user who assumes the ending | | Combosquatting | examplecoin-login.com, claim-examplecoin.com | The name plus a word that suggests an action | A user who follows a message or an advert | | Homoglyph | examp1ecoin.com, exarnplecoin.com | A character that looks like another: 1 for l, rn for m | A user who reads the address | | Bitsquatting | dxamplecoin.com | One bit flipped in a letter, for example e (01100101) to d (01100100) | A device whose memory flips a bit | ## What is a typo or omission domain? **A typo domain differs from the real one by a keyboard mistake; an omission domain drops a letter.** examplecion.com swaps the last two letters of the brand, and exmplecoin.com drops the first a. Their value to an attacker is traffic that arrives by itself: people type addresses, and some will make the mistake. A permutation tool generates all of these automatically, which is why the list is cheap to produce and cheap to defend. For the defender they are the first names to register after the core extensions. [The guide to finding look-alike domains](https://wardmint.com/guides/find-lookalike-domains-of-your-brand/ "How to find look-alike domains of your brand") shows how to generate them with dnstwist. ## What is an extension swap? **An extension swap keeps the name and changes the ending: examplecoin.co instead of examplecoin.com.** The attacker bets that a reader will not notice the missing letter or will assume the project owns that ending. The risk is highest for extensions that look like .com or that fit your sector. According to Wardmint's survey of 12 November 2026, 6 of the 10 extensions with the most phishing domains in Interisle's May 2025 to April 2026 data are sold here: .com, .pro, .info, .xyz, .shop and .icu. The choice of endings is explained in [which domains a crypto project should register](https://wardmint.com/which-domains-should-a-crypto-project-register/ "Which domains should a crypto project register?"). ## What is combosquatting? **Combosquatting adds a real word to the brand, such as login, support, claim or airdrop, and it fits the messages scammers send.** examplecoin-login.com looks like a page a project might own. A fake airdrop post carries a link to examplecoin-claim.com, and the visitor expects to see the brand in the address. Because the possible words are many, you cannot register all combinations: choose the words that appear in the scams already aimed at your sector and add the others as monitoring finds them. Words also exist as endings, which is why .support and .live appear in the endings set; see [defensive domain registration](https://wardmint.com/defensive-domain-registration/ "What is defensive domain registration?") for how a set is built. ## What is a homoglyph domain? **A homoglyph domain swaps a character for one that looks the same: a digit 1 for l, or the two letters rn for m.** examp1ecoin.com and exarnplecoin.com are pure ASCII and need no special handling. A second family uses letters from other alphabets, such as a Cyrillic а in place of a Latin a. Those names are stored in the xn-- punycode form and are covered in [what an IDN homograph attack is](https://wardmint.com/what-is-an-idn-homograph-attack/ "What is an IDN homograph attack?"). dnstwist builds its homoglyph names from a researched range of Unicode characters chosen so that the results can be registered. ## What is bitsquatting? **Bitsquatting registers a name that differs from yours by one flipped bit, and it relies on memory errors rather than human ones.** The letter e is 01100101 in ASCII and d is 01100100, so dxamplecoin.com is one bit away from examplecoin.com. A machine whose memory flips that bit while holding the address asks for the wrong name. Wardmint found no public count of bitsquatting in the sources it read, so it comes last in a defensive list; the other six exploit what a human reads or types. ## How do I defend against all seven? **Own the likeliest of each kind, redirect them, and use free tools for the rest.** Registration closes the names you hold: bulk search of up to 50 names at once, then one cart and one payment for all of them, at $128.94 a year for the six core names. For every name you do own, a "no email" DNS template (null MX, SPF -all, DMARC p=reject) so a defensive domain cannot be used to spoof your mail, free URL forwarding to send every variant to your main site, and automatic renewal from your balance so no variant lapses. A set of look-alike types is a checklist you can run on your own brand in an hour, and you can build the full list with the steps in [how to protect your brand from typosquatting](https://wardmint.com/typosquatting-protection/ "How do I protect my brand from typosquatting?"). ## Which look-alike types does Wardmint sell? Wardmint registers the ASCII names of a brand's own typo, omission, hyphen, extension, combination and homoglyph variants, within the 29 extensions it sells. It does not register look-alikes of someone else's brand, and its acceptable-use policy bans that. A look-alike domain is a registered name built to be mistaken for another; an owned variant is the same name held by the brand it imitates. ## Questions about look-alike domains ### Which kind of look-alike is most common in crypto phishing? Wardmint found no public count by kind in the sources it read. Combosquatting and extension swaps are the kinds attached to fake airdrop and support messages, so register those first. ### Is every look-alike domain illegal? No. Some are parked, some are held by unrelated owners. Whether one infringes depends on the law and, for a UDRP, on the three tests of the policy. ### Can a look-alike use a valid HTTPS certificate? Yes. Any domain can obtain one, so a padlock proves nothing about the owner. Certificate logs show issued certificates, which helps you spot new names. ### Should I register every typo of my name? No. Register the likeliest, redirect them, and watch for the rest. A list of 50 names fits in one bulk search. **In summary** - Seven kinds: typo, omission, hyphen, extension swap, combosquatting, homoglyph, bitsquatting. - Combosquatting and extension swaps fit fake airdrop and support messages best. - Homoglyphs include rn for m, 1 for l and non-Latin letters stored as xn--. - Bitsquatting needs a memory error: one bit flipped. - 6 of the 10 extensions with the most phishing domains (Interisle) are sold at Wardmint. - Wardmint registers a brand's own variants only, never those of another brand. ## Sources 1. [dnstwist, domain name permutation engine](https://github.com/elceef/dnstwist) — GitHub (elceef/dnstwist) (read 2026-11-12) 2. [Phishing Activity in TLDs, May 2025 to April 2026](https://www.cybercrimeinfocenter.org/phishing-activity-in-tlds-may-april-2026) — Cybercrime Information Center (read 2026-11-12) --- Wardmint: Wardmint registers the defensive domains a crypto project needs — its own name across the extensions phishers use, its own typo and look-alike variants — paid in crypto with no KYC: no ID, only one verified email per domain. It is run by DomaineGoat LLC, a company registered in Panama; domains are registered through its ICANN-accredited registrar partner. A .com costs $12.49/year, the same price every year.