Quick answer
How do I protect my brand from typosquatting?
Protect a brand from typosquatting by registering its own likely typos and extensions before phishers do, pointing them at your site, and watching for the rest. Wardmint registers a brand's own variants only, never someone else's, with a bulk search of up to 50 names and $128.94 for the core set.
Four steps and the tool for each
| Step | What to do | Tool | Cost |
|---|---|---|---|
| 1. Own | Register your name across extensions and your likeliest typos | Wardmint bulk search | $128.94 a year for the core set |
| 2. Lock | Redirect each name, publish a no-email DNS template, switch on the transfer lock | Client area | Free with the domain |
| 3. Watch | Generate look-alikes and check which exist; follow certificate logs | dnstwist, crt.sh | Free |
| 4. Respond | Report the registrar and host; file a UDRP if you hold a mark | Abuse forms, WIPO | Reports free; UDRP from USD 1,500 |
What is typosquatting, and is it always an attack?
Typosquatting is the registration of a domain that differs from a known one by a likely mistake, and it ranges from harmless parking to credential theft. The variants include a missing letter, two swapped letters, a doubled letter, a hyphen or a different extension. The seven families are described in what kinds of look-alike domains phishers register. For a crypto project the harmful cases dominate, because a victim who lands on a copy of your front end is asked to sign a transaction, not to read a page. Interisle found that 77% of phishing domains in its 2025 report were registered by the criminals themselves, so the names are bought for the purpose.
Which variants of my own name should I register?
Register the variants a real user would produce by accident, in order of likelihood, and stop when the list reaches your budget. For a name like examplecoin.com: one omitted letter (exmplecoin.com), two swapped letters (examplecion.com), your name with a hyphen (example-coin.com), your name on the core extensions (.net, .org, .io, .xyz, .app) and your name with the words users meet in scams (examplecoin-claim.com). A visual substitution such as rn for m (exarnplecoin.com) deserves a place too.
The method is in how to build a defensive domain list. Everything you register must be your own brand's: Wardmint's acceptable-use policy bans registering look-alikes of a brand you do not own, and we refuse such orders.
What should I do with the names once I own them?
Redirect every variant to your main site over HTTPS and publish a DNS template that sends no mail. A visitor who mistypes then arrives at the right place, and nobody can send email from the typo domain that appears to come from you. The client area provides a "no email" DNS template (null MX, SPF -all, DMARC p=reject) so a defensive domain cannot be used to spoof your mail, free URL forwarding to send every variant to your main site, and automatic renewal from your balance so no variant lapses. A transfer lock is available per domain: a transfer lock you switch on or off for each domain in the client area; the transfer (EPP) code is requested there too. Wardmint provides free DNS hosting with A, AAAA, CNAME, ALIAS, MX, TXT, NS, SRV and CAA records, managed DNSSEC, and your own nameservers if you prefer (2 to 13).
The records for the mail template are in how to stop email spoofing on unused domains.
How do I find the typosquats I did not register?
Run a permutation tool against your domain and compare the results with what exists. dnstwist is an open-source tool that generates look-alike names, including homoglyph and hyphenation variants, and checks which of them are registered. Certificate transparency logs show certificates issued for names containing your brand string, often before the page goes live. Both are free. The steps and commands are in how to find look-alike domains of your brand.
Wardmint does not sell monitoring: the point of the guide is that you can do the basic version yourself.
What can I do against a typosquat that already exists?
Report it to the registrar and the host with evidence, and file a UDRP complaint if it is worth the fee and you hold a mark. Since 5 April 2024, ICANN's DNS abuse amendments require registrars to act promptly on actionable evidence of phishing, malware, botnets and pharming, so a documented report can lead to suspension. For a name that is not abusive but infringes, the UDRP can transfer or cancel it: WIPO charges USD 1,500 with a single panelist for 1 to 5 domains, and the procedure needs rights in a mark. Reporting steps are in how to report a phishing domain.
What does Wardmint's data show about typosquat risk?
According to Wardmint's survey of 12 November 2026, 6 of the 10 extensions with the most phishing domains in Interisle's May 2025 to April 2026 data are on sale here: .com, .pro, .info, .xyz, .shop and .icu. All 29 extensions cost less than Namecheap's regular renewal, by a median of 33%.
Typosquatting protection is the practice of owning your likeliest misspellings and watching for the others. Wardmint sells the first half of that practice for a flat yearly price and publishes free guides for the second.
Questions about typosquatting
Can I register typos of a competitor's name to redirect their users?
No. That is typosquatting against someone else's brand, and Wardmint's acceptable-use policy bans it. We register a brand's own variants for that brand only.
How many typo domains do I need?
Start with a dozen for your main .com plus the core set of extensions. Add more when monitoring shows a pattern in what attackers register.
Does a registered typo stop all phishing?
No. It closes the names you hold. Attackers can use any other name or a different domain entirely, so keep monitoring and a reporting routine.
Is a UDRP complaint available without a registered trademark?
It requires rights in a mark. Unregistered marks are accepted in many cases, but you must show use. Check the provider's rules before you pay the fee.
Who pays for the domains if the project is a DAO?
Any wallet or multisig can top up the prepaid balance in BTC, USDT, USDC, ETH, SOL, LTC, with a minimum of $25.
In summary
- Register your own typos and extensions; never those of another brand.
- Redirect each name and publish a no-email DNS template.
- Find the rest with dnstwist and certificate logs, both free.
- ICANN's rules in force since 5 April 2024 oblige registrars to act on actionable evidence of phishing.
- A WIPO UDRP costs USD 1,500 for 1 to 5 domains and needs a mark.
- The core set costs $128.94 a year; 6 of the 10 most phished extensions are sold here.
Sources (5)
- dnstwist, domain name permutation engine — GitHub (elceef/dnstwist) (read 2026-11-12)
- Interisle Phishing Landscape 2025, press release — Interisle Consulting Group (read 2026-11-12)
- Phishing Activity in TLDs, May 2025 to April 2026 — Cybercrime Information Center (read 2026-11-12)
- Advisory on compliance with DNS abuse obligations in the RAA and RA — ICANN (read 2026-11-12)
- WIPO UDRP fee schedule — WIPO Arbitration and Mediation Center (read 2026-11-12)