Typosquatting Domain Generator

Typosquatting is registering a domain that is one slip away from a real one. Someone who types gogle.com or examplle.com lands on a site the attacker controls, which may show ads, install malware or imitate the real login page. The same idea powers phishing e-mails, where the sender’s domain is a close imitation of the brand. If you own a domain, it is worth knowing which variants exist in principle. This page lists them so that you can register the most dangerous, watch the rest and train staff on what to look for.

The techniques

Omission drops a letter (xample.com), repetition doubles one (eexample.com), and transposition swaps two neighbours (xeample.com). Keyboard replacement substitutes a letter with one next to it on a QWERTY keyboard (wxample.com), and neighbouring-key insertion adds such a letter beside the right one (wexample.com). Look-alike characters swap in digits and letters that read similarly, such as 3xample.com. Hyphenation inserts a hyphen (e-xample.com) and vowel swaps replace a vowel with another. Bit-flip variants change one bit in a character, giving names such as gxample.com or axample.com. Different top-level domains and added keywords such as login, secure or support complete the set.

A worked example

Press Sample, which enters example.com. The page produces 172 variants across 11 techniques: 42 neighbouring-key insertions, 29 bit flips, 24 keyboard replacements, 22 different top-level domains, 18 added keywords, and 7 omissions, 6 repetitions, 6 transpositions, 6 look-alike characters, 6 hyphenations and 6 vowel swaps. Click a technique name to see only those rows. The first rows already show the pattern: xample.com (omission), eexample.com (repetition), xeample.com (transposition) and wxample.com (keyboard replacement).

Deciding what to register

Registering everything is neither affordable nor useful. Rank the list by how likely a human is to make the slip or be fooled: omissions and transpositions of short names, doubled letters, plausible hyphenations, and the same name under the main top-level domains such as .net, .org and your country code. Add the added-keyword group if your brand is a frequent phishing target. Bit flips matter mostly for very high-traffic domains.

Monitoring

For the variants you do not register, put the list into a monitoring service or your own script that checks DNS now and then and alerts when a variant starts resolving or gets a certificate. Certificate transparency logs show new certificates for look-alike names within hours. Download the CSV to feed such a tool, and keep it with your brand protection records.

Internationalised look-alikes

With the extra option turned on, the page adds variants in which Latin letters are replaced by Cyrillic or Greek ones that look the same. These are the names that the IDN Homograph Detector explains, and they are usually the most deceptive, since they look identical on screen.

Limits

The page generates names; it does not check registration, reputation or content. It does not know which variants are legal to register in a given registry. The list is a model of attacker methods, not a complete one: tricks that depend on subdomains or paths are out of scope.

Related tools

• IDN Homograph Detector analyses the look-alike names this page can generate.
• URL Defanger makes suspicious links safe to share in a report.
• Punycode Converter shows the network form of internationalised variants.
• IOC Extractor pulls domains out of incident text.