Direct answer: Typosquatting registers domains one typo, one swapped letter, or one added word away from a brand's real address, then clones the store to capture mistyped visits and run lookalike promotions. Finding them takes systematic permutation searches and certificate and registration monitoring, not luck. Removal routes run through the registrar's abuse desk, the host, payment processors, and, for stubborn cases, UDRP complaints, which are built for exactly this abuse.
Your customer typed your address from memory, missed by one letter, and landed on a store that looks like yours, priced like a sale, and built to take money and ship nothing real. Typosquatting is the oldest trick in domain abuse because it keeps working: the traffic is free, pre qualified, and already trusts the name.
This guide covers how squatters build these traps, how to enumerate the domains pointed at your brand before customers find them, and which takedown levers close them fastest.
The operator registers a batch of variants: the missing letter, the transposed pair, the plural, the hyphen, your brand plus shop, store, sale, or your country code. Modern registration is cheap and automated, so assume the full permutation set exists the moment your brand is worth copying.
On the domain sits a cloned storefront scraped from your real one, running a permanent too good sale. Orders are either dropshipped as counterfeits, harvested for card details, or simply never shipped. The site rarely needs to be good. It needs to be plausible for the ninety seconds a mistyped visit lasts.
Generate the permutation list yourself: every single edit of your domain, keyboard adjacent substitutions, homoglyph swaps, and the common suffix and prefix additions, then check which resolve, which hold certificates, and which serve content. Certificate transparency logs are the pros' shortcut: new certificates for lookalike names announce a launch before the store even opens.
Repeat the sweep on a schedule and after every spike in lookalike activity, like a product launch the counterfeiters will happily ride. Parked domains get noted and watched rather than fought; the ones serving cloned stores are the emergencies, because every day live is a day of diverted orders and poisoned trust.
Start parallel, not sequential: the registrar's abuse desk for a domain registered and used in bad faith, the host for the infringing content, and the payment processors whose logos the fake store borrows, because losing payments ends the store's reason to exist even while the domain fight continues.
For domains that shrug off abuse desks, the UDRP is the purpose built remedy: a trademark owner shows the domain is confusingly similar, the registrant has no legitimate interest, and registration and use are in bad faith. It is slower than an abuse desk and far faster than court, and a cloned store is nearly the fact pattern it was designed for.
Brands with the budget register the highest risk variants themselves, particularly the one letter typos of their main domain and the brand plus sale and shop combinations, and point them at the real store. It feels like paying ransom to the dictionary until compared against one season of diverted customers.
The rest is hygiene: keep your trademark portfolio current, list official domains where customers can verify them, and make your real store's support team aware of the active fakes, because the first report of a typosquat store usually arrives as a confused customer asking where their order is.
Related reading: Fake Storefronts and Listing Impersonation: How Sellers Spot Them Early, Copyright vs Trademark for Marketplace Sellers: Which One Protects What, and Trademark Watch Services: Catching Confusing Filings Before They Register.
Cybersquatting registers a brand's actual name as a domain, usually to resell it or block the brand. Typosquatting registers near misses, the typos and variants, to intercept traffic meant for the real site. The fake store problem is mostly typosquatting, because the goal is your visitors, not your name itself.
No search finds literally every one, but permutation generation plus certificate transparency monitoring covers the realistic set: single edits, transpositions, keyboard neighbors, homoglyphs, and word additions, checked for resolution and content. Run it on a schedule, because new registrations appear constantly.
The Uniform Domain Name Dispute Resolution Policy is an administrative process run through approved providers that can transfer or cancel a domain registered and used in bad faith. It suits cloned stores and clear bad faith cases, costs far less than litigation, and typically resolves in about two months.
For the handful of highest traffic variants, usually yes: the one key typos and your brand plus shop or sale are cheap insurance compared with the support cost and lost orders from one active fake. You cannot buy every permutation, so monitoring and takedown still carry most of the weight.