What Is Typosquatting?

Typosquatting is the registration of domain names that imitate a legitimate brand — usually by exploiting common typos, character substitutions, or visually similar Unicode characters. The squatter relies on users mistyping a URL or failing to spot a swapped character, then collects the misdirected traffic for phishing, malvertising, or credential theft.

How Whisper models it

HOSTNAME (brand)—whisper.variants()→HOSTNAME (lookalike)

whisper.variants generates 14 algorithmic permutations and returns the ones that exist as registered HOSTNAME nodes.

Common Typosquatting Patterns

Insertion / deletion — goggle.com, gogle.com.
Substitution — paypa1.com (1 for l), gooogle.com.
Adjacent-key swaps — gokgle.com.
Homoglyph / IDN — Cyrillic а for Latin a, mixing scripts in internationalized domain names.
Brand + word — google-secure-login.com, microsoft-update.support.
TLD variation — registering brand.co or brand.app to shadow brand.com.

Why Typosquatting Persists

Domains are cheap. A few hundred dollars buys a portfolio of variations on any major brand. Even a small fraction of click-through traffic is monetisable through ads, affiliate links, or — more often — credential phishing kits that mirror the legitimate site.

How to Detect Typosquats Against Your Brand

Generation + check — algorithmically produce typo variants and look up each in DNS.
Passive DNS sweeps — find any registered domain similar to your brand and check whether it has ever resolved.
Certificate transparency monitoring — newly issued TLS certificates for typo variants are an early warning.
DNS twin detection tools — dnstwist, urlcrazy, and similar produce candidate lists in seconds.

Defenses

Defensive registration of high-risk variants.
Active takedown via UDRP / URS / hosting-provider abuse desks.
Browser, email, and DNS-layer blocking on flagged variants.
Brand-protection partnerships that monitor at scale.

Typosquatting in Whisper

Whisper ingests new domain registrations across all major TLDs in near-real-time. Brand-protection teams can register a watchlist for "domains within edit distance N of brand.com" and surface every typosquat as it appears, with full WHOIS, DNS, and hosting context attached.

See it in practice

Run it live in these use cases: Catch live lookalike domains.