Your customer types your address from memory, misses by one letter, and lands somewhere that looks like you. That somewhere harvests their login, takes their payment for an order that never ships, or delivers malware wearing your branding. Typosquatting is old, cheap, and still effective because the traffic is self delivering.
This guide covers the variations worth caring about, the monitoring that finds them while they are still being set up, and takedown routes ordered by speed.
Effective lookalikes cluster in a few families: single letter swaps, omissions, and doublings on the keyboard paths people actually mistype, your brand hyphenated with a product or support word, your brand on a different extension, and homographs using characters that render identically. Generate that list mechanically once, a few hundred candidates for a typical brand, and it becomes a checklist rather than a fog. Most will never be registered. The point of the list is monitoring precision: when one of them activates, you want to know the same week, not in a customer complaint next quarter.
The most useful early warning is the public certificate log. A lookalike domain usually obtains a TLS certificate shortly before its site goes live, and free monitoring services watch those logs for strings resembling your brand. Pair certificate alerts with registration monitoring and a weekly automated check of which lookalike candidates now resolve, have websites, or have mail servers configured. Mail records matter: a lookalike with mail set up and no website is being used for phishing, which is more urgent than a parked page, and your own customers will be its targets.
Not every lookalike earns the same response. Parked and inactive: log and watch. Redirecting to competitors or serving ads: a trademark complaint through the registrar, and a record for the pattern. Actively impersonating with a copied site, login form, or checkout: escalate immediately through the host, the registrar abuse desk, browser safe browsing reports, and your payment and platform contacts if it is taking money. Speed matters most in the third tier because every day live is a day of harvested customers, and hosts act fastest when the report includes screenshots, your trademark details, and the specific harm in one packet.
Registering every variation is financially absurd, but the closest handful, the most common misspelling, your brand on the two or three extensions customers plausibly guess, and your brand plus support or shop if you run those functions, costs little and removes the easiest attacks. Redirect them to your real site and log the traffic; a defensive domain receiving steady visits is telling you how many customers mistype you, which is also an argument for making your real address simpler in print and advertising. Review the defensive list when your brand or product names change.
Often, yes, through the uniform domain dispute process for bad faith registrations that target your trademark, or through courts in clear fraud cases. Dispute processes take weeks to months and cost filing fees, so they suit valuable or dangerous domains; simultaneous host and registrar abuse reports handle the immediate harm faster.
A legitimate business with a similar name on another extension is a trademark analysis, not an automatic takedown. Impersonation, copied branding, phishing, and selling counterfeits are what make a lookalike actionable. Document what the site does, not just what it is called.
Publish a short alert through your real channels linking only your genuine domain, tell customers you never ask for credentials or payment outside it, and give them a reporting route. Keep the alert up while the fake is live, then fold the guidance into your permanent help pages.
A basic version, yes: certificate and registration alerts for your exact brand string are free or cheap and run themselves. Small brands get targeted precisely because attackers assume nobody is watching, and the first warning usually otherwise arrives as a defrauded customer.