Should You Buy the Typo Versions of Your Domain? A Founder's Typosquatting Playbook
Sooner or later a founder reads about typosquatting and does something expensive: registers 40 misspellings of their own brand in one panicked evening. Ten years of renewals later, 39 of those domains have never received a visitor. The threat is real, but it is narrow. A handful of typo patterns cause nearly all the damage, and the most effective defences have nothing to do with registering more domains. This guide shows where to spend and where to stop.
Add ZeroTaken as a preferred source on Google
What is typosquatting, and how does it actually hurt you?
Typosquatting means registering a near-miss of a popular domain and waiting for mistakes. The squatter earns money from ads on the parked page, redirects visitors to an affiliate offer, or builds a lookalike site that harvests logins and card numbers. The first two cost you traffic. The third costs your customers money and your brand its reputation.
Note that who is typing matters. A typo only turns into a visit when someone types your URL by hand. Most people reach a known brand through search, bookmarks or links, so a misspelling gets a trickle of traffic. For a young company with no direct-type habit yet, that trickle is close to zero.
The more dangerous variant is not a visitor typo at all. It is a lookalike used in email: an invoice from your-brand-billing.com, or a message from a name that differs from yours by one swapped letter. The target is your customers' inboxes, not their address bars. That changes which defences matter.
Which typo patterns are worth worrying about?
Typo domains fall into a few families. Only some of them are likely enough, or harmful enough, to justify a registration fee:
- Missing .com or a wrong TLD: yourbrand.co, yourbrand.cm and yourbrand.om are the classic fat-finger cases. The ones that are real, working extensions are the most dangerous, because a squatter can actually use them.
- Dropped or doubled letters: yourbrnd.com, yourbrandd.com. Common on long names, rare on short ones.
- Transposed letters: yourbrnad.com. Real, but typing habits vary so widely that no single transposition dominates.
- Adjacent-key slips: a letter swapped for its neighbour on the keyboard. Predictable, but still individually unlikely.
- Plural or singular forms: yourbrands.com when you own yourbrand.com. Worth thinking about because people guess it without any typing error at all.
- Hyphen and spacing variants: your-brand.com. Matters mainly if your name is two words.
- Lookalike characters (homoglyphs): swapping an l for a 1, or an o for a 0, or using a visually identical character from another alphabet. Rare to see in an address bar, but the favourite trick of phishers because a quick glance misses it.
How many typo domains should a startup actually register?
Our opinion: almost none until you have a reason. Before launch, spend your money on the extension and spelling decisions that shape the brand itself. A pre-revenue startup that registers a dozen typos is paying renewals to defend traffic it does not have.
A sensible order of priority once you do have customers and revenue:
First, the obvious exact-name variants on the TLDs your audience really uses. If you are on .com, that is usually the .co and .net equivalents, and the plural or singular form if it is a natural guess. Second, the single most common misspelling of your name, which you will notice quickly because customers and support emails will keep spelling it that way. Third, nothing else, unless something happens.
Everything beyond those three is a bet against very unlikely events. If a specific lookalike causes trouble later, you can respond to that specific domain, and the response (see below) often costs less than owning the domain would have.
- Own now: your main name, the real-word plural or singular if it is a plausible guess, and the one-or-two TLDs your customers would naturally try.
- Own once you see it: the specific misspelling your customers keep making.
- Do not own: dozens of speculative adjacent-key and transposition variants.
How do you find out which typos are actually in use?
Do not guess. You can check what already exists in about an hour. Generate the likely variants of your name by hand (dropped letter, doubled letter, plural, common TLD swaps) and check which are registered. A free-to-register typo means nobody has bothered yet, which is a signal of its own: if no squatter wants it, you probably do not need to either.
For the ones that are registered, look at what they do. Load each one in a browser and a private window. A parked page with generic ads is low risk. A redirect to a competitor or an affiliate offer is worth acting on. A page that copies your branding or has a login form is urgent.
You can check availability of a batch of variants quickly with the free ZeroTaken domain search, and look up who registered a taken one with the WHOIS tool. Treat a result as a starting point and always confirm at the registrar before you buy.
What protects you better than owning every typo?
Registrations defend the address bar. The bigger risk to most small companies is email and customer trust, and the defences for that are cheaper and more effective:
Set up SPF, DKIM and DMARC on your real domain, and move DMARC to a policy of reject once your legitimate mail passes. This stops someone from sending mail that claims to be from your exact domain. It does not stop a lookalike domain, but it removes the easiest attack and is the baseline every customer's mail filter increasingly expects.
Tell customers how you will contact them. A line in your onboarding and invoices such as "We only send billing email from our exact domain" teaches users to be suspicious of lookalikes, and no registration can do that for you.
Keep your trademark position in order. If your brand is a registered mark, a clear lookalike that targets your customers gives you a legal route, which brings us to the next section.
- Publish SPF, DKIM and DMARC for the main domain.
- Use one consistent sending domain for customer email, and say so publicly.
- Enable registrar lock and two-factor authentication on your own domains, so the domains you do own cannot be hijacked.
- Set a recurring calendar reminder to re-check your top variants each quarter.
Can you take a typo domain away from a squatter?
Sometimes. The main route for generic domains is a UDRP complaint, a dispute procedure run by approved providers. In outline, you must show the domain is identical or confusingly similar to a mark you hold, that the owner has no legitimate interest in it, and that it was registered and is used in bad faith. A parked page full of ads or a site impersonating you tends to help your case. A domain that has simply never been used is a weaker target.
Two practical points. First, you generally need trademark rights to succeed, so an unregistered brand is in a weaker position. Second, a complaint costs money and time, so it only makes sense against a domain that is actively hurting you. Against a harmless parked typo, spending nothing is the right answer.
If a lookalike is being used for phishing, report it first to the registrar and the hosting provider. Abuse teams often act faster than any legal process. This is general information, not legal advice, so talk to a lawyer before filing anything.
What is the short version?
Buy the few variants that real people will plausibly type, skip the rest, and spend the savings on email authentication and a clear message to your customers. Typo defence is insurance, and good insurance matches the size of the risk. For most startups that means a small number of domains, not a portfolio.
When you are ready to check your name and its most likely variants, the free ZeroTaken search will tell you what is already registered.