Defensive domain registration means buying the domain variants an attacker would most likely use to impersonate you, so they can't be registered for phishing, fraud, or traffic theft. Prioritize your brand on the TLDs that matter to your market, your most likely typos, and combinations of your brand with words like "login" or "support." Then point all of them at your real site.
You can't buy every possible variant, and you shouldn't try. The goal is to close off the handful of lookalikes that would fool a customer or employee, and to monitor everything else.
What defensive domain registration protects against
Attackers register lookalike domains, a practice called typosquatting or domain impersonation, for a few predictable reasons:
- Phishing: A convincing domain hosts a fake login page or sends email that appears to come from you.
- Invoice and payment fraud: A lookalike sends spoofed emails to your customers or finance team asking for payment to a new bank account.
- Traffic and ad hijacking: Mistyped visits get monetized with ads, affiliate redirects, or malware.
- Reputation damage: Counterfeit storefronts or scam pages trade on your name.
Defensive registration works because a domain you own can't be used against you. It's the cheapest control you have, since no one has to spot the fake if the fake never exists.
Which domain variants to buy, in priority order
Rank variants by how plausible they look to a human and how useful they'd be to an attacker. Work down this list until the remaining variants are low-risk enough to monitor rather than own.
1. Your exact brand on key TLDs
If you own the .com, an attacker's easiest move is registering the same name on another extension. A message from example.net or example.org reads as legitimate to most people.
Secure these:
- .com, .net, and .org
- Country-code TLDs for every market where you sell or have staff
- The extensions closest to your industry or product, such as .app, .io, .co, or .shop
- The .co extension if you own .com, because it's one dropped letter away
2. High-probability typos
Typo variants catch both accidental traffic and deliberate phishing. Focus on the .com version first. The common patterns are:
- Omission: a dropped letter, like "exmple" for "example"
- Transposition: two adjacent letters swapped, like "exmaple"
- Adjacent-key substitution: a neighboring keyboard key, like "exampke"
- Doubling: a repeated letter, like "exammple"
- Missing dot: "wwwexample" registered as its own domain, which catches users who skip the period after "www"
Short brand names produce few typos, so cover them all. Long names produce dozens. For those, buy the transpositions and omissions that look most natural, especially in the first and last few characters, where readers pay attention.
3. Hyphen and plural variants
If your brand is two words, register the hyphenated form ("ex-ample") and the joined form. Add the plural or singular form if your name works both ways. These variants read as entirely legitimate in an email signature or a link.
4. Combosquatting variants
Combosquatting attaches a trusted-sounding word to your brand, such as "example-login," "examplesupport," or "example-billing." These domains contain no typo, so security-aware users often trust them more.
Consider registering combinations with:
- Account words: login, signin, account, secure, verify
- Money words: pay, billing, invoice
- Help words: support, help
- Product words: app, portal, mail, plus your main product name
You can't own every combination. Buy the ones tied to workflows customers actually use with you, like login, billing, and support, andlet the rest go to monitoring.
5. Homoglyph and IDN variants
Homoglyphs are characters that look alike: "rn" for "m," "vv" for "w," the digit "0" for the letter "o," or "l" for "I." Internationalized domain names (IDNs) take this further by swapping a Latin letter for an identical-looking one from another script, such as a Cyrillic "а" in place of a Latin "a." The result can be visually indistinguishable in many fonts.
Buy the ASCII lookalikes for your .com, since they need no special registration. Many registries and browsers restrict mixed-script IDNs, so full coverage is often impractical. Register the most convincing single-character IDN swaps of your primary domain, and leave the rest to monitoring.
What not to waste money on
- Obscure TLDs with no link to your market. A variant on a niche extension rarely fools anyone.
- Far-fetched typos. Three errors deep, a domain stops looking like yours.
- Every combosquat permutation. The list is effectively infinite, so watch for these instead of buying them.
Configure your defensive domains so they can't be abused
Owning a domain isn't the finish line. Set each defensive domain up so it's useful to customers and useless to spoofers:
- Redirect web traffic with a permanent (301) redirect to your main site, so mistyped visitors land somewhere safe.
- Block email spoofing on domains that never send mail. Publish an SPF record of "v=spf1 -all," a null MX record, and a DMARC policy of p=reject. Receiving servers will then reject mail claiming to come from that domain.
- Turn on auto-renew and registrar lock. A lapsed defensive domain is a gift to attackers, because they can register it the day it drops.
- Consolidate at one registrar account with multi-factor authentication, so renewals and ownership don't get scattered across teams.
Monitor the variants you didn't buy
Defensive domain registration covers your highest-risk variants. Monitoring covers the long tail. The warning signs that a lookalike is being prepared for an attack include:
- MX records appearing, which means the domain can send and receive email
- A new TLS certificate issued for the domain, visible in certificate transparency logs
- Recent registration with privacy-shielded WHOIS
- A live page that copies your branding or login screen
Dokyma does this work for you. It generates typo, homoglyph, TLD, and combosquatting permutations of your brand, checks which are registered, inspects their DNS, MX, and WHOIS data, and watches certificate transparency logs for new certificates. When a lookalike starts gearing up, you know before your customers see it, while you still have time to file a takedown or warn your users.
Your next step
Before you buy anything, find out which variants are already taken and which are dangerous. Run a free brand scan at dokyma.com to see every registered lookalike of your domain, which ones have mail servers or certificates set up, and which unregistered variants you should secure first. Use that list as your shopping list, and let Dokyma keep watching the rest.