Preventing brand launch typosquatting comes down to timing. Secure your domain variants, trademarks, and social handles *before* anything about the new name becomes public, then monitor continuously from announcement day onward. Attackers register lookalike domains the moment a name leaks, so the defensive work has to finish before the first press release, trademark filing, or app store listing goes live.
This guide covers why launches are a magnet for typosquatters, which variants to lock down, and how to detect and remove the ones you miss.
What Is Brand Launch Typosquatting?
Typosquatting is registering domains that imitate a real brand's domain, counting on people to mistype, misread, or trust a familiar-looking name. Brand launch typosquatting is the same tactic aimed at a new product, company, or rebrand during the short window when the name is known but not yet established.
Attackers use these domains for credential phishing, fake checkout pages, invoice fraud, malware delivery, ad-revenue parking, or resale back to you at a markup. A new brand is an easy target because customers don't yet know what the "real" domain looks like. Any plausible URL passes.
Why New Launches Are Especially Vulnerable
Several things line up against you during a launch:
- Public signals leak the name early. Trademark applications, business registrations, beta invites, job postings, and code repositories can all reveal a product name before the official announcement.
- Customer familiarity is zero. People can't spot a wrong domain they've never seen right. A lookalike faces the same skepticism as your real site, and no more.
- Attention spikes on day one. Press coverage, social posts, and paid ads drive a wave of people typing and searching the new name. That wave is the traffic squatters want to intercept.
- Your own security isn't finished. New domains often launch without enforced email authentication, which lets attackers spoof your exact domain until DMARC is in place.
The Typosquatting Techniques to Plan For
Knowing the specific patterns tells you which variants to register and which to monitor.
Character-level tricks
- Omission and repetition: dropping or doubling a letter in your name.
- Transposition: swapping two adjacent letters.
- Adjacent-key substitution: replacing a letter with a neighboring key on the keyboard.
- Visual substitution: using a digit "1" for a lowercase "l", "0" for "o", or "rn" for "m". In many fonts these are nearly indistinguishable.
Homoglyphs and IDN attacks
Internationalized domain names (IDNs) allow non-Latin characters. Attackers register domains using characters from other scripts, such as a Cyrillic "а" in place of a Latin "a", which render identically on screen. Under the hood these domains are stored in punycode (beginning with "xn--"). Browsers display punycode in some cases but not all.
TLD swaps
If you launch on example.com, an attacker may take example.net, example.org, or a country-code or newer generic TLD. Customers rarely remember which extension a new brand uses.
Combosquatting
The attacker appends a believable word to your exact brand name: login, support, app, secure, billing, or the product's feature names. These domains contain no typo at all. That's why they work well in phishing emails.
Subdomain tricks
A URL like example.com.example.net puts your brand at the front, but the real domainis example.net. Readers scanning left to right see your brand and stop reading. Attackers use this in SMS and email links, where the full URL is often truncated.
How to Prevent Brand Launch Typosquatting: A Pre-Launch Checklist
Work through these steps in order, and finish them before any public signal goes out.
- Register the primary domain and key variants together. Buy them in a single session so the name isn't exposed through one registration days before the others. Prioritize the .com, your main country-code TLD, the most likely one-character typos, and the obvious combosquats such as login, app, and support versions of the name.
- Sequence your filings. Trademark applications are public records. Lock down domains and social handles before you file, or at least on the same day.
- Reserve social handles and app store names. Squatters impersonate brands on social platforms and in app listings as readily as on domains.
- Enable registrar lock and multi-factor authentication on your registrar account so nobody can hijack or transfer the domains you own.
- Publish email authentication before launch. Set up SPF and DKIM, then a DMARC policy that moves toward quarantine or reject. This stops attackers from spoofing your exact domain. It does not stop lookalikes, so you still need the other steps.
- Point defensive domains somewhere useful. Redirect owned variants to your real site so typo traffic reaches you. Configure null MX records on any variant that should never send or receive mail.
- Tell customers what's real. On launch day, state your official domain and support channels clearly, and say that you will never ask for passwords or payment by email.
You can't register every permutation, and you shouldn't try. Defensive registration covers the highest-risk variants. Monitoring covers everything else.
How to Detect Lookalike Domains After Launch
Spotting typosquats means generating thousands of permutations of your name and checking which ones exist. A useful check also asks whether each one is set up to cause harm. The warning signs that separate a dangerous lookalike from an idle one include:
- Active MX records, meaning the domain can send and receive email. This is a strong phishing indicator.
- A newly issued TLS certificate. Certificate transparency logs record these publicly, often before a phishing page goes live.
- A recent WHOIS registration date clustered around your announcement.
- Live web content that copies your branding, login pages, or checkout flow.
Dokyma does this work for you. A scan at dokyma.com generates typo, homoglyph, TLD, and combosquat permutations of your brand. It checks DNS and WHOIS for each one, flags domains with mail servers or fresh certificates, and keeps watching certificate transparency logs, so new lookalikes surface as soon as they appear. Start that monitoring before launch day so you have a clean baseline. That way, anything registered after the announcement stands out.
What to Do When You Find a Typosquat
- Document it first. Capture screenshots, registration details, and DNS records before the site changes or disappears.
- Report active phishing quickly. Send abuse reports to the domain's registrar and hosting provider, including your evidence. Live phishing pages are often removed fastest this way.
- Warn your users if the domain is sending email or running ads that target your customers.
- Pursue the domain itself if it's worth owning. The UDRP dispute process can transfer a domain that is confusingly similar to your trademark and was registered in bad faith. Talk to counsel before buying it back from a squatter, since paying can encourage more squatting.
- Add it to your watchlist. Parked domains can be weaponized later, so keep monitoring anything you don't take down.
Check Your Brand Before You Announce It
The cheapest typosquat to deal with is the one you register first. Before your next launch, rebrand, or product announcement, run a free brand scan at dokyma.com. You'll see which lookalike domains already exist, which have live mail servers or certificates, and which variants are still open for you to register defensively.