Most organizations start with one domain, and that feels enough. But as a company becomes known, domains resembling its name can fall into other hands. Someone registers the name with a hyphen, someone swaps one letter, someone takes the same name in another zone. Such domains are used to confuse customers, send fake emails or divert traffic to a competitor. A defensive set means a few extra domains around the main one that the organization owns itself.
Which variants actually pose a risk
Buying every possible variant makes no sense; the cost never ends. A better approach is to think about which form customers are most likely to mistype and which a fraudster would choose. These groups usually come first:
- Hyphenated and unhyphenated spellings, such as
misolsavdo.uzandmisol-savdo.uz. - Forms spelled differently in Uzbek because of the apostrophe or letter pairs:
o'vso,shvss. - Typical fast-typing errors: a neighboring key, a doubled or missing letter.
- The same name in another zone, important for international customers.
A small family shop may need one or two variants, while a bank or large retail chain needs a wider set, because they are attractive targets.
Example: a building supplies chain in Tashkent
Imagine a building supplies store with several branches running on misolsavdo.uz. One day a customer asks about an email sent in the store's name requesting "prepayment for a discount" from an address on misol-savdo.uz. The store did not own that domain. Afterwards it registered the hyphenated variant, the most common typo and the name in an international zone for dealing with foreign suppliers. Had these been bought in advance, the fraudster could not have used them.
Redirecting extra domains to the main site
A defensive domain should not sit empty. Anyone typing it should land on the main site via a permanent 301 redirect, so browsers and search engines know which address is primary. On Apache, using .htaccess:
RewriteEngine On
RewriteCond %{HTTP_HOST} !^misolsavdo\.uz$ [NC]
RewriteRule ^(.*)$ https://misolsavdo.uz/$1 [R=301,L]On Nginx, a separate server block does the same:
server {
listen 443 ssl;
server_name misol-savdo.uz www.misol-savdo.uz;
# ssl_certificate and ssl_certificate_key for this domain
return 301 https://misolsavdo.uz$request_uri;
}Note that for the redirect to work over HTTPS, the extra domain also needs a valid SSL certificate. Otherwise the browser shows a security warning before redirecting, and the customer leaves.
Protecting a domain that never sends mail
Most defensive domains never send email, yet a fraudster may try to spoof messages from them. Three DNS records declare that no mail is sent from the domain at all:
misol-savdo.uz. TXT "v=spf1 -all"
_dmarc.misol-savdo.uz. TXT "v=DMARC1; p=reject"
misol-savdo.uz. MX 0 .The first says no server may send mail for the domain. The second asks receiving servers to reject such mail. The third, called null MX, announces that the domain accepts no mail. If your DNS page does not accept an MX with a dot value, SPF and DMARC alone still add real protection.
Keeping ownership and renewals in one place
The biggest risk is one domain expiring and passing to someone else. This usually happens when domains are registered to different employees in different accounts; an employee leaves, reminders go unread and the domain is released. Keep every domain in the organization's name in one shared account and turn on auto-renewal. In the sayt.uz cabinet, auto-renew extends the domain before expiry when the balance is sufficient, so check the balance from time to time. Also keep a simple register of each domain's purpose, redirect target, expiry date and SSL status, and review it yearly.
The limits of a defensive set
No set covers every lookalike name. Tell customers your official addresses clearly on the site and in emails, and state that payment requests come only from the main domain. If a lookalike of your brand is used for fraud, keep evidence and consult a lawyer, since the dispute procedure depends on zone rules and the law.