Typosquatting: should you also register misspelled domains?

Typosquatting is the practice of registering a domain that looks almost exactly like a well-known address but contains a common typo. People type quickly, drop a letter, swap two neighbours or hit the key next door, and instead of the intended site they land on someone else's. That page may show ads, a competitor's offer or a fake login form. This is why many companies quietly register the most dangerous variants of their own name before anyone else does.

How look-alike domains are chosen

Typosquatters pick names based on how people actually make mistakes. The most common is a missing letter, such as misolshp.uz instead of misolshop.uz. Next come swapped adjacent characters and doubled letters, plus neighbouring keys like o and p or n and m. Other extensions are a separate risk: if you only own the .uz name, the same name in .com may be free, and many visitors type .com out of habit. Hyphenated versus unhyphenated spellings and singular versus plural forms create similar confusing pairs.

Why it is dangerous

The biggest threat is phishing. A fraudster clones your site on the misspelled domain and sends customers an email or SMS asking them to confirm an order. The victim does not notice a one-letter difference and enters a password or card details, then blames your brand. Email is the second risk: if the look-alike domain accepts mail, messages that staff or partners send with a typo in the address, including contracts and invoices, end up with a stranger. The mildest outcome is simply lost traffic to an ad page or a competitor.

Which variants are worth registering

You cannot register every possible typo, and you do not need to. Even a short name produces dozens of variants, each with a yearly renewal. Focus on the likely and the harmful ones:

your main name in other popular extensions, especially .com;
the hyphen-free version if your name has a hyphen, and vice versa;
frequent missing-letter or doubled-letter typos;
alternative spellings such as x/h or i/y;
brand plus words like "login" or "pay" if customers pay online.

Take an appliance store in Tashkent running on texnomisol.uz and accepting Click and Payme payments. It makes sense to hold texnomisol.com, tehnomisol.uz (people often write "h" for "x") and texno-misol.uz. Rare typos like tdxnomisol.uz are usually wasted money. A small café or a brochure site that collects no logins or payments can stop at two or three core variants; banks, online stores and services with user accounts need wider coverage.

Point them at your main site

A registered typo domain left empty helps little. Connect it to the main site with a permanent 301 redirect so lost visitors arrive in the right place and search engines treat one address as canonical. In Nginx:

server {
    listen 80;
    listen 443 ssl;
    server_name tehnomisol.uz www.tehnomisol.uz texnomisol.com www.texnomisol.com;
    # ssl_certificate and ssl_certificate_key cover these names
    return 301 https://texnomisol.uz$request_uri;
}

Each extra domain needs its own SSL certificate, otherwise HTTPS visitors see a warning before the redirect happens. On sayt.uz hosting, Let's Encrypt certificates are free and renew automatically, so secure redirects for extra names are easy. On Apache the same is done in .htaccess:

RewriteEngine On
RewriteCond %{HTTP_HOST} !^texnomisol\.uz$ [NC]
RewriteRule ^(.*)$ https://texnomisol.uz/$1 [R=301,L]

If a defensive domain is never used for email, give it no MX record and publish strict SPF and DMARC records so nobody can send mail in its name:

tehnomisol.uz.        IN TXT "v=spf1 -all"
_dmarc.tehnomisol.uz. IN TXT "v=DMARC1; p=reject"

Watching the variants you do not own

Check the main typo variants of your name from time to time and note any change. If a suspicious domain starts serving a site or accepting mail, you want to know early:

whois tehnomisol.uz
dig +short A tehnomisol.uz
dig +short MX tehnomisol.uz

If you find a phishing page, save evidence first: screenshots, dates, customer complaints. Then file abuse reports with the hosting provider and the registrar and warn customers through official channels. With a registered trademark, legal recovery of the domain may be possible, so talk to a lawyer. Finally, tell customers your one official address, always send messages from the same domain, and train staff to read links letter by letter. Those habits defeat most typo attacks.