Typosquatting

Typosquatting exploits the gap between what someone means to type and what their fingers actually produce: a transposed pair, a dropped letter, a doubled one, the wrong top-level domain. Each variant is a separate registration, each costs a few dollars a year, and each catches a small but reliable stream of a brand's own traffic.

The registered domain is rarely the attack. It is the delivery mechanism. Some variants park on ads and quietly monetise the misdirected traffic. Some redirect to a competitor. The dangerous ones stage a phishing page and wait for a campaign to point at them.

Because registration is cheap and instant while removal is neither, volume favours the attacker. The defensive move is to make the cost of staying registered higher than the cost of moving on: enumerate the whole cluster rather than chasing one domain at a time, and file against the shared infrastructure the cluster depends on.

Parked and redirecting variants are worth removing even though they look harmless. A domain that sits dormant for a year is a domain that can be weaponised on any afternoon, and by then it has aged, which makes it more credible to filters, not less.