Typosquatting Domain Generator

Typosquatting is when an attacker pre-registers a domain that differs from a well-known one by a single character, hijacking visitors who mistype the address. These look-alikes are used for phishing pages, fake login forms, malware delivery and ad redirects. This typo domain generator takes the SLD of your domain (the example in example.com) and instantly expands the typos people commonly make plus the visually confusing variants attackers exploit.

It produces character omission, adjacent transposition, QWERTY-adjacent replacement, character insertion, repeated characters, homoglyphs (o↔0, l↔1, rn→m) and hyphenation, along with TLD swaps such as .com → .net/.org/.co/.io/.cm. Brand-protection owners, security teams and domain administrators can quickly enumerate which look-alikes to monitor or defensively register. Everything runs in your browser and nothing is sent anywhere.

Variant types generated

Each candidate models a real human input error or a visual illusion. The groups are:

• Character omission: a dropped letter (exmple.com).
• Adjacent transposition: two neighboring letters swapped (examlpe.com).
• QWERTY-adjacent replacement: hitting the neighboring key (wxample.com).
• Character insertion: an extra letter added (exaample.com).
• Repeated character: the same letter typed twice (exxample.com).
• Homoglyph: a look-alike substitution (example.com → examp1e.com).
• Hyphenation: a hyphen inserted mid-word (exam-ple.com).
• TLD swap: the same name on a different top-level domain (example.net, example.io).

Using it for brand protection and phishing monitoring

The list is a starting point for monitoring, defensive registration and takedowns. A typical workflow:

1. Enter your core brand domain to extract every candidate.
2. Prioritize high-probability variants (homoglyphs, transpositions, TLD swaps) for defensive registration or monitoring.
3. Check the rest via WHOIS / Domain Lookup for actual registration and DNS Record Lookup for hosting IP and MX records (mail-phishing risk).
4. When abuse is found, respond via registrar abuse reports, a UDRP dispute, or Safe Browsing reports.

Limits and caveats

This tool only generates candidate strings. It does not tell you which are actually registered, live, or who owns them. A long SLD can also produce hundreds of candidates, not all of which are real threats — confirm registration, traffic and content to set priorities. Internationalized domain (IDN / punycode) homoglyph attacks span a far wider Unicode range, so high-risk brands should also consider a dedicated IDN monitoring service.

ASCII homoglyph substitution table

These are the main ASCII visual confusions this tool applies. Depending on the font (especially sans-serif) and screen size, some pairs become nearly impossible to tell apart, which is why they usually top the defensive-registration list.

Worked example: paypal.com

Enter the SLD paypal (6 characters) and each group yields candidates like the following. Tracking which variant came from which group lets you triage fast.

• Character omission: aypal, pypal, papal, payal, paypl, paypa
• Adjacent transposition: ayppal, pyapal, papyal, payapl, paypla
• QWERTY-adjacent replacement: oaypal (p→o), payoal, payqal (p→q)
• Homoglyph: paypa1 (l→1), paypaI (l→I) — top-priority threats per the table above
• TLD swap: paypal.net, paypal.org, paypal.co, paypal.cm

From this set, you would first verify paypa1.com, paypal.cm (Cameroon TLD — the classic trap where the .com typo drops a letter), and papal.com (a real word, so likely registered) via WHOIS Lookup and narrow down from there.

Common pitfall

• Assuming typos only apply to the SLD. In practice, TLD typos catch the most traffic. .cm (Cameroon), .co, and .om (a dropped c from .com) are favorite targets for typosquatters — never ignore the TLD-swap group.
• Treating an unregistered candidate as safe. Anyone can buy an available domain today, so not registered now ≠ safe — read it as a candidate for defensive registration.
• Checking only ASCII homoglyphs. Unicode characters like Cyrillic а or Greek ο are not in this table yet are visually identical (registered as punycode xn--). High-risk brands need dedicated IDN monitoring on top of this.