Typosquatting and IDNs: Prioritising Lookalike Domains
Prioritise typosquatting and IDN alerts using technical representation, observed behaviour and authorisation context.
What’s in this article?
Direct answer
A spelling variation or visually similar character is a reason to investigate, not a standalone infringement decision. Prioritise domains using the similarity pattern, active content, relationship claims and requested user action. An unused address and a payment-collecting imitation page should not receive the same operational treatment.
Record both representations
For internationalised domains, the Unicode form seen by users and the technical DNS representation can differ. Preserve both. Manually copying letters from a screenshot can lead to investigating the wrong address. Separate the registered domain from paths, usernames and subdomains.
Classify missing letters, extra characters, keyboard proximity, word order and visually similar characters from different alphabets separately. Explain the actual technical difference. A character variation alone does not settle intent or legal infringement.
Build an explainable risk queue
Keep similarity, observed behaviour and rights or permission context in separate fields. Record payment requests, password forms, support claims and redirects safely. Compare findings with an updated inventory of official sites, dealers and former campaigns.
An automated system may recommend human review, but should not send a legal complaint on that basis alone. Unavailable content, unknown authorisation and confirmed findings must remain distinguishable. Missing observations should not become adverse evidence.
Fictional acceptance test
Use a synthetic set of legitimate dealer pages, unused spelling variations and imitation pages. Require the system to explain its priorities. Measure false alerts, review time and missing context as well as the number of detections. Report the sample's limitations instead of claiming perfect protection.
Checklist
- Are visible and technical names recorded?
- Is the registered domain parsed correctly?
- Is the authorised inventory current?
- Is active behaviour documented?
- Do uncertain results reach a reviewer?
- Is the procedural route selected separately?
Feed false positives back into the process
Add verified legitimate dealer records to the reference inventory with their reasoning. Do not treat permission as perpetual: retain its scope and review date. One correct classification does not justify automatically applying the same result to every later lookalike.
Explain the features behind an alert so the next reviewer knows what information is missing. A “high risk” score is not a sufficient task description. Observing a payment form and detecting spelling similarity alone should not produce identical reports. Preserve the reason for closing a false alert to improve later investigation.
Questions
Must every variation be purchased defensively? Portfolio cost and risk should guide selection; buying unlimited variants is not a complete strategy.
Does visual similarity guarantee UDRP success? No. The other applicable elements still require assessment.
Official sources
Related guides
- Digital Evidence and Timelines in Domain Name Disputes
- Assessing Domain Bad Faith: Registration, Acquisition and Use
- Phishing Domains: Separating Registrar, Hosting and CDN Reports
- Preventing Domain Disputes: Corporate Portfolio and Incident Playbook
Brand protection and monitoring
General information only. Rights, authority and current procedure require case-specific assessment. Fictional examples are not B10 client cases or claimed successes.