# Detecting Typosquats at Scale

URL: https://www.deepinfo.com/blog/detecting-typosquats-at-scale/

Engineering

## Detecting Typosquats at Scale: The Whole Family, Not One Variant.

Typosquatting isn’t one technique; it’s a family. Detecting it at scale means covering the full range of variants attackers register.

Deepinfo · Published 2026-06-05 · 4 min

When people think of typosquatting, they usually picture one variant: the brand name with one character changed, `acmme.example` instead of `acme.example`. That technique is real and common. It is also a small part of the lookalike domains attackers register.

Brand Risk Protection in the Deepinfo Platform sorts the family into match types on two axes. The first is how a name relates to your keyword: exact, contains, fuzzy or fuzzy contains. The second is whether it swaps in characters from another script that look identical, which gives a confusable version of each.

### How a Name Can Match

#### Exact Match: `exact`

The brand name, exactly, registered somewhere the brand doesn’t own it: `acme.test` next to the legitimate `acme.example`. It is often registered to hold the name for resale. It is also used for phishing, where a different extension doesn’t raise a reader’s suspicion.

#### Contains Match: `contains`

The brand name plus other words: `acme-support.example`, `secure-acme.example`, `acme-billing.example`. This pattern is common in customer-service impersonation, where the added word makes the domain look like an official support or billing channel.

#### Fuzzy Match: `fuzzy`

A near miss, built from a substitution, a deletion or an insertion: `acmf.example`, `acm.example`, `acmne.example`. This is the classic typosquat, designed around predictable typing errors.

#### Fuzzy Contains Match: `fuzzy_contains`

The two combined: a near miss plus an added word, such as `acmne-support.example`. It sits where typo-based matching meets customer-service impersonation.

### Confusable Versions of Each Match

#### Confusable Exact Match: `confusable_exact`

The brand name, character for character, but with a letter from another script that looks identical, such as a Cyrillic `а` in place of the Latin `a`. To a reader it is the same word; to the DNS it is a different domain, registered in its punycode form (`xn--…`). This is the homoglyph attack, and browsers don’t always show the difference.

#### Confusable Contains Match: `confusable_contains`

Lookalike characters in a brand-plus-word name: `аcme-support.example`, where the first letter is Cyrillic.

#### Confusable Fuzzy Match: `confusable_fuzzy`

Lookalike characters combined with a typo: `аcmne.example`, a Cyrillic `а` plus an inserted letter. Layering two evasions is the attacker’s version of defense in depth.

#### Confusable Fuzzy Contains Match: `confusable_fuzzy_contains`

All three together: lookalike characters, a typo and an added word. It is the most elaborate pattern, and it exists to slip past detection that handles only the simpler variants.

### Why Every Match Type Matters

A platform that only handles exact matches catches the obvious cases. Phishing campaigns choose their domains to fit whatever a target’s monitoring misses, so detection that covers only the simpler match types leaves the rest open. Covering all of them raises the cost of any campaign that depends on a convincing address.

Scale is the other half. The internet adds a large batch of new domains every day (our [domain insights](https://www.deepinfo.com/insights/domain/) page shows the current count), and the lookalikes of any one brand are a tiny fraction of that batch. Finding the fraction means running the matching logic against the whole domain corpus as it changes. A list someone compiled once can’t keep up.

### What a Rule Looks Like

In the platform, a rule is a keyword, one match type and optional helper and discard keywords, run against new domains (or subdomains, set by `fqdn_type`) as they enter the index. With `include_past` on, it also runs against names registered before the rule existed. The request below creates a rule for the most elaborate match type.

```bash
curl -X POST "https://api.deepinfo.com/v1/brp/fraudulent-rules" \
  -H "apikey: YOUR_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
    "name": "acme confusable fuzzy contains",
    "filters": {
      "fqdn_type": "domain",
      "keyword": "acme",
      "match_type": "confusable_fuzzy_contains",
      "helper_keywords": [],
      "discard_keywords": [],
      "included_extensions": [],
      "excluded_extensions": []
    },
    "include_past": true,
    "auto_approval": false,
    "enabled": true
  }'
```

Matches land as suspicious domains for your team to review. Approved ones become monitored lookalikes with DNS, MX, SSL and HTTP indicators, their own history and a risk-score timeline, which is the evidence a [takedown request](https://www.deepinfo.com/platform/brp/managed-takedown/) needs. The [Fraudulent Rule Create reference](https://docs.deepinfo.com/reference/brp/fraudulent-rule-create/) documents each field.

### Each Match Type on One Brand Name.

One brand name and this post’s example for each match type, with the lookalike characters, typos and added words marked.

- **Same name** (`exact`): The name itself, on another TLD
- **Name inside** (`contains`): The name inside a longer label
- **Typo** (`fuzzy`): One edit away: a dropped, doubled, swapped or mistyped letter
- **Typo inside** (`fuzzy_contains`): A typo inside a longer label
- **Lookalike letters** (`confusable_exact`): Letters swapped for ones that look identical
- **Lookalike letters inside** (`confusable_contains`): Lookalike letters inside a longer label
- **Lookalike and typo** (`confusable_fuzzy`): A typo and a lookalike letter together
- **Lookalike and typo inside** (`confusable_fuzzy_contains`): Both, inside a longer label

### Where to Read Next.

- [Dark web monitoring: what it actually catches](https://www.deepinfo.com/blog/dark-web-monitoring-what-it-actually-catches/) (Blog · 2026-06-19): Where stolen credentials surface, and where monitoring stops seeing them.
- [Why we index the internet](https://www.deepinfo.com/blog/why-we-index-the-internet/) (Blog · 2026-05-22): The domain corpus these rules run against, and the lines around it.
- [Fraudulent Domain Monitoring](https://www.deepinfo.com/platform/brp/fraudulent-domain-monitoring/) (Brand Risk Protection): Keyword rules, review, monitoring and a risk-score timeline per lookalike.

### Find the Domains Built to Look Like You.

Book a demo of Brand Risk Protection on your brand names.

[Request demo](https://www.deepinfo.com/request-demo/)