Detecting Typosquats at Scale: The Whole Family, Not One Variant.

When people think of typosquatting, they usually picture one variant: the brand name with one character changed, acmme.example instead of acme.example. That technique is real and common. It is also a small part of the lookalike domains attackers register.

Brand Risk Protection in the Deepinfo Platform sorts the family into match types on two axes. The first is how a name relates to your keyword: exact, contains, fuzzy or fuzzy contains. The second is whether it swaps in characters from another script that look identical, which gives a confusable version of each.

How a Name Can Match

Exact Match: exact

The brand name, exactly, registered somewhere the brand doesn’t own it: acme.test next to the legitimate acme.example. It is often registered to hold the name for resale. It is also used for phishing, where a different extension doesn’t raise a reader’s suspicion.

Contains Match: contains

The brand name plus other words: acme-support.example, secure-acme.example, acme-billing.example. This pattern is common in customer-service impersonation, where the added word makes the domain look like an official support or billing channel.

Fuzzy Match: fuzzy

A near miss, built from a substitution, a deletion or an insertion: acmf.example, acm.example, acmne.example. This is the classic typosquat, designed around predictable typing errors.

Fuzzy Contains Match: fuzzy_contains

The two combined: a near miss plus an added word, such as acmne-support.example. It sits where typo-based matching meets customer-service impersonation.

Confusable Versions of Each Match

Confusable Exact Match: confusable_exact

The brand name, character for character, but with a letter from another script that looks identical, such as a Cyrillic а in place of the Latin a. To a reader it is the same word; to the DNS it is a different domain, registered in its punycode form (xn--…). This is the homoglyph attack, and browsers don’t always show the difference.

Confusable Contains Match: confusable_contains

Lookalike characters in a brand-plus-word name: аcme-support.example, where the first letter is Cyrillic.

Confusable Fuzzy Match: confusable_fuzzy

Lookalike characters combined with a typo: аcmne.example, a Cyrillic а plus an inserted letter. Layering two evasions is the attacker’s version of defense in depth.

Confusable Fuzzy Contains Match: confusable_fuzzy_contains

All three together: lookalike characters, a typo and an added word. It is the most elaborate pattern, and it exists to slip past detection that handles only the simpler variants.

Why Every Match Type Matters

A platform that only handles exact matches catches the obvious cases. Phishing campaigns choose their domains to fit whatever a target’s monitoring misses, so detection that covers only the simpler match types leaves the rest open. Covering all of them raises the cost of any campaign that depends on a convincing address.

Scale is the other half. The internet adds a large batch of new domains every day (our domain insights page shows the current count), and the lookalikes of any one brand are a tiny fraction of that batch. Finding the fraction means running the matching logic against the whole domain corpus as it changes. A list someone compiled once can’t keep up.

What a Rule Looks Like

In the platform, a rule is a keyword, one match type and optional helper and discard keywords, run against new domains (or subdomains, set by fqdn_type) as they enter the index. With include_past on, it also runs against names registered before the rule existed. The request below creates a rule for the most elaborate match type.

curl -X POST "https://api.deepinfo.com/v1/brp/fraudulent-rules" \
  -H "apikey: YOUR_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
    "name": "acme confusable fuzzy contains",
    "filters": {
      "fqdn_type": "domain",
      "keyword": "acme",
      "match_type": "confusable_fuzzy_contains",
      "helper_keywords": [],
      "discard_keywords": [],
      "included_extensions": [],
      "excluded_extensions": []
    },
    "include_past": true,
    "auto_approval": false,
    "enabled": true
  }'

Matches land as suspicious domains for your team to review. Approved ones become monitored lookalikes with DNS, MX, SSL and HTTP indicators, their own history and a risk-score timeline, which is the evidence a takedown request needs. The Fraudulent Rule Create reference documents each field.