Cybersquatting is registering, trafficking in, or using an internet domain in bad faith to profit from a trademark that belongs to someone else. It ranges from grabbing the .net version of a brand that only owns the .com, to typo domains like paypa1.com, to "combosquats" like microsoft-support.net that keep the brand intact and add a trustworthy-sounding word. In the United States it is actionable under the Anticybersquatting Consumer Protection Act (ACPA); worldwide it is resolved through ICANN's Uniform Domain-Name Dispute-Resolution Policy (UDRP), which can force a transfer or cancellation in roughly two months without a lawsuit.
That is the definition an AI Overview will hand you. What it can't show you is the mechanics: the four squatting patterns attackers actually use, how a single brand string explodes into hundreds of registerable lookalikes, and the concrete detection-and-takedown workflow that turns "someone might be squatting us" into a repeatable check. The diagram, tables, and enumeration walkthrough below are built for that.
The anatomy of a squatting attack
Every squatting campaign follows the same arc: pick a brand, mint a lookalike domain, dress it up with a valid TLS certificate so browsers show the padlock, then harvest traffic or credentials. The enumeration defense runs the same string generation the attacker does — but you get there first.
The four squatting patterns
Not all lookalikes are equal. The pattern determines both how likely a victim is to fall for it and which takedown lever works best.
| Pattern | Example (brand = acme.com) | How it fools people | Best defense |
|---|---|---|---|
| TLD swap | acme.net, acme.co, acme.io | User assumes the brand owns every extension | Defensively register the top 3-4; enumerate the rest |
| Typosquatting | acme.co typo acmee.com, acme.cm | Keyboard slips and dropped/doubled letters | Register the 2-3 most-likely typos; monitor others |
| Combosquatting | acme-support.com, login-acme.net | Brand is spelled correctly; added word reads as official | CT-log + newly-registered-domain monitoring |
| Homograph / IDN | аcme.com (Cyrillic а → xn--cme-8cd.com) | Address bar looks pixel-identical | Punycode-aware browser + CT-log monitoring |
The "which should I use when" rule: defensive registration is cost-effective only for the handful of exact-match and obvious-typo domains real customers type. For everything else — combosquats and homographs, which are effectively infinite — you cannot out-buy the attacker, so you detect and take down instead. Enumeration plus Certificate Transparency monitoring is that detection layer.
How TLD enumeration works
There are over 1,500 top-level domains in the ICANN root zone, from legacy generics (.com, .net, .org) to newer ones (.app, .dev, .xyz) and country codes (.co.uk, .de, .io). TLD enumeration takes your brand string and mechanically produces the registerable variant for each, then checks its live status:
- Generate every
brand.<tld>combination from the root-zone list. - Resolve each via DNS — does it have an A/AAAA record, or is it unregistered?
- Classify the responders: your own domains, parked/for-sale pages, active third-party sites.
- Prioritize anything that resolves to a live site with a valid TLS certificate — that combination is the strongest signal of an active campaign rather than a passive squatter.
Our TLD Enumerator runs this for any brand string in your browser and returns the full grid so you can spot registered lookalikes without manually querying WHOIS a thousand times.
Detection signals, ranked
Not every registered lookalike is a live threat. Triage by signal strength before you spend legal budget.
| Signal | What it means | Urgency |
|---|---|---|
| Live site + valid TLS cert on a lookalike | Active phishing/impersonation infrastructure | High — act now |
| New TLS cert in CT logs for your brand keyword | Someone just stood up a lookalike | High — investigate |
| WHOIS privacy registration timed to a launch | Deliberate, likely bad-faith registration | Medium |
| Parked/for-sale page on an exact-match TLD | Classic squatter waiting for a buyout | Medium |
| Unregistered but obvious variant | Future risk, not current | Low — consider pre-registering |
Takedown: UDRP vs. ACPA lawsuit
Once you confirm bad-faith use, two paths exist and they solve different problems.
| UDRP (ICANN) | ACPA lawsuit (US) | |
|---|---|---|
| Forum | WIPO or other approved provider | US federal court |
| Timeline | ~2 months | Months to years |
| Cost | Filing fees (low thousands) | Litigation costs |
| Remedy | Transfer or cancel the domain | Transfer plus up to $100,000 statutory damages per domain |
| Use when | You just want the domain gone, fast | You want damages or the registrant is US-based and egregious |
For a UDRP complaint you must prove all three elements: the domain is identical or confusingly similar to your mark, the registrant has no legitimate interest, and it was registered and used in bad faith. Missing any one element loses the case.
A practical monitoring routine
You don't need an enterprise brand-protection suite to cover the basics:
- Weekly: run TLD enumeration on your brand and any product names; flag new live resolvers.
- Continuously: subscribe to Certificate Transparency log feeds filtered on your brand keyword — every new HTTPS lookalike surfaces here within minutes of issuance.
- At launch time: watch newly-registered-domain feeds around product announcements, when combosquatting spikes.
- Register defensively, narrowly: own
.com,.net,.org, your country code, and the one or two most obvious typos. Skip the rest. - Keep evidence: screenshot the offending site, save WHOIS records, and note registration dates — you'll need them for a UDRP filing.
Conclusion
Cybersquatting is not one attack but four — TLD swaps, typos, combosquats, and homographs — and only the first two are worth buying your way out of. For the rest, the winning strategy is detection: enumerate your brand across every TLD, watch Certificate Transparency logs for lookalike certificates, and move fast with a UDRP complaint when you find bad-faith use. Start by running your brand through the free TLD Enumerator to see exactly which variations are already registered against you.