Threat · DOMAIN

Typosquat domains

A typosquat domain is a near-miss of a brand's real domain (a dropped letter, a keyboard neighbor, or a predictable suffix like -shop or -official) registered by someone else to catch the brand's customers. For every brand we generate between 589 and 880 plausible variants: dropped letters, doubled letters, keyboard neighbors, hyphenations, and the predictable suffixes such as shop, store, official, outlet, sale, us.

Scan my brand for this, free

How we scan for these, weekly

Detect→Grade→Record→Alertyour call at the end.

What we look for

The signals that make a match.

Resolved against public DNS, not the local one

A local resolver will happily answer for domains that do not exist. We query the public resolvers directly and discard private-range answers, or 99% of a report is fiction.

Live is not the same as dangerous

Parked and for-sale pages resolve too. We separate them out and say so, rather than counting them to make a number look serious.

Watched, not forgotten

A domain sitting on “Launching soon” can become tomorrow's clone. It stays on the watchlist; if a scheduled scan finds it selling, you get an alert with the capture attached.

Bad neighborhoods

When a clone appears in an address block that already hosts template scam shops, that pattern is worth knowing and worth watching.

What you get

The record, and the decision.

Where a site is live: the capture, the IP address it resolved to, and lookup links for its registrar and host. Where it isn't: a standing watch, and an alert when a scheduled scan finds that changed.

Always

Nothing goes out at all

RIHTAN sends nothing on your behalf. Every match in this category sits in your record for your review; mark it reviewed, doubtful or authorized and the scanner remembers. A seller you mark as authorized is never raised again.

Common questions

Asked before the first scan.

A lookalike domain is parked. Is it a threat?

Not yet, and we won't count it as one. Parked and for-sale pages are reported as exactly that. But a domain sitting on “Launching soon” can become tomorrow's clone, so it stays on the watchlist, and when a scheduled scan finds it selling you get an alert with the capture attached.

How many variants do you check?

Between 589 and 880 plausible variants per brand: dropped letters, doubled letters, keyboard neighbors, hyphenations and the predictable suffixes, all resolved against public DNS so parked fictions don't inflate the count.

Other threats