Typosquatting

Typosquatting is the practice of registering domain names that are slight misspellings of an established brand's domain: a swapped letter, a missing character, or a different extension such as .co instead of .com. The goal is to capture visitors who mistype the address and monetize that traffic before the visitor notices anything is wrong.

For B2B SaaS companies the stakes go beyond a few lost visits. Typosquatted domains are used for phishing login credentials, impersonating support, and, in affiliate programs, claiming commissions on customers who were already on their way to buy. It is both a brand protection issue and a fraud issue.

How it works in B2B SaaS

A typosquatter studies how people actually mistype a domain and registers the most likely variants. Common patterns include:

• Dropped letters
• Doubled letters
• Adjacent-key swaps
• Alternate extensions such as .co instead of .com

The squatter then parks ads on the domain, redirects it somewhere profitable, or clones the real site.

In an affiliate context, the profitable redirect is the problem. The squatter joins the vendor's affiliate program, routes typo traffic through their own affiliate link, and lands the visitor on the real site. The visitor signs up as intended, tracking credits the squatter, and the vendor pays commission on a customer it had already earned.

Because the visitor ends up exactly where they meant to go, nobody complains. The fraud only surfaces when someone audits referring domains or asks why one affiliate converts at rates only direct brand traffic should reach.

A worked example

Imagine CloudMetrics, an analytics SaaS at cloudmetrics.com with 50,000 brand-driven visits per month. A squatter registers cloudmetrics.co and cloudmetrix.com and redirects both through an affiliate tracking link.

Suppose 1 percent of brand traffic mistypes the address: 500 visits per month now pass through the squatter's link. If 5 percent of those visitors start a trial and half of the trials convert to the $100 per month plan, that is roughly 12 new customers a month. At a 20 percent recurring commission, the squatter earns about $240 in new monthly commissions, and the total stacks each month because the commission recurs.

Within a year CloudMetrics is paying thousands of dollars annually for customers who typed the brand name themselves. The affiliate dashboard makes the squatter look like a star performer. The referring-domain report tells the real story.

Typical ranges and benchmarks

Defensive domain registrations commonly cost $10 to $20 per domain per year, which is why many SaaS companies simply buy their highest-risk variants outright. A defensive portfolio of a dozen obvious misspellings and extensions typically costs less than a single month of fraudulent commissions.

When a bad actor already owns the domain, a UDRP complaint (the standard domain dispute process) commonly starts around $1,500 in filing fees plus any legal help, and decisions typically take around two months. A registered trademark strengthens the case considerably, though nothing here is legal advice.

Typosquatting vs brand bidding

Both tactics intercept buyers who already know the brand, which is why they get lumped together. Brand bidding means buying search ads on the vendor's brand keywords; typosquatting means owning misspelled versions of the vendor's domain.

The practical difference is severity. Brand bidding is usually a program policy violation handled with warnings and commission reversals. Typosquatting involves registering someone else's trademark in bad faith, which can trigger domain disputes and legal claims, not just removal from the program.

How it shows up in affiliate and partner programs

Program terms should explicitly ban affiliates from registering domains that contain the vendor's trademark or close misspellings of it. Without that clause, enforcement becomes an argument instead of a process.

Monitoring matters as much as terms:

• Review referring domains for top affiliates.
• Flag partners whose traffic converts suspiciously like direct brand traffic.
• Hold commissions long enough to reverse fraudulent ones.

Honest affiliates benefit too: typo domains steal last-click credit from partners who did the real work.

Common mistakes

Registering only the .com while ignoring the extensions and misspellings that phishing kits favor. Treating typosquatting purely as a marketing problem when a cloned login page makes it a security incident.

On the program side, the classic errors are paying large affiliates without ever checking referring URLs, writing terms that ban trademark bidding but say nothing about domains, and reacting to discovered squatting with a quiet block instead of a commission reversal and a documented ban.

Frequently asked questions

Is typosquatting illegal?

It can be. In the United States, the Anticybersquatting Consumer Protection Act targets bad-faith registration of trademarked names, and the UDRP process can force domain transfers without going to court. Outcomes depend on trademark rights and evidence of bad faith, so treat this as background, not legal advice.

How do I find typosquatted versions of my domain?

Run your domain through a permutation tool that generates likely misspellings and checks which ones are registered. Combine that with referring-domain reports in your analytics and affiliate platform, and watch certificate transparency logs for lookalike domains setting up HTTPS.

Should I buy common misspellings of my own domain?

For most SaaS brands, yes. A handful of high-risk variants costs less per year than one fraudulent commission, and redirecting them to your real domain quietly recovers mistyped traffic. Prioritize adjacent-key typos, dropped letters, and the .co and .net versions of your name.