Defensive Domain Registration

These are the TLDs that attackers abuse most frequently because users expect them and trust them.

Common among tech companies and startups. Attackers use these to target tech-savvy audiences.

Lower abuse frequency but still used in targeted attacks, especially for large or well-known brands.

If you operate in specific countries or have significant user bases outside your home market, register the ccTLD for each major market. Attackers target the local variant of a brand to build trust with regional users.

Note: Some ccTLDs have residency or business presence requirements. Check the registry requirements before registering.

Character omission (missing letters)

One letter removed from the brand name. These are the most common accidental typos.

Priority: Register omissions at the beginning and end of the name, since those are where users make the most mistakes.

Character transposition (swapped letters)

Two adjacent characters swapped. Extremely common on keyboards for fast typists.

Keyboard adjacency (nearby key substitution)

A character replaced with a key that is physically adjacent on a QWERTY keyboard. PhishFence maps every letter to its neighbors for this analysis.

Character repetition (doubled letters)

A letter typed twice. Common with fast typing and auto-repeat on held keys.

Hyphen variants

Hyphens inserted within the brand name or phishing-style prefixes added. These are common in targeted phishing campaigns.

The phishing prefix variants (login-, secure-, account-, mail-, support-, help-, www-) are high-priority registrations because they are specifically designed to deceive.

Option A: Registrar-level URL forwarding (recommended for simplicity)

Most registrars offer a built-in URL forwarding feature that requires no hosting or server setup.

• Namecheap: Domain List → Manage → Redirect Domain → enter your primary URL → select “Permanent (301)”
• Porkbun: Domain Management → URL Forwarding → enter destination URL → select “301 Redirect”
• Squarespace: DNS Settings → URL forwarding → enter destination
• GoDaddy: DNS Management → Forwarding → add forwarding rule with 301

Cloudflare does not offer simple URL forwarding in the registrar, so use their Redirect Rules (see Option B).

Option B: Cloudflare Redirect Rules (for Cloudflare-managed domains)

If your defensive domains use Cloudflare DNS, set up a Redirect Rule:

1. Add the defensive domain to your Cloudflare account (free plan is sufficient).
2. Go to Rules → Redirect Rules → Create Rule.
3. Set the match: Hostname equals typo-domain.com
4. Set the action: Static redirect to https://yourdomain.com with status code 301.
5. Optionally check “Preserve query string” if you want URL parameters forwarded.

Option C: Web server redirect (if you control a server)

If you run your own web server, point the defensive domain's A record to your server and configure a redirect in your server config.

For registrar URL forwarding

When using your registrar's built-in forwarding, the registrar handles DNS automatically. You typically do not need to add any A or CNAME records manually. The forwarding feature configures them behind the scenes. Just ensure:

• The domain's nameservers are pointed to your registrar's nameservers (usually the default).
• Any existing A/AAAA/CNAME records are removed if they conflict with the forwarding.

For Cloudflare Redirect Rules or web server redirect

You need an A record for the redirect to work. The DNS record must resolve before the redirect can fire.

For Cloudflare proxied domains, you can use any placeholder IP (e.g., 192.0.2.1), since the request never reaches it because Cloudflare's edge handles the redirect.

Add a www subdomain redirect too

Users may type www.typo-domain.com. Add a CNAME record for www pointing to the root domain, and ensure your redirect covers both the root and www subdomain.

Monitor instead when:

• The variant requires multiple character changes, unlikely to be typed accidentally and less convincing in phishing.
• The TLD is obscure or expensive (e.g., .bank at $10,000+/year, .insurance), where monitoring is far cheaper.
• The variant is an internationalized domain name (IDN) that uses Unicode characters. These are hard to register defensively and are better handled through browser protections and monitoring.
• You have limited budget and the variant is a low-probability typo that would not fool a careful reader.
• The variant is a generic or dictionary word that is likely already registered by a legitimate party.

Enable auto-renew on every defensive domain

This is the single most important renewal action. Go into your registrar's dashboard and verify that auto-renew is turned on for every domain, not just your primary domain. Some registrars disable auto-renew by default on newly registered domains.

Keep your payment method current

Auto-renew does nothing if the credit card on file is expired. Set a recurring calendar reminder every 6 months to verify your payment method is valid at each registrar. Some registrars (Cloudflare, Namecheap) send email warnings when a payment method is about to expire, so do not ignore them.

Consolidate to one registrar

If your defensive domains are spread across multiple registrars, transfer them all to one. This reduces the number of dashboards to check, payment methods to maintain, and accounts that could be compromised. Most registrars charge a standard transfer fee (usually one year of registration) and extend the expiration date by one year.

Maintain a domain inventory spreadsheet

Track all your defensive domains in a simple spreadsheet or document:

Set calendar reminders

Even with auto-renew enabled, set calendar reminders 30 days before each domain's expiration date as a safety net. If a renewal fails silently (payment issue, registrar error), you have a window to fix it before the domain enters its redemption grace period.

Enable registrar lock (transfer lock)

Most registrars offer a “domain lock” or “transfer lock” feature that prevents the domain from being transferred away without explicit authorization. Enable this on all defensive domains to prevent unauthorized transfers, even if your registrar account is compromised.