Defensive Domain Registration: What to Buy

Defensive domain registration means buying the lookalike TLDs, common misspellings, and typo variants of your primary domain before a phisher or squatter grabs them. The short answer on what to buy: your exact brand on .com, .net, and .org, the one or two TLDs a single keystroke away (like .co), the two or three misspellings people actually type, and any country-code domain for a market you truly operate in. Register those, then stop.

Everything past that narrow list is usually wasted money, because the number of possible variations is effectively infinite. Good defensive domain registration is about covering the highest-risk permutations cheaply and backing them with monitoring and trademark enforcement — not owning every string that resembles your name.

Start with the exact-match cluster

The foundation is the exact-match cluster: your name spelled correctly across the few TLDs a customer might guess. If your primary is a .com, own brandname.net and brandname.org as well — not to use them, but because a fake "login" or "support" page parked on your .net is the most common lookalike attack.

Redirect every one of these straight to your real site with a 301. That way the defensive names do a second job: they catch honest typos and hand that traffic back to you instead of leaking it.

• .com, .net, .org — the classic trio; buy all three even if you only use one.
• ccTLDs you actually operate in — .co.uk, .de, or .ca carry a real geo-ranking signal, so they matter for live markets, not vanity.
• Your hyphen and plural forms — brand-name.com and brandnames.com if either reads naturally to a customer.

Lookalike TLDs worth buying in defensive domain registration

Lookalike TLDs are the extensions close enough to yours to fool a rushed reader. In defensive domain registration these deserve priority over exotic strings:

• .co — one dropped letter from .com and mistyped constantly; at roughly $12–30 a year it is worth owning despite the price gap with .com.
• .cm and other fat-finger ccTLDs — Cameroon's .cm famously catches .com typos; register it only if your brand is a frequent target.
• .io, .app, .dev — buy these only if your audience is technical and might assume you use them. Note that .app and .dev force HTTPS, and .io runs about $37–41 a year.

Resist the urge to sweep up every new gTLD. Names like .shop, .online, or .xyz often cost $0.99 the first year and then renew at $30–60, so a wall of them becomes an expensive standing bill for domains no attacker was ever going to bother with. Google's John Mueller has said search treats these gTLDs equally for ranking, so there is no SEO reason to hoard them either.

Misspellings and homoglyphs attackers actually weaponize

Squatters and phishers rarely register a random string; they register the mistake your customers are most likely to make. Map those deliberately rather than guessing:

• Adjacent-key typos — the letters next to yours on a QWERTY keyboard, such as "brsnd" for "brand".
• Doubled or dropped letters — "brand" doubled to "braand", or "brannd" trimmed back to "brand".
• Transpositions — two swapped letters, the single most common human typo.
• Homoglyphs — "rn" reading as "m", the digit 0 standing in for the letter o, or 1 for a lowercase L.

One class you cannot buy your way out of is the IDN homograph attack, where a Cyrillic "а" replaces the Latin "a" to create a visually identical domain. There are thousands of such combinations, so registration is hopeless here — this is exactly where monitoring and legal enforcement have to take over.

When defensive domain registration becomes overkill

Defensive domain registration becomes overkill the moment you are buying permutations no realistic attacker would use to make money. Clear signs you have crossed the line:

• You are registering four-letter typos of a fifteen-letter brand.
• You are paying $50–100 a year for a .ai you will never point anywhere, purely "to be safe".
• Your renewal bill for unused defensive names has outgrown the cost of a monitoring service plus a trademark filing.

Past the high-risk shortlist, two tools beat brute-force buying. A registered trademark paired with a domain-watch alert lets you act only when a genuine infringer appears. And when one does, the UDRP (Uniform Domain-Name Dispute-Resolution Policy) and the faster URS (Uniform Rapid Suspension) let you seize or suspend an abusive lookalike for a filing fee — cheaper and more durable than trying to pre-register infinity.

What the variants cost and where to register them

For plain defensive registrations you want the cheapest reputable registrar with free WHOIS privacy, because these names just sit and redirect:

• Porkbun (~$11) — the best all-round pick, with free WHOIS privacy included.
• Cloudflare (~$10.46) — at-cost pricing, but it forces you onto Cloudflare DNS.
• Spaceship (~$9.98) — consistently among the lowest .com prices.
• Namecheap — cheap first-year promos (around $5.98) that renew higher ($13.98–18.48).

Skip GoDaddy for this job: .com renewals sit near $21.99, a poor fit for names you are only parking. For most people a defensive portfolio is a handful of .com/.net/.org registrations, not a sprawling estate.

The exception to "cheapest wins" is when a defensive purchase is really a brand upgrade — you have decided the clean, premium version of your name is worth owning outright. That is where Atom.com fits: it is a curated marketplace for premium, brandable domains, and every listing ships with a free AI appraisal, a USPTO trademark check, secure escrow, and a designed logo, so you can judge quality and legal risk before you buy. Atom also provides registrar services — you can register and manage available domains, DNS, forwarding, and DNSSEC there too — so it works both as the place to find a stronger primary name and as a platform to hold the defensive ones beside it. Use the at-cost registrars for the cheap typo cluster, and Atom when the goal is a premium name with appraisal and trademark vetting built in.

Lock down and renew the names you keep

The names you keep are only as safe as the account holding them, and a hijacked registrar login undoes the whole exercise. Apply the same hardening to every defensive domain as to your primary:

• Authenticator-app 2FA, never SMS, which is exposed to SIM-swap fraud.
• Registrar lock on by default, and registry lock for any high-value name to block unauthorized transfers.
• DNSSEC enabled to prevent DNS tampering and cache poisoning.
• The account recovery email on a different domain, so losing one name cannot lock you out of the rest.

Finally, turn on auto-renew for every defensive name. If one lapses it can fall into a redemption period costing $80–200+ to recover — far more than the $10–12 renewal you missed — and a dropped name is exactly what a squatter waits for. There is also a 60-day transfer lock after any new registration, so buy each name at the registrar where you intend to keep it.

Frequently asked questions

Should I register every TLD for my brand?

No. There are hundreds of TLDs and effectively infinite typo combinations, so buying all of them is pure cost with little added protection. Cover the high-risk shortlist — .com/.net/.org, one or two lookalike extensions like .co, your most likely misspellings, and ccTLDs for real markets — then rely on monitoring and trademark enforcement for everything else.

How much should defensive domain registration cost per year?

For most brands a sensible defensive set is a handful of .com/.net/.org names at roughly $10–12 each, plus maybe a .co at $12–30. That lands around $50–150 a year. If your renewal bill has climbed into the hundreds for names you never use, you have drifted into overkill and should switch that budget to monitoring.

What do I do if someone already registered a lookalike of my domain?

If they are using it in bad faith and you hold trademark rights, file a UDRP or the faster URS to have it transferred or suspended — cheaper and more permanent than buying it from a squatter. Purchasing it back directly should be a last resort, and always through escrow, never a direct wire.

Where should I actually buy defensive domains?

For plain typo and TLD registrations, use a low-cost registrar with free WHOIS privacy such as Porkbun, Cloudflare, or Spaceship. When the purchase is really a premium brand name you want appraised and trademark-checked first, Atom.com is the better fit — it pairs a curated premium marketplace with registrar and DNS management.