Every brand eventually asks the same question after its first copycat: should we just buy all the variations? The honest answer is no, and the reason is arithmetic. The IANA root zone database lists well over a thousand top-level domains, and for each of them there are dozens of plausible typos, hyphenations, plurals and combinations with words like “shop”, “sale” or “official”. Owning all of them is impossible, and owning a large share of them costs more every year than recovering the few that are ever abused.
A defensive portfolio is a short list chosen on purpose. Below is how to choose it, what to do with everything you do not buy, and the mistakes that make defensive registration expensive without making you safer.
What defensive registration actually protects against
It helps to be precise about the threat. Copycat domains hurt a brand in three ways: they intercept customers who mistype or guess your address, they impersonate you to sell counterfeits or steal payment details, and they borrow your name to rank in search or ads. Our guide to what counts as a copycat domain lays out the types.
Defensive registration only addresses the first threat well. Owning the domains customers are likely to type removes the accidental traffic a squatter would otherwise harvest. It does much less against deliberate impersonation, because a determined operator simply picks a variation you do not own. Against that, what protects you is monitoring and a fast takedown.
That is why the portfolio should be built around where customers actually go, not around every string that contains your name.
The names worth owning
| Category | Examples for a brand called “Lumen Goods” | Why it earns its cost |
|---|---|---|
| Exact name, main extension | lumengoods.com | Your primary address; non-negotiable |
| Exact name, trading country codes | lumengoods.co.uk, lumengoods.de | Customers in those markets type and trust them |
| Hyphen and spacing variants | lumen-goods.com | Easy confusion if the name has two words |
| Likeliest typos of the main domain | lumengods.com, lumengood.com | Captures real mistyping on the address customers use |
| Category extension your sector uses | lumengoods.shop | Only if customers might believe it is you |
| Retired names with traffic | an old campaign or former brand domain | Carries links and memory a copycat could exploit |
The exact name in your main extension and trading country codes comes first. If you sell in Germany and someone else holds your name under .de, customers there will find it, and you will be explaining the difference to them.
Typos of the domain customers actually use come second, and only a few. The useful ones are the mistakes a real person makes on a phone keyboard: a dropped or doubled letter, two adjacent letters swapped, a singular for a plural. Typosquatting tools can generate hundreds of permutations; most of them are mistakes nobody makes.
Category extensions come third, and only selectively. Some sectors genuinely use extensions such as .shop or .store, and a copycat there could look plausible. Many extensions, though, are ones no customer would associate with you, and buying them is insurance against a risk that barely exists.
Old names come last but are easy to forget. A previous brand name, a retired campaign site or a product microsite still has links pointing at it and people who remember it. If it receives traffic, keep it and redirect it.
What about lookalike characters?
Homograph domains swap a letter for a visually similar character from another script, such as a Cyrillic “а” for a Latin “a”. They are a real phishing technique, and the Unicode security mechanisms standard documents how confusable characters are identified.
Registering homographs defensively is rarely worth it. The number of confusable combinations for even a short name is large, many registries restrict mixed-script registrations, and modern browsers display many suspicious internationalised names in their raw encoded form. Monitoring catches the ones that are actually registered, and a phishing homograph is exactly the kind of abuse registrars and hosts act on quickly.
Where the Trademark Clearinghouse fits
For new generic top-level domains, ICANN created the Trademark Clearinghouse, a central database that authenticates trademark information and passes it to registries and registrars. A recorded mark gives its holder two things: priority access during the sunrise period before a new extension opens to the public, and notifications when someone registers a matching name.
For brands that care about new extensions, that is useful early warning at a modest recurring cost; the Clearinghouse itself publishes its pricing and the calendar of upcoming launches. Two limits matter. It applies to new generic extensions, not to .com or most country codes, which is where most abuse happens. And a notice tells you a name was registered; it does not stop the registration or decide anything. Treat it as a monitoring feed for one part of the namespace.
Monitor and recover the rest
Everything outside the short list is better watched than owned. That sounds like a compromise, but it is usually the stronger position.
Monitoring tells you when a lookalike is registered, when it gets a certificate, and when it starts serving content, often before any customer sees it. Recovery then targets only the domains that are actually being used against you. The UDRP exists for exactly this: a trademark owner who can show a confusingly similar domain registered and used in bad faith can have it transferred, as our guide to UDRP in plain English explains. Faster interim routes, such as suspension for clear phishing, sit alongside it.
The economics favour this split. A defensive name costs a renewal every year, forever, whether or not anyone ever targets it. A recovery costs money once, and only for the names someone actually abuses. Most long-tail variations are never abused at all.
Building the list in an afternoon
A practical process for a first portfolio:
- List where you sell. Every country where you take orders or advertise suggests a country code worth checking.
- Check what you already own. Many brands discover forgotten registrations under former employees’ accounts or old agencies. Consolidate them under one company account with renewal reminders.
- Check what others own. Look up your exact name across your trading country codes and the main extensions. If someone else holds one, decide whether it is abuse, a legitimate business, or a domain worth trying to buy.
- Pick your typos. Take your main domain and write down the five mistakes a customer would most plausibly make. Register the two or three most likely.
- Decide on category extensions. Hold one only if a customer might genuinely believe it is you.
- Set up monitoring for everything else, including combinations with words like your product categories, “shop”, “sale” and “official”.
- Write down the recovery path before you need it: who sends the takedown, which evidence you keep, and when a UDRP is worth filing.
What if someone already owns a name on your list?
Checking your exact name across trading country codes often turns up a holder, and the right response depends on who it is.
A legitimate business with the same name. Two companies can share a name in different sectors or countries, and neither is doing anything wrong. There is no dispute to win here. If the domain matters to you, the only route is a negotiated purchase, and the price will reflect that they are using it.
A domain investor. Some holders register names to resell them. Holding a domain for sale is not automatically bad faith, but targeting a specific brand to sell it back to that brand can be. Before negotiating, look at whether the domain was registered after your mark became known and whether it has been used against you. If it is parked with ads tied to your products, that is evidence; if it is a generic word you happen to share, it is a purchase.
A copycat. If the domain imitates your site, sells counterfeits or carries ads for your competitors, it belongs in the recovery track, not the purchase track. Buying it rewards the behaviour and tells the operator which names you will pay for.
When you do decide to buy, use a broker or an anonymous inquiry rather than your company email. A request from a recognisable brand raises the price, and a clumsy offer can later be quoted as an admission that the holder had legitimate rights. Decide your maximum before the first message.
Mistakes that make defensive registration expensive
Buying everything a generator suggests. Hundreds of permutations look thorough and mostly protect nothing. Renewal invoices grow every year.
Registering names nobody manages. Defensive domains scattered across personal accounts, agencies and old registrars are one forgotten renewal away from a copycat. An expired brand domain is particularly valuable to a squatter because it already has links and history.
Leaving defensive domains dark. A defensive domain that does not resolve wastes the traffic it catches. Point each one at your main site with a permanent redirect.
Treating ownership as protection. Owning fifty variations does not stop an operator registering the fifty-first. Monitoring and a recovery plan do the real work.
Forgetting the trademark. Most recovery routes depend on a registered trademark. Without one, a domain dispute is much harder to win, and the Clearinghouse is not available at all. If your mark is not registered in your main markets, that is a better first investment than any domain.
When a bigger portfolio does make sense
Some brands genuinely need more. A heavily counterfeited consumer brand, a company whose name is a common word, a business in a regulated sector where impersonation carries legal risk, or a brand about to launch in many new markets at once may reasonably hold a larger portfolio. Even then, the principle holds: each name should be one you would renew without hesitation, because it blocks a specific, plausible harm.
Panels deciding domain disputes also look at patterns. The WIPO Jurisprudential Overview collects how panels treat things like a respondent registering many trademark-related names, which is evidence of bad faith on their side. A coherent, documented brand portfolio on yours makes your own position clearer when you do need to act.
The short version
You cannot own every variation of your name, and you should not try. Register your exact name in .com and your trading country codes, the two to five likeliest typos of your main domain, category extensions only where customers might believe they are you, and old names that still get traffic. Redirect every defensive domain to your main site and keep them all under one managed account. Use the Trademark Clearinghouse as early warning for new extensions if they matter to you. Monitor everything else and recover what is actually abused. Working out the right short list for your brand, and the monitoring around it, is part of a confidential review.
