The question is deliberateness, not resemblance
Resemblance is easy to assert and nearly worthless on its own. The evidentiary question in a typosquatting matter is narrower and harder: is this name a deliberate variant of a target string, or a coincidence?
Typosquatting is the registration of names a user reaches through an input error. What makes it tractable as evidence is that the error classes are finite, enumerable and machine-generable. That lets an expert say something precise — this string sits inside a small, well-defined neighborhood of the mark, generated by a published process, rather than being one of the effectively unlimited strings available to a registrant.
Two forums make the analysis operative rather than academic. The UDRP treats registration to prevent a mark owner from reflecting its mark in a corresponding domain name as evidence of bad faith, expressly conditioned on a pattern of such conduct. And in the United States, the ACPA directs a court to consider a registrant's registration or acquisition of multiple domain names known to be identical or confusingly similar to marks of others. US-specific: the ACPA and the Federal Rules of Evidence referred to on this page are United States law only.
Both provisions operate on the set. That is why the enumeration exists.
The variant space is finite, and it is generated rather than guessed
The measurement literature works in edit distance — the minimum number of insertions, deletions, substitutions or transpositions needed to turn one string into another — supplemented by a keyboard-adjacency measure capturing letters that sit next to each other on a physical keyboard. Those operations map onto observable variant classes:
- Omission — a dropped character. Transposition — two adjacent characters swapped. Repetition — a character doubled.
- Substitution, most often by a physically neighboring key, and insertion of an adjacent key struck alongside the intended one.
- Hyphenation, vowel swap, pluralization, and dictionary or combination terms appended — the combosquatting pattern, where nothing is misspelled at all.
- Homoglyph substitution — a visually confusable character, within ASCII or across scripts.
- Bitsquatting — a single-bit difference in the character's binary representation, catching lookups corrupted in memory.
- Extension swap — the same second-level label in a different extension.
- Subdomain insertion — the target string relocated into a label position the target does not control.
That list is not an invention for a particular matter. It is the published permutation set of a widely used open-source generator, dnstwist, whose generator methods carry those names.
Name the generator, the version and the parameters
Using a published, independently maintained generator rather than a hand-picked list is the single decision that most affects whether the exhibit survives. It matters for a reason that has nothing to do with convenience: the other side can re-run it.
A hand-curated list of variants is a selection, and a selection made by the party asserting the pattern. Every name on it invites the question of what was left off. A full permutation run over a named tool at a named version, with the wordlist and parameters stated, is a process someone else can reproduce and check — which is the standard the reliability framing of FRE 702 asks about, and which is simply better practice regardless of forum.
The run produces candidates, not findings. Each candidate is then resolved and recorded: does it resolve now, what address and mail records does it carry, which registrar sponsors it, what is its creation date, and is its registrant field redacted. The negative results stay in the table. A variant that does not exist is a fact about the neighborhood, and removing it inflates every ratio in the exhibit.
Homoglyphs and internationalized names: codepoints, not screenshots
Confusable characters have formal machinery behind them, and a report that uses it is on much firmer ground than one that asserts two strings look alike. The Unicode Consortium's security mechanisms specification, UTS #39, defines a skeleton transformation — normalize, strip default-ignorable characters, map each character to its prototype exemplar, normalize again — and defines two strings as confusable precisely when their skeletons match.
It also classifies single-script, mixed-script and whole-script confusables (a whole Latin word reproduced in another script), defines mixed-script detection by resolved script set, and sets restriction levels running from ASCII-only upward. It points in turn to the registry-side label generation rules mechanism, by which a registry defines a permitted character repertoire and blocks variant labels.
So a homoglyph exhibit reports the codepoints, the script of each character, the skeleton result, and the registry's label-rule posture for that extension. It does not report a screenshot and an assertion. Codepoints survive re-typing, copy-paste and font substitution; an image does not, and an image of two visually identical strings makes the opposite of the intended point.
One variant is weak; the patterned set is the evidence
A single close variant, standing alone, is weak evidence of anything. What carries weight is the set, and specifically four properties of it:
- Multiple variants of the same target held by one registrant or one account.
- Registered in a burst — same date, same registrar, sequential registry transaction ordering.
- A shared monetization identifier across the set. Published measurement work found this concentration directly: in one 2010 study of typo domains displaying advertising, a majority of those observed used one of only five advertising partner identifiers, and roughly four in five of the crawled typo domains monetized through pay-per-click advertising (Moore and Edelman).
- Shared infrastructure — name servers, address ranges, certificates whose subject alternative names cover several of the variants at once.
Those are the signals that survive redaction, and post-2018 they carry more weight than the registrant-name field does, because that field is usually not there. Each remains an inference. A shared name server can mean a shared hosting provider; a shared address can mean shared hosting. The exhibit states the alternative explanation next to each signal, and treats registrar account records as the confirmation.
The prevalence literature cuts both ways, and the page says so
Published measurement studies establish that patterned typo registration is real, measured and industrial in scale. One 2010 study identified on the order of hundreds of candidate typo domains per popular target site. A 2014 USENIX Security study identified millions of candidate typo names in a single extension's zone and estimated that a substantial fraction of registrations in that extension were true typo domains — while also finding that only a small percentage of lexicographically similar registrations targeted popular domains, so the activity sits overwhelmingly in the long tail. Work on combosquatting, drawing on hundreds of billions of DNS records over roughly six years, reported that most abusive combosquatting domains persist for more than a thousand days.
Now the part an expert has to volunteer. The same literature establishes that close variants of any given string are extremely common — which is precisely the base-rate argument a respondent will make. An expert who cites prevalence research to demonstrate intent has cited evidence that also undercuts the inference. The honest use of these figures is to establish that the phenomenon exists and has measurable structure, not to bridge from one similar name to a conclusion about why it was registered.
What variant analysis cannot establish
It cannot establish intent, and it cannot establish common ownership from public data alone.
- Base rates defeat naive inference. A large share of any big extension is lexicographically similar to something else, so "this string is one edit from the mark" is on its own an extremely weak signal.
- Enumeration is generator-dependent. A different tool yields a different variant set, so the generator, version, parameters and wordlist are named or the exhibit is not reproducible.
- A variant may have an independent meaning. Short strings, dictionary words, acronyms and other parties' marks collide innocently. The expert reports the collision; whether it is innocent is not the expert's call.
- Redaction breaks registrant linkage. "One registrant holds all of these" is usually an inference from infrastructure until disclosure occurs, and privacy services and bulk registrar accounts mask common ownership the same way.
- Passive DNS coverage is partial and sensor-dependent; absence of a record is not evidence a name never resolved.
- Deleted variants vanish from live sources, leaving only archive, certificate log and passive DNS traces — and registration records for dropped names age out first.
- Country-code variants may have no public registration data at all.
What a retaining attorney should expect
The deliverable is an enumerated variant table — every generated permutation, its operation class, whether it resolves, its address and mail records, its registrar, its creation date and its registrant field state — cross-joined against passive DNS and certificate transparency data so that names which once resolved but no longer do are still captured. Alongside it sits a linkage exhibit: shared name servers, addresses, certificate coverage, and advertising or affiliate identifiers recovered from archived page source. The target's own defensive registrations get their own column rather than sitting unlabeled in the total.
US-specific: a generated variant list is not a record. It is the output of a process, and it comes in under the reliability framing of FRE 702 as amended effective 1 December 2023, which is why the tool, version and parameters go in the report. The underlying registration and DNS records are records, authenticated under FRE 901 with the 902(13) and 902(14) certification routes available; a large table is a candidate for summary presentation under FRE 1006 with the underlying data produced.
Bill Hartzer has testified in domain-related legal cases and has provided expert witness reports in others, and has worked in this field since 1996. The current record is at hartzer.com. What the set means legally is for counsel.