Typosquatting in 2026 — 301-redirect traps, MX poisoning and AI-generated cover pages.

Two data points from vendors watching the ecosystem end-to-end — one on volume, one on tradecraft.

• Bitdefender 2026 Cybersecurity Assessment (1,200 respondents) 70% report measurably more sophisticated AI-enabled phishing. 59% report AI-enabled social engineering incidents in the past year. 44.8% admit only partial visibility into how AI is being used inside their own organization.
• CrowdStrike Counter Adversary Operations (Feb 2026) Shift from opportunistic typosquats to organized campaigns combining bulk domain registration, fabricated WHOIS records harvested from public corporate filings, and AI-generated 'domain for sale' cover pages that make the infrastructure look inert while it is actively receiving mail.
• Why string matching alone is a losing bet Character insertion, hyphenation, suffix appending, TLD swap and Punycode composition together produce hundreds of plausible variants for any five-letter brand. Exact-substring monitors catch the noisy end and miss the rest.

CrowdStrike's writeup names three concrete techniques. Each is a decade old; combined at automated scale, they defeat naive monitors.

• Character substitution Replace one glyph with a visually similar alternative — examp1ecorp.com (numeral 1 for lowercase l). Extends to rn for m, vv for w, and the full Unicode homoglyph set once IDN is on the table.
• Prefix and suffix appending example-corp.com, examplecorp-support.com, examplecorp-billing.com — read as legitimate corporate subdomains but are separate registrations under attacker control. Especially effective in email where users read the local-part and stop.
• Bulk TLD sweep Register the base brand across .top, .shop, .online, .click, .zip. One API call, thirty domains, forty dollars. Combined with the other two families, the permutation space reaches into the low thousands.

The typosquat serves an HTTP 301 or 302 redirect straight to the real brand's website while keeping a malicious MX record pointing at attacker infrastructure. Web traffic sees a redirect and concludes the domain is dormant; mail traffic gets harvested.

• The browser visit looks fine A user who visits the typosquat lands on the real site. Everything appears normal. The user 'learns' the typo domain is safe.
• The email still gets stolen An email sent from support@<typosquat> lands in the target's inbox with a plausible From header. Replies flow into the attacker's mailbox because the MX record resolves to attacker infrastructure.
• Abuse teams close the report An abuse analyst who opens the domain sees the redirect and concludes it is dormant or park-flipped. Reports get closed as false positives.
• Web-only monitors are blind A crawler that follows URLs sees a redirect chain to the legitimate site and reports no threat. The credential-harvest and BEC pathway runs entirely over SMTP, which the crawler never queries.

Attackers place the typosquat behind Cloudflare or an equivalent CDN and use server-side IP filtering to serve different content per visitor.

• Vendor IPs see a benign page Requests from known security-vendor IP ranges (Palo Alto, Trend, Cisco Talos, Google Safe Browsing, common sandbox exit nodes) receive a benign 200 OK or a redirect to the real brand.
• Residential IPs see the phishing kit Requests from residential IPs in the target geography receive the actual phishing content.
• Ray-ID caches the verdict The Cloudflare Ray-ID header gives the operator a per-request identifier that can be correlated to a decision cache — the same visitor gets the same targeted verdict.
• Small-IP monitoring under-reports systematically Any monitoring approach that scans typosquat domains from a small pool of cloud IPs looks clean from the vendor and dangerous from the victim's couch.

Generative AI now produces the cover material at industrial scale — the layer that used to catch bulk typosquat operators is gone.

• Fake 'domain for sale' landing pages Generated from a handful of templates with LLM-written marketing copy. Abuse teams triaging hundreds of reports per day pass over anything that looks like parking.
• Fabricated but convincing WHOIS records Company names, VAT numbers and postal addresses harvested from public corporate filings. A registrar abuse check that verifies 'does this look like a real business' returns yes.
• Disposable registration contacts Hard to trace, hard to notify, hard to serve legal process. The registrar has done its due diligence; the abuse pipeline stalls.

The defense against the 301-plus-MX trick is a direct DNS query for MX and TXT records on every candidate typosquat, run independently of the web response.

• MX on a 'parked' domain is anomalous by definition Parking inventory does not receive email. An MX record on a domain whose web layer redirects to a real brand is nearly always mail-harvesting infrastructure.
• MX hostname reputation A handful of hosting providers and mail relays are disproportionately represented in phishing forensics. Domainscan cross-references MX targets against historical abuse data.
• SPF, DKIM and DMARC on the typosquat itself are diagnostic A domain with a generous SPF, a real MX and no DMARC is provisioned to send email under a brand-adjacent identity — the exact configuration a phishing operator wants.

AI-populated WHOIS records are convincing at a glance and thin at second look. Three properties distinguish real business registrations from fabricated ones.

• Entity-address correspondence A real company's registered address matches its incorporation record and its public presence. Domainscan cross-references the registrant against corporate registries and flags mismatches.
• Contact reachability Real business email answers. Fabricated addresses bounce, silent-drop or forward to a burner. Reachability testing is the fastest single check that flags a fabricated registration.
• Registration velocity Fabricated identities appear across bulk-registration batches from the same registrar in tight time windows. Cross-registrar clustering on registrant metadata surfaces the operator's entire fleet from one flagged domain.

A 301 hides the phishing kit from a browser and from a naive crawler. Prism AI treats the redirect chain as a signal, not a terminator.

• Redirect-chain expansion with origin verification Prism AI follows the redirect and asks whether the final destination is genuinely the brand it claims — certificate chain, DOM origin and served content, not just the URL bar. The suspicious source domain verdict is carried forward to the final report.
• Multi-region fetch to detect geo-filtering The same domain is queried from residential exit nodes and vendor exit nodes. Divergent responses — clean from the vendor, dangerous from the residential — are the fingerprint of Ray-ID gated phishing.
• Cover-page template fingerprinting LLM-generated parking-page templates have measurable stylistic signatures — token repetitions, layout structures, image-encoding artifacts — that Prism AI matches against a library of known AI-produced cover material.

• Enumerate your permutation space For every brand you own, generate the full character-substitution, prefix/suffix and TLD-sweep set. Enrol the list into Domainscan's Typosquat monitor so newly registered variants trigger an alert the day they enter the zone file.
• Add DNS + MX queries to abuse triage Any candidate typosquat that returns a 301 to the real brand and has a custom MX pointing outside your infrastructure is a mail-harvest operation, regardless of what the web layer shows.
• Enforce DMARC p=reject on your real domain Including parked and marketing subdomains. DMARC ensures the receiver's inbox provider rejects anything that fails alignment against your real SPF and DKIM.
• Watch Certificate Transparency logs Every typosquat that provisions HTTPS issues a certificate that hits the public CT log within seconds. Log-watch on your brand name catches variants at issuance rather than at first-victim-click.
• Train on the FROM address, not the display name The 2026 kits make Support <[email protected]> look correct until you copy the address out. Payment authorizations based on display name — invoice fraud, supplier-detail changes, wire instructions — are the highest-value target.

Primary research on typosquat mechanics: The Art of Deception: How Threat Actors Master Typosquatting Campaigns to Bypass Detection — CrowdStrike Counter Adversary Operations (Alen Peric, February 23, 2026). Supporting data on AI-driven phishing volume: The New AI Arms Race Starts Before the Cyberattack — Bitdefender Business Insights (Duncan Mills, September 9, 2026), referencing Bitdefender's 2026 Cybersecurity Assessment (1,200 IT and security professionals surveyed).