Hyphenated domains and brand-splitting variants

Hyphenation exploits the natural ambiguity of compound brand names. When a brand consists of two or more words merged into a single label, users frequently wonder whether the official address includes a hyphen: notolens.com versus noto-lens.com. Attackers register the alternating variation to intercept direct-navigation traffic and establish credible phishing destinations.

How hyphen-splitting operates

The MS-ISAC Security Primer catalogs hyphenation as one of the six main variations of typosquatting: an inserted or removed hyphen within the brand label. The mechanics depend on the brand structure:

• Hyphen insertion: Placing a hyphen between syllables or lexical units in a single-word mark (notolens.com to noto-lens.com).
• Hyphen omission: Merging a legitimately hyphenated brand into a solid string (coca-cola.com to cocacola.com).
• Keyword coupling: Inserting a hyphen before a function keyword (notolens-verify.com), overlapping with combosquatting.

Unlike keyboard misspellings that produce gibberish or obvious typos, hyphenated labels preserve normal reading flow. The visual difference is subtle, particularly on mobile browser address bars where elongated domain names truncate.

Confusing similarity in dispute proceedings

From an enforcement perspective, adding or removing a hyphen provides zero legal protection to an unauthorized registrant. Section 1.7 of the WIPO Overview 3.1 summarizes the consensus test among administrative dispute panels:

Where a domain name incorporates the entirety of a trademark, or where at least a dominant feature of the relevant mark is recognizable in the domain name, the domain name will normally be considered confusingly similar to that mark. Panels compare the mark’s letters directly, and a hyphen does not break that recognizability. In Sanofi v. Justin Gaines (Sanofi-Aventis) (WIPO Case No. D2022-3391), the panel found the domain confusingly similar because it reproduced the mark “merely deleting space and adding hyphen”. Hoffmann-La Roche Inc. v. Tamiflu Shop (WIPO Case No. D2006-0308, <tamiflu-cure.com>) ordered transfer of a hyphenated copy of the mark on the same reasoning.

Detecting hyphenated lookalikes

Defensive registration can cover obvious single-hyphen splits for primary domain extensions. However, with hundreds of active top-level domains available, adversaries routinely register hyphenated variants in alternative extensions. Automated registration monitoring tracks newly observed domains across all covered TLDs, identifying inserted or deleted hyphens the day the names enter registry zone files.