TLD swap: cross-extension brand imitation
Updated October 5, 2026
A TLD swap keeps your exact brand name unchanged and registers it under an alternative top-level domain: notolens.co, notolens.shop, or notolens.top. Because the brand string is completely unaltered, visitors frequently overlook the extension mismatch.
- Variant class
- Top-level domain substitution
- Available extensions
- 1,400+ gTLDs and ccTLDs (IANA)
- Empirical research
- Halvorson et al., ACM IMC 2015
Cross-extension imitation, or TLD swapping, relies on a simple reality: most internet users recall brand names accurately but pay little attention to the characters following the final dot. When an organization establishes a presence on .com, third parties can register the identical brand string on .co, .io, .shop, .online, or regional country-code extensions.
Expansion of the top-level namespace
Following ICANN’s New gTLD Program, the number of top-level domains expanded from a handful of legacy extensions (.com, .net, .org) to more than 1,400 active delegations listed in the IANA Root Zone Database.
In an empirical study presented at ACM IMC 2015, Halvorson and colleagues analyzed registration dynamics during the rollout of new generic TLDs. Their findings documented that only 15% of domains in the new TLDs showed characteristics consistent with primary registrations, with the remainder promotional, speculative, or defensive, and that new domains were more than twice as likely to appear on a commonly available blacklist within the first month of registration.
Legal and dispute remedies across extensions
When an unauthorized entity registers an identical brand mark under an alternative extension, dispute mechanisms provide established avenues for recovery:
- ICANN Generic TLDs (gTLDs): All generic extensions (including legacy extensions and new gTLDs) are governed by the Uniform Domain-Name Dispute-Resolution Policy (UDRP). Because the domain label is identical to the mark, satisfying the first element (identical or confusing similarity) is direct.
- Uniform Rapid Suspension (URS): For new gTLDs, the URS offers a faster, lower-cost suspension mechanism for clear-cut cases of bad-faith registration.
- Country-Code TLDs (ccTLDs): Many national registries (such as
.co,.me, and.io) operate dispute procedures administered by WIPO or local dispute resolution bodies (such as Nominet DRS for.uk).
Defending against cross-extension lookalikes
Attempting to acquire every available extension is cost-prohibitive for most businesses. A pragmatic defense focuses defensive registrations on the top three to five commercially vital extensions (such as .com and primary national ccTLDs) while deploying automated daily monitoring across all remaining TLDs. When an unauthorized registration appears, monitoring detects the new zone record immediately, providing the observation records needed for abuse reports or dispute filings.
Sources
Frequently asked questions
Traditional typosquatting alters the brand label itself through omitted letters, typos, or homoglyphs. A TLD swap reproduces the brand label identically and changes only the domain extension (.shop, .app, .co, or .top instead of .com).
All ICANN-accredited generic TLDs (gTLDs) are bound by the mandatory UDRP policy. Many country-code TLDs (ccTLDs) have adopted UDRP or comparable dispute frameworks administered by WIPO, while others enforce national administrative or judicial dispute rules.
With more than 1,400 delegable extensions in the IANA root zone, registering every available extension costs tens of thousands of dollars annually in renewals. Most organizations defensively register primary commercial extensions and use continuous monitoring for the remainder.
Analysis from ACM IMC 2015 found that promotional, speculative, and defensive registrations dominated the new gTLDs, and that new domains were more than twice as likely to appear on a blacklist within their first month. Low-cost extensions suit disposable abuse infrastructure.
Related tools and resources
Lookalike Domain Generator
Enumerate cross-extension variants and alternative TLD availability for your brand.
Typosquatting
The full range of lookalike registration techniques, scale data, and defenses.
How to Report Domain Abuse to a Registrar
Find the sponsoring registrar and submit an actionable abuse report.
Continuous brand monitoring
notolens checks daily registrations across 1,570 TLDs, trademark registers, and app stores. When a lookalike domain, conflicting mark, or copycat app appears, notolens checks it, explains the risk, and hands you the records and possible next steps.