Vowel swap domains and sound-alike substitutions

Most lookalike techniques in typosquatting model a mistake: a finger slipping to an adjacent key, a character dropped in fast typing, a lookalike glyph that fools the eye. Vowel swaps model a different failure. The registrant replaces one vowel with another, and the result is not a typing error at all; it is a differently spelled name that still reads and sounds like yours.

How the substitution works

The set is small and fully enumerable. English has five vowels, so each vowel position in a label yields at most four single-swap variants: notolens.com becomes notolans.com, netolens.com, notilens.com, notolons.com, or notoluns.com. A label with three vowels produces at most twelve single-swap names. Unlike homoglyph domains, which draw from thousands of Unicode characters, or combosquatting, which adds words, the vowel-swap space is bounded by the label itself.

Domain-fuzzing tools treat it as a named technique for the same reason defenders do: dnstwist implements it as the vowel-swap algorithm alongside omission, transposition, and bitsquatting. Where keyboard-driven variants model how people mistype, vowel swaps model how people mishear and misremember, the same territory academic work files under sound-squatting.

Why a swapped vowel still passes

Three properties make the substitution effective where a keyboard typo would not be:

• The label still looks plausible. Letter count and the consonant skeleton are preserved, and every character is valid. notolans.com draws no attention in a link preview or an email signature.
• It often sounds identical. English reduces unstressed vowels to a schwa, the neutral “uh” sound, so a single vowel substitution can be near-indistinguishable when spoken. Names that travel by voice (calls, meetings, podcasts, word of mouth) carry the substitution silently.
• Nothing validates it. A vowel swap produces a correctly spelled word or a plausible invented one. There is no malformed input for a browser, spell-checker, or cautious reader to reject.

That last point is why enumeration beats intuition. The variant set is finite: for any domain, every possible vowel swap can be generated and checked. The lookalike domain generator produces the same vowel substitutions an attacker would try, locally in the browser.

What enforcement says

A vowel swap is an intentional misspelling in the sense panels care about. Section 1.9 of the WIPO Overview 3.1 records the consensus view: a domain consisting of a common, obvious, or intentional misspelling of a trademark is confusingly similar to that mark for purposes of the first UDRP element. Panels read the misspelling itself as a signal of intent to confuse, typically corroborated by the content the domain serves. The UDRP dispute guide covers the three elements and the filing process, and reporting to the sponsoring registrar remains the faster first channel for actively deceptive use.

For detection at scale, notolens enumerates vowel swaps as a named variant class: notolans.com surfaces in your inbox with the same checks and records as any other match, while the registration is still fresh.