Typosquatted Nameservers
1 unique typosquatted nameserver variants affecting 2,024 domains
Analysis by Ishan Karunaratne · Data from 2026-08-24
Domains Affected
2,024
Unique Typos
1
% of Dataset
0.0007%
| Typo Domain | Domains Affected |
|---|---|
| cloudflvare.com | 2,024 |
What Are Typosquatted Nameservers?
Nameserver typosquatting occurs when a domain’s NS (Name Server) records contain misspelled versions of legitimate DNS provider hostnames. For example, a domain might point to "ns1.cloudflre.com" instead of "ns1.cloudflare.com", or "dns1.googl.com" instead of "dns1.google.com". These typos typically originate from manual configuration errors when setting up DNS delegation.
The security risk is significant. If the typo domain is unregistered, anyone can register it and stand up a nameserver that answers DNS queries for every domain pointing to the misspelled hostname. If it is already registered by a third party, that control exists today. Either way it means full control over DNS resolution — enabling phishing, email interception, traffic hijacking, and SSL certificate issuance for the affected domains. This attack vector is documented in academic research and has been observed in real-world incidents.
DNS Checker detects typosquatted nameservers by comparing NS record hostnames against a database of known DNS provider domains, using edit-distance algorithms and common typo patterns (character transposition, omission, duplication, and adjacent-key substitution) to identify probable misspellings.
How DNS Checker Detects Typosquatted Nameservers
The detection pipeline processes NS records from zone files across hundreds of gTLDs. Each nameserver hostname is extracted, normalized, and compared against the nameserver base domains of every DNS provider in the dataset that serves at least a thousand domains. Hostnames within a Levenshtein edit distance of 1–2 characters of a known provider, but not matching it exactly, are flagged as candidate typosquats. Very short base names are skipped, because at that length unrelated companies routinely fall within one edit of each other.
Additional heuristics include: adjacent-key substitution on QWERTY layouts, common character transpositions (e.g., "ie" → "ei"), vowel omission, and TLD confusion (e.g., ".comm" instead of ".com"). Edit distance alone produces false positives — a provider's own secondary nameserver domain, or an unrelated company with a similar name, can sit one character from a known provider — so candidates are checked against a maintained exclusion list before publication, and the reason for each exclusion is recorded.
Flagged lookalikes fall into two quite different cases, and both appear in the table. Some are unregistered, where the risk is that someone could register them. Others are already registered and actively answering DNS queries for the domains pointing at them, which means resolution for those domains is already in third-party hands. Registration status is not shown per row; check any hostname that concerns you with a WHOIS lookup and confirm it against your provider's documented nameservers.
How to Fix Typosquatted Nameservers
- Audit all NS records for your domains using the DNS Checker DNS Inspector. Verify that each nameserver hostname exactly matches your DNS provider’s documented nameservers.
- Cross-reference your NS records against your provider’s official documentation. For example, Cloudflare’s nameservers follow the pattern: {name}.ns.cloudflare.com.
- Set up DNS monitoring to detect unauthorized or unexpected nameserver changes. Services like DNS Checker’s DNS Inspector can help verify NS records on demand.
- If you manage DNS for multiple domains, use automation (Terraform, Pulumi, or provider APIs) to set NS records programmatically, eliminating manual typo risk.
- Consider registering common typo variants of your own nameserver domains as a defensive measure, especially if you operate a DNS hosting service.
Frequently Asked Questions
How common are typosquatted nameservers?
Typosquatted nameservers affect thousands of domains across the global DNS infrastructure. While the percentage of total domains is small, each typosquatted NS record can affect critical services — a single misspelled nameserver domain could be exploited to hijack DNS for every domain pointing to it.
Can typosquatted nameservers lead to SSL certificate issuance?
Yes. If an attacker controls DNS resolution for a domain via a typosquatted nameserver, they can pass domain validation (DV) challenges used by certificate authorities like Let’s Encrypt. This allows the attacker to obtain valid SSL certificates for the victim domain, enabling convincing phishing attacks.
What is the difference between typosquatted nameservers and typosquatted domains?
Domain typosquatting targets end users by registering misspelled versions of popular websites (e.g., "gooogle.com"). Nameserver typosquatting targets DNS infrastructure by registering misspelled versions of DNS provider hostnames. The latter is more dangerous because it can silently hijack all DNS traffic for affected domains without any visible change to the domain name itself.
How does this relate to DNS hijacking?
Typosquatted nameservers are a form of DNS hijacking. Unlike traditional DNS hijacking (which requires compromising a registrar account or DNS server), NS typosquatting exploits a configuration error that already exists in the victim’s DNS records. The attacker simply needs to register an available typo domain.