The generated space is tens of thousands of names. A watchlist is what remains after you ask, of each one, whether a registration would change what you do that day.
The test
If this domain were registered tomorrow, would I act? If the answer is no, watching it produces an alert you will dismiss, and dismissing alerts is a habit that generalises.
Where the cuts are
| Cut | Keeps | Discards |
|---|---|---|
| By plausibility to a reader | Names a hurried person would not question | Variants that look obviously wrong in an address bar |
| By TLD | The TLDs your customers associate with you, plus the cheap ones abused at volume | The long tail of TLDs nobody transacts in |
| By brand element | The brand name itself and the product names customers type | Internal project names nobody outside would recognise |
| By technique | Combosquats and single-character errors | Bitsquats, unless you are large enough for random bit flips to matter |
Bitsquatting, honestly
A bitsquat exploits memory errors flipping a single bit in a cached hostname. It is real, it has been demonstrated, and the traffic it captures is proportional to your query volume.
- At internet-scale query volumes it is worth registering the variants.
- Below that, the expected traffic is approximately zero.
- It belongs in a generated list and near the bottom of a watchlist, for almost everyone.
A worked cut
Generated: ~22,000 names Drop TLDs with no customer link: ~4,000 Drop implausible-to-a-reader: ~900 Drop bitsquats: ~700 Keep combosquats with high-risk words (login, secure, billing, support, pay, account, verify): +120 Watchlist: ~800 names Of which, escalate immediately on: - any that resolves - any that obtains a certificate - any that publishes an MX
Eight hundred names being watched with three escalation triggers produces a handful of alerts a month. Twenty-two thousand names alerting on registration produces a stream nobody reads by week three.
Write down what you excluded, and why
The exclusions are the defensible part of the design, and they will be questioned after an incident involving something you excluded. A recorded rationale turns that conversation into a decision to revisit rather than an oversight to explain.