Before deciding what to watch you need to know what exists to be watched. The permutation space for a single brand is mechanically generated and is larger than most people expect.
The generation classes
| Class | Applied to "northwind" | Roughly how many |
|---|---|---|
| Omission | orthwind, nrthwind, northwnd | One per character |
| Transposition | ornthwind, nrothwind | One per adjacent pair |
| Insertion | nnorthwind, northwiind | Keyboard-adjacent, several per position |
| Substitution | morthwind, northwinf | Keyboard-adjacent, several per position |
| Repetition | nnorthwind, norrthwind | One per character |
| Vowel swap | narthwind, northwand | Several per vowel |
| Homoglyph | n0rthwind, northvvind | Several per substitutable character |
| Bitsquat | A single bit flipped in one character | Around eight per character |
| Hyphenation | north-wind | One per boundary |
| Combosquat | northwind-support, login-northwind | Unbounded |
"northwind" (9 characters), single-label variants: roughly 1,500 - 2,500 depending on the generator Multiply by TLDs you care about: .com .net .org .co .io .co.uk .de ... x 10 TLDs -> 15,000 - 25,000 names Add combosquats (unbounded by construction): -> the space is effectively infinite
Why combosquatting breaks the model
Every other class is a finite transformation of the brand string. Combosquatting is the brand plus an arbitrary word, so the space is bounded only by the dictionary — and it dominates in practice, because northwind-billing.com is more convincing to a reader than nrothwind.com and does not depend on a typing error.
Generating the space is not monitoring it
A list of twenty thousand names is not a watchlist. It is the input to the next lesson, which is about deciding what fraction of it you would actually act on — because a programme that alerts on all of it produces alerts nobody reads, which is indistinguishable from no monitoring.