Use HTTP and DNS record to analyze the user behavior with typo in hostname