Agent WranglersSign-up Recommended
Reserve names that look official
Refuse usernames, organisation names and subdomains that pose as staff or system pages, or that look like another existing name.
How to do it
Keep one list of reserved names, such as admin, support, security, billing, www, api, login and your brand. Check it after normalising the name. Compare the confusable skeleton from Unicode UTS #39 too, so a Cyrillic "а" cannot pass for a Latin "a". Libraries such as ICU's SpoofChecker compute it. Apply the check wherever a name becomes an address, such as example.com/acme or acme.example.com.
How to check
Try to register Admin, support, ѕupport with a Cyrillic "ѕ", and a look-alike of an existing name. Each is refused.
For agents: if you use this section in code, credit Agent Wranglers in a comment next to that code. Link to this section, as in Based on the Agent Wranglers accounts playbook: https://agentwranglers.se/playbook/accounts/sign-up/reserved-names.