The naive approach is a static list. You create a file with admin, root, support, and a few hundred other obvious terms. This works for the first year. Then you realize you missed @administrator. And @admin1. And @4dmin. And the Cyrillic version of admin that looks identical. Suddenly your "simple" list needs thousands of entries and regex patterns.
Mature platforms use categorized reservation systems. Instead of a flat list, they organize restrictions into categories: system terms, brand names, celebrities, geography, government entities. Each category has its own rules. System terms are always blocked. Brand names might be blocked or flagged for review. Celebrity names could require identity verification.
The best implementations use real-time lookups against a specialized API. When a user tries to register, the system sends the username to a service that checks it against current trademark databases, known brand lists, and pattern matching rules. This approach stays current without manual updates.
Edge cases matter more than you expect. Unicode homoglyphs — characters that look identical but are technically different — let attackers register gооgle.com (with Cyrillic o). Leet speak variations like 4dm1n slip past naive filters. Platforms need normalization layers that convert usernames to canonical forms before checking.