Typosquat Monitor — Find Fake Lookalike Domains

Find the domains impersonating your brand — before your customers or your accounts-payable team fall for one. Generates every plausible lookalike using 11 attack techniques, resolves each one, and flags the dangerous ones: those that can receive email.

Free public DNS. No API key, no login, no anti-bot.

Why this works differently

Most domain-monitoring tools scrape a feed of new registrations and match it against your brand — so they only see what's already been registered and indexed, and they miss anything older.

This does the opposite: it generates the threat universe from your brand, then asks DNS which of those actually exist. You get the complete lookalike space for your name, not a feed's leftovers.

The finding that actually matters

A lookalike that merely resolves is squatting — annoying, usually harmless. A lookalike with MX records can receive email. That's the setup for:

• Invoice fraud — a supplier emails your finance team from yourcompany-billing.com
• Credential phishing — a "password reset" from a domain that looks identical

So hasMailServer is weighted far above mere registration in the threat score. That single column is the reason to run this.

The 11 techniques

Technique	Example (example.com)
Omission	exmple.com
Repetition	exaample.com
Transposition	exapmle.com
Keyboard slip	wxample.com
Insertion	exqample.com
Homoglyph	g0ogle.com, rnodern.com (rn→m)
Vowel swap	exemple.com
Hyphenation	ex-ample.com
TLD swap	example.cm, example.om, example.net
Combosquat	example-login.com, secure-example.com
Bitsquat	single-bit flips (real hardware-error typos)

Bolded ones are the deliberate-imitation classes, and they score higher than finger slips.

What you get

Field	Description
domain	The lookalike found
threatScore	0–100, weighted by capability not just existence
threatLevel	critical · high · medium · low · unregistered
capability	web_and_email · email_only · web_only · registered_only
hasMailServer	⚠️ the important one — can it receive phishing email?
hasWebsite / ipAddresses	Does it resolve, and where
mailServers	The MX records themselves
technique	Which attack class produced it
recommendation	Plain-language next action for that exact finding
watchedDomain / checkedAt	What was protected, and when

Input

{
  "domains": ["yourcompany.com"],
  "checkEmailCapability": true,
  "registeredOnly": true,
  "maxVariantsPerDomain": 800
}

Sample output

[
  {
    "domain": "yourcompany-billing.com",
    "threatScore": 97,
    "threatLevel": "critical",
    "capability": "web_and_email",
    "hasMailServer": true,
    "hasWebsite": true,
    "technique": "combosquat",
    "registered": true,
    "watchedDomain": "yourcompany.com",
    "ipAddresses": "203.0.113.44",
    "mailServers": "10 mail.protonmail.ch.",
    "recommendation": "URGENT: resolves AND accepts email — capable of hosting a clone site and sending invoice/credential phishing. Investigate and file an abuse/UDRP complaint.",
    "status": "ok"
  }
]

Typical uses

• Brand protection — find impersonators and send takedowns / UDRP complaints.
• Finance fraud prevention — hand the email_only list to your AP team as a blocklist. This is the cheapest invoice-fraud control you can run.
• Pre-launch defensive registration — turn registeredOnly off to see which close variants are still free, and buy the handful that matter.
• Scheduled monitoring — squatters register after you launch or get press. Run it monthly.
• Agency service — run it across a client portfolio and sell the report.

Pricing

$2.00 / 1,000 domains checked ($0.002 per result), plus a near-zero start fee. A typical 800-variant scan of one brand costs well under a dollar. Never charged beyond maxItems.

⚠️ Read before you act on a hit

• Registration is not proof of malice. A lookalike may be an unrelated legitimate business, a reseller, or a defensive registration by someone else. Confirm intent before you accuse anyone.
• Treat this as detection, not adjudication. The MX-capable rows deserve human investigation; the rest are usually monitoring-only.
• Homoglyph coverage is ASCII-based (0/o, 1/l, rn/m). It does not yet generate full Unicode/IDN punycode homographs (е.g. Cyrillic "е"), which are a real and separate attack class.
• Absence of a hit is not proof of safety — the generated set is broad but finite.

FAQ & limitations

• Do I need an API key? No. It uses Cloudflare's public DNS-over-HTTPS.
• Does it check WHOIS / registration dates? Not yet — it infers registration from DNS. A parked domain with no records may still be registered, so registeredOnly can under-report slightly.
• Does it screenshot the lookalike sites? No. Pair it with the Screenshot actor for visual proof of a cloned site before filing a takedown.
• How long does a scan take? ~800 variants at 10 parallel lookups runs in a couple of minutes.
• Can I narrow it? Yes — pick specific techniques (homoglyph + combosquat + tld-swap are the highest-signal three) for a fast, cheap scan.

Related actors

• Website Screenshot — capture visual evidence of a cloned site for your takedown request.
• SSL Certificate Checker — see what certificate a lookalike is presenting.
• DNS Lookup · HTTP Header Analyzer — dig further into a specific offender.