Domain Typosquat Scanner — Lookalikes & MX Risk

Find registered look-alike domains that impersonate your brand — typos, homoglyph (IDN) spoofs, TLD swaps, bitsquatting, and more — then score which ones can send email.

Powered by dnstwist (Apache-2.0), the industry-standard domain permutation engine. This Actor is an unofficial integration and is not affiliated with or endorsed by the dnstwist authors. It resolves public DNS (and optional public WHOIS) — it never logs into target sites or scrapes private content.

Use results for defensive brand protection and authorized security research. Comply with laws in your jurisdiction.

What you get

Give it a domain (e.g. yourbrand.com) and it will:

1. Generate thousands of permutations (typos, swaps, homoglyphs, hyphenation, TLD substitutions, bitsquatting, …).
2. Resolve live DNS (A / AAAA / MX / NS).
3. Flag mail-capable look-alikes and MX intercept risk (whether mail hosts can catch mail meant for your domain).
4. Attach a 0–100 risk score with plain-language reasons.
5. Optionally run in monitor mode so a weekly schedule returns only what is new, changed, or gone.

Why teams run it

• Brand protection — catch domains squatting on your name before customers get phished
• Anti-phishing triage — prioritize rows with MX + intercept risk
• M&A / vendor diligence — map impersonation exposure around a company domain
• Continuous monitoring — schedule weekly diffs without re-reading the full noise floor

How to use

1. Enter your domain (example.com — no http://, no path).
2. Leave Registered domains only on.
3. Click Start. Each registered look-alike is one dataset row.
4. Export JSON / CSV / Excel, or pull via API. Add a schedule for monitor mode.
5. If a run fails, open the Issues tab on this Store page.

Input

Field	Description
domain	Brand domain to protect (required)
registeredOnly	Only resolving look-alikes (default true)
maxResults	Cap on billed rows (default 200)
mailServerOnly	Keep rows with MX records
minRiskScore	Drop rows below this score
mxcheck	Probe MX intercept risk (default true)
whois	Attach public WHOIS created/registrar (slower)
fuzzers	Optional comma-separated algorithm list
timeout	Scan timeout in seconds (default 300)
threads	Parallel DNS workers (default 16)
monitorMode	Diff vs previous run for the same monitor key
monitorKey	Optional watch name
includeUnchanged	Also return unchanged rows in monitor mode

Output

{
  "inputDomain": "example.com",
  "variantDomain": "examp1e.com",
  "fuzzer": "homoglyph",
  "registered": true,
  "hasMailServer": true,
  "mxInterceptRisk": false,
  "riskScore": 60,
  "riskReasons": ["fuzzer:homoglyph", "mail_server"],
  "dnsA": ["203.0.113.10"],
  "dnsAAAA": null,
  "dnsMX": ["mail.example.net"],
  "dnsNS": ["ns1.example.net"],
  "whoisCreated": null,
  "whoisRegistrar": null,
  "scannedAt": "2026-08-30T12:00:00+00:00"
}

Monitor mode adds changeType (new / changed / removed / unchanged) and changeDetail.

Pricing

Pay per look-alike row delivered (plus a small Actor-start fee). Store plan discounts apply — see the Pricing tab. Quiet monitor weeks that deliver no change rows bill the start fee only.

Tips

• Watch hasMailServer and mxInterceptRisk first — those are the phishing-shaped hits.
• Use minRiskScore (e.g. 40) to keep exports tight for SOC ticketing.
• Schedule monitor mode weekly; leave monitorKey empty for a single automatic watch per domain.
• Raise timeout for huge brands or when whois is on.

Attribution

Includes dnstwist © Marcin Ulikowski, licensed under the Apache License 2.0. See the project license for terms.