Domain Typosquat Scanner — Lookalikes & MX Risk

Example: Domain Typosquat Scanner — Lookalikes & MX Risk · dm.hu

Field	What you get
riskScore	60
variantDomain	examp1e.com
fuzzer	homoglyph
hasMailServer	true
mxInterceptRisk	false
dnsA	203.0.113.10
dnsMX	mail.example.net
inputDomain	example.com
registered	true
riskReasons	fuzzer:homoglyph, mail_server
dnsAAAA	—
dnsNS	ns1.example.net
whoisCreated	—
whoisRegistrar	—
scannedAt	2026-08-30T12:00:00+00:00
changeType	when available
changeDetail	when available

Press Start. The example is already filled in.

Find registered look-alike domains that impersonate your brand — typos, homoglyph (IDN) spoofs, TLD swaps, bitsquatting, and more — then score which ones can send email.

Powered by dnstwist (Apache-2.0), the industry-standard domain permutation engine. This Actor is an unofficial integration and is not affiliated with or endorsed by the dnstwist authors. It resolves public DNS (and optional public WHOIS) — it never logs into target sites or scrapes private content.

Use results for defensive brand protection and authorized security research. Comply with laws in your jurisdiction.

What you get

Give it a domain (e.g. yourbrand.com) and it will:

1. Generate thousands of permutations (typos, swaps, homoglyphs, hyphenation, TLD substitutions, bitsquatting, …).
2. Resolve live DNS (A / AAAA / MX / NS).
3. Flag mail-capable look-alikes and MX intercept risk (whether mail hosts can catch mail meant for your domain).
4. Attach a 0–100 risk score with plain-language reasons.
5. Optionally run in monitor mode so a weekly schedule returns only what is new, changed, or gone.

Why teams run it

• Brand protection — catch domains squatting on your name before customers get phished
• Anti-phishing triage — prioritize rows with MX + intercept risk
• M&A / vendor diligence — map impersonation exposure around a company domain
• Continuous monitoring — schedule weekly diffs without re-reading the full noise floor

How to fill the form (first run)

Field	What to enter
Brand domain	Replace dm.hu with your apex domain (brand.com).
Registered domains only	Leave on for actionable hits only.
Max look-alike rows	Default 5 for smoke; raise for exports (billed per row).
Check MX intercept risk	Leave on unless you only need DNS presence.
Fuzzers	Leave empty (full engine) unless you want a faster, narrower scan.
Monitor mode	Off for first run; turn on when you add a weekly schedule.

How to use

1. Enter your domain (example.com — no http://, no path).
2. Leave Registered domains only on.
3. Click Start. Each registered look-alike is one dataset row.
4. Export JSON / CSV / Excel, or pull via API. Add a schedule for monitor mode.
5. If a run fails, open the Issues tab on this Store page.

Input

Field	Description
domain	Brand domain to protect (required)
registeredOnly	Only resolving look-alikes (default true)
maxResults	Cap on billed rows (default 5 on first run; raise for full scans)
mailServerOnly	Keep rows with MX records
minRiskScore	Drop rows below this score
mxcheck	Probe MX intercept risk (default true)
whois	Attach public WHOIS created/registrar (slower)
fuzzers	Optional comma-separated algorithm list
timeout	Scan timeout in seconds (default 300)
threads	Parallel DNS workers (default 16)
monitorMode	Diff vs previous run for the same monitor key
monitorKey	Optional watch name
includeUnchanged	Also return unchanged rows in monitor mode

Output

{
  "inputDomain": "example.com",
  "variantDomain": "examp1e.com",
  "fuzzer": "homoglyph",
  "registered": true,
  "hasMailServer": true,
  "mxInterceptRisk": false,
  "riskScore": 60,
  "riskReasons": ["fuzzer:homoglyph", "mail_server"],
  "dnsA": ["203.0.113.10"],
  "dnsAAAA": null,
  "dnsMX": ["mail.example.net"],
  "dnsNS": ["ns1.example.net"],
  "whoisCreated": null,
  "whoisRegistrar": null,
  "scannedAt": "2026-08-30T12:00:00+00:00"
}

Monitor mode adds changeType (new / changed / removed / unchanged) and changeDetail.

Pricing

Pay per look-alike row delivered (plus a small Actor-start fee). Store plan discounts apply — see the Pricing tab. Quiet monitor weeks that deliver no change rows bill the start fee only.

Tips

• Watch hasMailServer and mxInterceptRisk first — those are the phishing-shaped hits.
• Use minRiskScore (e.g. 40) to keep exports tight for SOC ticketing.
• Schedule monitor mode weekly; leave monitorKey empty for a single automatic watch per domain.
• Raise timeout for huge brands or when whois is on.

Attribution

Includes dnstwist © Marcin Ulikowski, licensed under the Apache License 2.0. See the project license for terms.