Typosquatting Detection — Find Lookalike Domains, 1,075 TLDs

Finds every delegated domain that matches, imitates or contains your brand, across the whole gTLD namespace. It reads the registries' own zone files, so a match means the domain really exists today — not that someone once registered it, not that a scraper saw it last month.

Typosquats, homograph tricks, brand-plus-keyword domains and lookalikes in TLDs you have never checked. One run, 1,075 TLDs.

Coverage

1,075 gTLDs, including .com, .net, .org, .info, .biz, .xyz, .top, .shop, .online, .site, .store, .app, .dev and .cloud — 255,631,856 delegated domains, counted from the zone files themselves and refreshed daily.

Coverage is real but it is not evenly spread, and you should know the shape of it before you rely on it: .com alone is 166 million of that total, and while all 1,075 TLDs are included, 481 of them hold fewer than a thousand domains each. Breadth helps you catch something in an obscure TLD; it is not 1,075 equally busy namespaces.

You can narrow it. Leave Limit to these TLDs empty and the sweep covers all 1,075. Fill it in — com, net, shop — and the run is substantially faster and cheaper, because the service skips every other TLD instead of reading through them. If you already know which namespaces matter to your brand, say so.

Not covered: .io, .ai, .co, .me, .tv, .cc and every other country-code TLD. These are not available from ICANN's zone file service at any price — they are run outside ICANN's contracts. They are also exactly the TLDs a startup expects, so we say it here rather than letting you find out from an empty result.

What a zone file does not contain, and no run will ever return: the registrant, their email, the registrar, the registration date, the expiry date, or the domain's own A, MX and TXT records. Any tool promising those needs a different source, and at scale that source is prohibited by the agreement behind this data.

Input

Every run is anchored on something you provide. There is no way to ask this Actor for the whole namespace, and that is a design decision rather than a limitation: the data agreement behind it forbids handing over a substantial portion of a zone, so the product simply has no shape that could.

See Example runs below for fifteen worked inputs.

Output

Field	Meaning
domain	The matching domain, lowercase, in A-label form
tld	Its top-level domain
match_type	exact, typo or contains
edit_distance	How many characters away from your brand, for typo matches
nameservers	Every nameserver the domain delegates to
dns_provider	Who runs the DNS, inferred from the nameserver. 69.1% filled. This is a hosting fact, not a technology one — see below
parked_for_sale	True when the nameserver belongs to a parking or domain-sale service. 2.0% of domains, and exact when it fires

Reading the results

A match is not an infringement. stripe-tools.com may be a legitimate integration partner and strlpe.com may be a parked typo nobody will ever use. This Actor tells you what exists; deciding what to act on is your job and your lawyer's.

exact is certain. typo and contains are search, not judgement. Edit distance 2 will surface names that share letters with your brand by coincidence, especially for short brands. If your brand is under five characters, start at distance 1.

A domain that exists is not necessarily live. The zone file proves delegation, not that a website answers. Check parked_for_sale: a match sitting on Afternic or Sedo is a squatter waiting to sell, which is a different problem from one running a fake shop.

dns_provider says who runs the DNS, not what the site is built with. We measured every domain in the zone: the nameserver identifies the DNS operator for 69% of them, but that is a hosting fact. A domain on Cloudflare can be running anything at all. Website platforms are configured with A and CNAME records, which a zone file does not contain, so we cannot see them and we do not guess — Shopify, for instance, is visible on 185 domains out of 64 million. We would rather ship a column that is true than one that looks impressive.

An empty result is the good news, and it only costs the $0.00001 start fee. If nothing came back, nobody is squatting on your brand in the zones we cover today.

Example runs

1. Find typosquatting domains for a short brand name

{
  "brand": [
    "stripe"
  ],
  "matchTypes": [
    "exact",
    "typo"
  ],
  "maxEditDistance": 1,
  "maxResults": 100
}

2. Thorough typosquat sweep with edit distance 2

{
  "brand": [
    "stripe"
  ],
  "matchTypes": [
    "exact",
    "typo",
    "contains"
  ],
  "maxEditDistance": 2,
  "maxResults": 500
}

3. Check two spellings of one brand for squatters

{
  "brand": [
    "mailchimp",
    "mailchimps"
  ],
  "matchTypes": [
    "exact",
    "typo"
  ],
  "maxEditDistance": 1,
  "maxResults": 200
}

4. Monitor a brand and its product names for squatting

{
  "brand": [
    "figma",
    "figjam"
  ],
  "matchTypes": [
    "exact",
    "contains"
  ],
  "maxResults": 300
}

5. List exact-match brand domains across all TLDs

{
  "brand": [
    "notion"
  ],
  "matchTypes": [
    "exact"
  ],
  "maxResults": 1000
}

6. Find brand plus keyword domain squatting

{
  "brand": [
    "paypal"
  ],
  "matchTypes": [
    "contains"
  ],
  "maxResults": 1000
}

7. Typosquatting detection for a long brand name

{
  "brand": [
    "cloudflare"
  ],
  "matchTypes": [
    "typo"
  ],
  "maxEditDistance": 2,
  "maxResults": 500
}

8. Check hyphenated variants of a two-word brand

{
  "brand": [
    "redbull",
    "red-bull"
  ],
  "matchTypes": [
    "exact",
    "typo"
  ],
  "maxEditDistance": 1,
  "maxResults": 200
}

9. Typosquat check for a three-letter acronym brand

{
  "brand": [
    "ibm"
  ],
  "matchTypes": [
    "typo"
  ],
  "maxEditDistance": 1,
  "maxResults": 200
}

10. Find phishing lookalike domains imitating a bank

{
  "brand": [
    "santander"
  ],
  "matchTypes": [
    "typo",
    "contains"
  ],
  "maxEditDistance": 2,
  "maxResults": 2000
}

11. Full typosquatting sweep before a product launch

{
  "brand": [
    "ozempic"
  ],
  "matchTypes": [
    "exact",
    "typo",
    "contains"
  ],
  "maxEditDistance": 2,
  "maxResults": 1000
}

12. Find squatted domains for a game or media title

{
  "brand": [
    "gta6"
  ],
  "matchTypes": [
    "exact",
    "contains"
  ],
  "maxResults": 500
}

13. Monitor a licensed brand for unauthorised domains

{
  "brand": [
    "shopify"
  ],
  "matchTypes": [
    "exact"
  ],
  "maxResults": 500
}

14. Brand protection when your brand is a common word

{
  "brand": [
    "apple"
  ],
  "matchTypes": [
    "exact"
  ],
  "maxResults": 1000
}

15. Weekly scheduled typosquatting monitoring run

{
  "brand": [
    "binance"
  ],
  "matchTypes": [
    "exact",
    "typo",
    "contains"
  ],
  "maxEditDistance": 2,
  "maxResults": 5000
}

Pricing

$0.00001 to start, then $0.004 per matching domain — about $4 per 1,000 results, and a default run of 100 rows costs $0.40.

The closest thing in the Store is a dnstwist-based typosquatting detector at $0.03 per registered domain found — $30 per 1,000. This is roughly seven times cheaper, and it works differently: dnstwist generates permutations of your brand and then tests whether each one resolves. This searches the registries' own zone files for what is actually there, so it finds squats whose spelling no permutation engine would have guessed.

Data source

🛡️ Sourced from the Registry Operators' own zone files, obtained through ICANN's Centralized Zone Data Service under agreement with those operators. ICANN does not endorse, sponsor or review this Actor.

Built for security research, brand protection and domain analytics. The access behind this data was granted one TLD at a time, which is why the coverage is what it is.

Support

Found a domain the Actor missed, or a row that looks wrong? Open an issue on the Actor page with the exact input you used. Zone data is refreshed once a day, so a domain delegated this morning may not appear until tomorrow's snapshot.