Typosquatting Check – Lookalike Domains That Resolve in DNS

Give it your domain and it generates up to 30 typo versions of it (a dropped letter, two letters swapped, a neighbouring key) and tells you which ones resolve in DNS. A typo domain that resolves is worth a look; on its own it is not proof of typosquatting (see below). Each run is a snapshot; put it on an Apify schedule to repeat it.

Use it when

• You want to know which misspellings of your brand's domain are live before a customer lands on one.
• You run brand-protection or phishing-exposure checks for clients and need the DNS evidence as rows, not a screenshot.
• An agent needs a bounded, repeatable list of lookalike candidates with resolution status.

How it works

A supplied registrable ASCII domain → deterministic typo variants and observed A/AAAA DNS evidence via Cloudflare's public DNS resolver. Snapshot only: nothing is remembered between runs.

{ "domains": ["example.com"] }

Up to 5 raw seeds/run, 30 variants/seed, 60 sequential DNS queries/seed. Each query has a 5-second deadline including response parsing, long enough for the resolver to give up on a lame delegation (about 4 seconds); a query that misses it is asked once more, and other failures are not retried. A 150-second total budget per seed covers all attempts, retries and parsing; the final attempt is shortened to the remaining budget. On exhaustion, remaining generated A/AAAA evidence is unknown without more network calls, and the seed persists free as partial or upstream_error. Seeds remain sequential against the shared resolver: five seeds have at most 750 seconds of DNS waiting, leaving startup/persistence margin within the existing 960-second default run timeout. No seed-domain query. Candidate order: single-character deletion, adjacent transposition, then left/right neighbours in the QWERTY letter rows qwertyuiop, asdfghjkl, zxcvbnm. Deduplication and cap happen before querying. Only the registrable label changes; the ICANN suffix stays unchanged. No insertions, suffix swaps, homographs or IDN generation. truncated reports capped candidates; each query caps observed addresses at 16 and separately reports truncation.

Accepted seed spellings normalize case, whitespace, URL/email form, port, trailing dot and www. prefix. Normalized repeats yield one row and at most one charge; distinct invalid junk stays distinct. Other subdomains, unknown/non-ICANN suffixes, nonregistrable names and normalized xn-- labels are refused. Normalization does not discover a company's domain.

Rows contain normalized domain (null if invalid), variants with separate a/aaaa statuses and addresses, query counts, elapsed time and limits. NOERROR and NXDOMAIN are resolver answers. SERVFAIL is recorded only when the resolver reports the name is delegated but no authoritative nameserver answers (a lame delegation, common for parked or abandoned typo registrations); other SERVFAILs are unknown. unknown means a DNS/HTTP/transport/payload failure or exhausted seed budget. queries counts logical queries actually attempted, excluding retries and budget-skipped queries; answeredQueries counts conclusive evidence and unknownQueries counts all unresolved generated evidence, including skipped queries. Thus answeredQueries + unknownQueries = 2 × variants.length, while queries can be smaller. Any unknown makes the entire seed free, with answered evidence retained. A fully answered capped scan is an answer even when none of its variants yields addresses. A one-character digit label can produce no valid candidates; that completed empty generation also bills, with zero queries explicitly reported.

DNS resolution is not registration, purchase availability, ownership, maliciousness or phishing. A DNS-negative response does not prove a name is unregistered or safe. An address may be parking, wildcard DNS, shared hosting or unrelated content. No RDAP or website fetches, threat scores or exhaustive coverage claims.

Billing

$0.01 per completed seed, not per variant or address. A charge cap stops the batch early; unprocessed seeds have no dataset row or charge. The truncated flags describe candidate/address caps, not omitted seeds.

reasonCode	Meaning	Charged?
checked	Every generated, capped A/AAAA query answered, including empty address results	yes
invalid_domain	Unsupported or unusable seed; no DNS query	no
partial	Some queries answered, some unknown; retained evidence is incomplete	no
upstream_error	No generated queries answered	no

Source and access

Cloudflare's free public resolver documents the unauthenticated JSON DoH endpoint. Its resolver terms incorporate Website and Online Services Terms, including no overload or limit circumvention. Documented public API use is not blanket rights over third-party content or trademarks. Only DNS evidence is collected here; callers remain responsible for lawful use. Service availability and data accuracy are not guaranteed by Cloudflare.