Lookalike Domain Finder

About the Lookalike Domain Finder

Phishing and fraud start with a domain that looks like yours: exarnple.com for example.com, examp1e.com, éxample.com, example-login.com, or the same name under another ending. Enter your domain and this finder generates the lookalikes with the published methods of dnstwist, the open-source domain permutation engine — missing, doubled, swapped and neighbouring-key letters, look-alike characters and internationalised names, hyphens, added words, other endings and bit flips — then checks every one in DNS from your browser.

For each lookalike that exists it shows the website addresses, the mail servers (a lookalike set up for e-mail can receive mail meant for you and is ready for phishing), the name servers and, for the closest matches, the registration date from the registry’s RDAP service. A risk score adds up how alike it looks, how new it is and whether it has mail and a website. With a Premium pass, export the list as CSV and open that file next time to see what was registered since. It is meant for protecting your own brand.

Without a pass you see a free preview: every lookalike is checked and counted, and the first registered ones are shown with their details. The full list, its CSV and copying the names unlock with a Premium pass.

Common uses

• Checking a brand’s domain for typosquatting and phishing lookalikes before a launch or a rebrand.
• Monthly brand-protection checks: compare each export with the last one to catch new registrations early.
• Investigating a phishing e-mail: is the sender’s domain one of a whole set of lookalikes of yours?
• Deciding which lookalikes to register defensively.

How “registered” is decided

Each name is looked up for an address record (A). A name that does not exist (NXDOMAIN) has no registration delegated in DNS. An answer — even an empty one — or a SERVFAIL (the domain’s own name servers are broken) means the name exists. For those, the page also asks for the mail servers (MX; a single “0 .” record is a null MX, RFC 7505, meaning the domain accepts no mail), the name servers (NS) and IPv6 addresses (AAAA).

Some endings answer for every name (wildcard DNS). Before checking, the page asks each ending about a random name nobody registered; when that answers, the lookalikes under it are marked unclear instead of registered. Registration dates come from the registry over RDAP (RFC 9083), found through IANA’s bootstrap list (RFC 9224).

The risk score

Out of 100, only for registered lookalikes:

• How alike it looks (15 to 40): 40 when it looks the same as your name after replacing look-alike characters with the Unicode confusables skeleton (rn and m, 1 and l, Cyrillic а and Latin a, accents); 30 for one character away or the same name under another ending; 25 for the ending written into the name; 20 for two characters away or a word added; 15 otherwise.
• How new it is (from RDAP): 30 when registered within 30 days, 20 within 90 days, 10 within a year.
• Mail servers (MX): 20.
• A website address (A or AAAA): 10.

High from 70, medium from 40, low below. A lookalike that uses the same name servers or mail servers as your domain is pointed out: it may be one you registered yourself.

The methods

Ported from dnstwist (Apache License 2.0): letter added at the end, bit flip (one bit of one character, as faulty memory can do), Cyrillic letters for the whole name, look-alike characters (with the characters each registry allows in internationalised names, from dnstwist’s tables), hyphen added, neighbouring key added and neighbouring key instead (QWERTY, QWERTZ and AZERTY keyboards), letter left out, plural, letter doubled, dot added, letters swapped, vowel changed, word added, other ending and other forms such as examplecom.com. Internationalised names are converted to Punycode (RFC 3492) for DNS and shown as people see them. To keep the lookups gentle, look-alike characters are swapped one at a time (dnstwist can also swap two).

What to do about a lookalike

• Block it at your e-mail gateway, proxy or DNS filter, and warn staff and customers who might receive mail from it.
• Report abuse to its registrar or host when it is used for phishing: the Abuse Contact Lookup finds the right address, and the WHOIS Lookup shows the registrar.
• Dispute it when it infringes your trademark: generic top-level domains follow ICANN’s Uniform Domain-Name Dispute-Resolution Policy; country endings have their own procedures.
• Register the riskiest ones yourself before someone else does, if they are still unregistered.
• Protect your own domain with SPF, DKIM and DMARC (the DMARC Record Generator): that stops mail forged in your own name, though not mail from lookalikes.

Limitations

• DNS shows names that are delegated. A domain that is registered but has no name servers (parked without DNS, on hold) looks unregistered here; the WHOIS Lookup can confirm it.
• Registration dates are looked up for up to 50 of the closest matches, and only from registries whose RDAP service answers web pages. Others say why.
• It cannot see who owns a lookalike, or what its website shows. A registered lookalike is not proof of bad intent: check it before acting.
• Up to 2,500 names per check. Large name lists take a few minutes at the gentle rate, and a resolver may ask the page to slow down; rerun the check to retry failed lookups.
• Lookalikes in scripts other than Latin and Cyrillic, and names with two look-alike characters replaced at once, are not generated.

Privacy

Sends data to online services

The names are generated in your browser. Checking them sends each name to the public DNS resolver, and the closest matches to their registry’s RDAP server, straight from your browser: those services see the names and your IP address. MySmartCoPilot stores nothing; your method, ending and word choices are remembered in this browser only.