Lookalike Domain Checker
Generate the lookalike variants attackers register to impersonate your brand — homoglyphs, typosquats, combosquats, and TLD swaps — then resolve each one to flag which are registered, accept mail, and pose a credible phishing risk.
Workflow
Run check
Inspect a live record
Results are generated on demand so you can verify the current public configuration.
Why check for lookalike domains?
Impersonation domains are the launchpad for phishing, business email compromise, and brand
abuse. Attackers register a variant that reads like your domain at a glance, then use it to
send mail your customers and staff trust. Finding those variants early lets you defensively
register the dangerous ones, file takedowns, and brief your team before an attack lands.
How the candidates are generated.
We build variants the way attackers do: homoglyph swaps that read as the original glyph,
typosquats from missing, doubled, or transposed characters, combosquats that append common
words, and swaps to other popular TLDs. Internationalized (IDN) input is normalized to
punycode first so unicode homoglyph tricks are handled. Candidates are resolved cheaply with
DNS and MX checks before any WHOIS call, and WHOIS is capped to protect upstream registries.
What is a lookalike or impersonation domain? +
A lookalike domain is a deliberately similar variant of your domain — using swapped letters (rn for m, l for 1, o for 0), missing or doubled characters, added words like -secure or -login, or a different TLD. Attackers register these to send phishing email or host spoof sites that pass for your brand.
How does this tool decide the risk level? +
Each candidate is resolved on demand. A registered variant that also publishes MX records and closely resembles your domain is HIGH risk because it can send convincing email. A registered variant with no mail records is MEDIUM. A variant that is not yet registered is LOW, since it is only a future threat.
Does this monitor my domain continuously? +
No. This is a one-shot, on-demand check. It permutes likely variants and resolves them in the moment — it does not ingest certificate-transparency logs, zone files, or newly-registered-domain feeds, and it does not run background monitoring.