Domain Mutation Generator
List the typo, look-alike and keyword variants of your domain that attackers register, as text for brand monitoring, blocklists and takedown preparation.
Runs in your browser Your input never leaves your device.
| Domain | DNS form | Family |
|---|
Names are generated in your browser from the domain you enter. Nothing is looked up or sent, and a name in the list is not necessarily registered. Use the list for brand monitoring, blocklists and takedown preparation on domains you are responsible for.
Report a problem with this tool
About this tool
Attackers register domains that resemble a brand to phish customers or intercept mistyped mail. The best defence starts with knowing what those names look like. This tool writes them out from the domain you enter, entirely in your browser. The typo and look-alike families are the ones dnstwist uses: omitted, transposed, repeated, replaced and inserted letters based on real keyboard layouts, an added letter, a hyphen inside the name, a dot that turns the name into a subdomain, vowel swaps, single bit flips (bitsquatting), homoglyphs including mixed-script and two-letter look-alikes such as rn for m, and the same name under other common endings. Two families are added here: combosquatting, where keywords such as login, secure, support or pay are joined to the brand with or without a hyphen on either side (example-login.com, secureexample.com), and the domain ending written into the name (examplecom.net, example-com.net). You can edit the keyword list, choose the families, set a limit, filter the table, and copy the names or download a CSV. Internationalised look-alikes are shown with their punycode (xn--) form, which is what DNS and blocklists use. Nothing is looked up, so a name in the list is not necessarily registered; use the live look-alike domain finder to see which ones exist. The typo families are the same code the look-alike domain finder uses, which is compared with dnstwist in its own test, and the added families were compared with an independent Python implementation of the rules. Names longer than 63 characters are skipped because a DNS label cannot be that long. Use the output for brand monitoring, blocklists and takedown preparation on domains you are responsible for.
How to use it
- Enter the domain you want to protect.
- Choose the mutation families and edit the keyword list if you want.
- Generate, then filter the table by family or text.
- Copy the names or download a CSV for your monitoring or blocklist tools.
Common problems
- The list is very long
- Untick families you do not need, shorten the keyword list or lower the limit. Short brand names produce the most variants.
- I want to know which of these exist
- This tool only writes names. Use the look-alike domain finder, which checks live DNS for a sample, or your own monitoring service.
- The tool rejects my domain
- Enter a full domain such as example.com in normal letters (not punycode), with a name part under 40 characters.