Lookalike Domain Finder
List typo and look-alike versions of a domain that attackers could register, and see which ones already exist.
Looks up live data The variant names are generated in your browser. To find out which exist, an automatic sample of the names (up to 50 per run) is sent to our server in batches of 10, and it asks Cloudflare's public DNS (1.1.1.1) about each, which in turn asks those domains' name servers. Nothing is fetched from those domains and nothing is stored. A Cloudflare Turnstile bot check runs when you press the button. A Cloudflare Turnstile bot check runs when you press the button (it loads a script from challenges.cloudflare.com and may show a short challenge).
| Name | Kind | DNS |
|---|
Report a problem with this tool
About this tool
Typosquatting is registering a domain that is one slip away from a real one, such as exmaple.com or examp1e.com, so that visitors who mistype or misread it land on a page the attacker controls. Phishers use the same trick, often with look-alike characters from other alphabets, and with a mail server set up so they can send messages that appear to come from you. This tool builds the common kinds of variant from the domain you enter: a missing letter, two neighbouring letters swapped, a doubled letter, a neighbouring key typed instead or in addition (using QWERTY, QWERTZ and AZERTY layouts), a hyphen or dot inserted, one letter added at the end, a vowel replaced, a single flipped bit (which happens in faulty memory and is a real attack), look-alike characters such as 1 for l, rn for m, or Cyrillic and Greek letters that are written differently on the wire as punycode, and the same name under other endings such as .net or .co. The algorithmic kinds were compared with the open-source dnstwist tool, which they match, while the look-alike set is curated by us. Because nobody can check thousands of names, the tool takes a sample of up to 50 spread across all the kinds and asks DNS which of them exist. A name that answers with address, name-server or mail records is shown as active, and one with mail records is flagged because it can send or receive email. Active does not mean malicious: many are parked, unrelated businesses or defensive registrations of your own. Use the list to decide which to watch or register, and report real abuse to the registrar. The tool only looks at DNS; it never opens the sites. The copy buttons give the list either defanged (dots in brackets, safe to paste into a ticket or chat) or plain.
How to use it
- Enter the domain you want to protect, for example example.com.
- Press Generate to see the variants, grouped by kind.
- Press Check which exist to look up a sample of up to 50 names, spread over the kinds.
- Review the active names, especially any with mail servers, and decide what to register, monitor or report.
Common problems
- A name is active but I do not know who owns it
- Look it up with the WHOIS tool. Many hits are parked pages or unrelated businesses; look at the registration date and where it points before you decide it is abuse.
- Only some of the variants were checked
- A domain has thousands of possible variants. The check covers a sample of 50 spread across the kinds. Untick the kinds you do not need and generate again: the sample is then spread over fewer kinds, so each gets more coverage. The copy buttons give you the full list to take to your own tools.
- A name shows as no records but I expect it to be registered
- A registered domain with no DNS records at all looks the same as an unregistered one from DNS alone. A WHOIS lookup shows whether it is registered.