Typosquat & Lookalike Domain Scanner

Find domains that impersonate your brand. Select your region to check country-specific TLDs and see which lookalikes are already registered.

New to brand protection? Read our Lookalike Domain Protection guide for a full explanation.

What does this scanner check?

We generate dozens of permutations of your domain using techniques that real attackers use (how many depends on the length of the name and your region), then check each one in DNS to see whether it is registered. For your exact name on other TLDs, look-alike characters, keyword names and dot insertions that DNS finds nothing for, we also ask the registry, where it publishes its registration data (RDAP). Nominet, which runs .uk, allows about one lookup every 2 seconds, so for a .uk name we ask it about at most 40 per scan, the exact name on other TLDs and keyword names first. Every result is labelled Critical, High, Medium or Low so you can focus on what matters most, and a registered name the registry lists with your brand-protection registrar is marked Probably yours.

TLD variations: Your exact brand name on different extensions. If you own example.com, we check example.co.uk, example.net, example.io, and region-specific ccTLDs based on your market.
Closed extensions: Only eligible organisations can register under extensions such as gov.uk, nhs.uk, police.uk, ac.uk or gov.au, so nobody else can register a lookalike there. For a domain under one of them we make the variants on the extensions anyone can register instead: for example.gov.uk, names such as example-login.co.uk, example-secure.uk and example.com.
Typosquatting: Common misspellings including character omission, adjacent swaps, and vowel substitutions.
Homoglyphs: Visually similar characters like replacing "m" with "rn" or "o" with "0".
IDN homographs: Letters that look the same as yours: your whole name in Cyrillic or Greek letters where every letter has a twin, and accented or look-alike Latin letters such as "ɑ" for "a", one letter at a time. Each name stays in one alphabet, as registries require. They are made under your own extension only, and not for a .uk or .au name, as neither registry takes such names. Up to 30 per scan. This free scan checks them in DNS only, so one it finds nothing for is marked Not found in DNS: a registered name that is not in use, such as one on hold, looks the same there.
Keyword squatting: Your brand combined with phishing keywords like "login", "secure", or "verify".
Structural tricks: Dot insertion, hyphen manipulation, character repetition, and plural/singular variations.

Why region matters

A UK-based business should be watching .co.uk, .uk, and .org.uk variants of their brand. An Australian company needs to monitor .com.au and .co.nz. Attackers target the TLDs your customers trust most. Select your region above to ensure country-code TLDs relevant to your market are included in the scan.

Registered lookalikes vs defensive opportunities

Not every result is equal, and a registered lookalike is not proof of abuse. We categorise findings into four risk levels:

Critical: Your exact brand on a different TLD that is already registered. Check it is not one of your own domains: list yours in "Your other domains" and they are left out.
High: Any other registered lookalike, such as a homoglyph, character swap or keyword variant.
Medium: Permutations the scan found no registration for, or whose registration could not be confirmed. They are marked Available when the registry told us it has no record of the name, Not found in DNS when only DNS was checked, and Unknown when the check was inconclusive.
Low: A registered lookalike that is probably yours, because the registry lists it with the brand-protection registrar your domain uses (such as MarkMonitor or CSC), which registers names only for its own clients. It is marked Probably yours, with the reason. Nameservers named after your domain are noted but do not change the rating, because anyone can list them.

What should I do with these results?

Investigate registered lookalikes: Check whether they host content, have MX records, or serve as phishing pages. Not all are malicious, but all warrant review.
Defensively register high-risk domains: Start with your exact brand on the TLDs your customers trust, such as .co.uk and .com for a UK business. Registering them prevents attackers from doing so.
Report malicious domains: If a lookalike is being used for phishing, report it to the registrar and to services like Google Safe Browsing.
Enforce DMARC: Publish DMARC at p=reject. You then ask receivers to refuse mail that uses your real domain and fails DMARC; each receiver makes the final call (RFC 9989, section 5.4). This does not stop emails from lookalike domains, but it covers your exact domain.

Frequently asked questions

How many permutations do you check?

We generate dozens of lookalike candidates per domain, more for longer names and for regions with more country-code TLDs, using eleven techniques: character omission, adjacent swaps, homoglyph substitution, IDN homographs (look-alike Cyrillic, Greek or accented Latin letters, up to 30), character repetition, dot insertion, hyphen manipulation, vowel swaps, plural/singular, keyword squatting, and region-aware TLD variations. Each is checked in DNS, and the kinds attackers register most often are also looked up with the registry.

Why should I select my region?

Different regions have different country-code TLDs that your customers recognise and trust. Selecting your region ensures we check the extensions most relevant to your market. For example, a UK business should check .co.uk and .uk variants.

Which domains should I register defensively?

Start with the most convincing lookalikes: your exact brand on the TLDs your customers trust, then look-alike characters such as "rn" for "m". The scan marks a permutation Available when the registry told us it has no record of it, and Not found in DNS when only DNS was checked, which a registered name that is not in use can also show. Defensively registering the ones that are free is an effective way to prevent future abuse.

Does a registered lookalike mean I am being attacked?

Not necessarily. Some lookalike domains are registered by other legitimate businesses or parked by domain investors. However, any registered lookalike is a potential risk and should be investigated.

How does this differ from the ShieldMarc dashboard?

This free tool gives you a point-in-time snapshot. Lookalike monitoring in the ShieldMarc dashboard (on paid plans and the 30-day free trial) re-scans your domain about once a day and records each registered lookalike's DMARC policy, MX records and whether it serves a web page, plus its registration date and registrar where the registry provides them. It also asks the registry about the permutations DNS found nothing for, where the registry publishes its registration data, so it can find a lookalike that is registered but not in use. It checks the most likely ones (your exact name on other extensions, and keyword names) with the registry on every scan, and works through the rest over the following scans. It emails you when it finds a lookalike registered in the last 90 days, and again if that lookalike gains MX records while it is still within 90 days of registration, unless it publishes DMARC p=reject, has a very short name or sits on a TLD outside the alert list for your region. Once you acknowledge or dismiss a lookalike, it emails you about that lookalike again only if it changes (it gains MX records, weakens its DMARC policy, is registered again or changes registrar, or mail naming it fails DMARC in your reports), and says what changed.