Typosquat & Lookalike Domain Scanner
Find domains that impersonate your brand. Select your region to check country-specific TLDs and see which lookalikes are already registered.
New to brand protection? Read our Lookalike Domain Protection guide for a full explanation.
What Does This Scanner Check?
We generate dozens of permutations of your domain using techniques that real attackers use (how many depends on the length of the name and your region), then check each one via DNS to confirm whether it is registered. Every result is labelled Critical, High, Medium or Low so you can focus on what matters most, and a registered name the registry lists with your brand-protection registrar is marked Probably yours.
- TLD variations: Your exact brand name on different extensions. If you own example.com, we check example.co.uk, example.net, example.io, and region-specific ccTLDs based on your market.
- Typosquatting: Common misspellings including character omission, adjacent swaps, and vowel substitutions.
- Homoglyphs: Visually similar characters like replacing "m" with "rn" or "o" with "0".
- IDN homographs: Letters that look the same as yours: your whole name in Cyrillic or Greek letters where every letter has a twin, and accented or look-alike Latin letters such as "ɑ" for "a", one letter at a time. Each name stays in one alphabet, as registries require. They are made under your own extension only, and not for a .uk or .au name, as neither registry takes such names. Up to 30 per scan, checked by DNS only.
- Keyword squatting: Your brand combined with phishing keywords like "login", "secure", or "verify".
- Structural tricks: Dot insertion, hyphen manipulation, character repetition, and plural/singular variations.
Why Region Matters
A UK-based business should be watching .co.uk, .uk, and .org.uk variants of their brand. An Australian company needs to monitor .com.au and .co.nz. Attackers target the TLDs your customers trust most. Select your region above to ensure country-code TLDs relevant to your market are included in the scan.
Registered Lookalikes vs Defensive Opportunities
Not every result is equal, and a registered lookalike is not proof of abuse. We categorise findings into four risk levels:
- Critical: Your exact brand on a different TLD that is already registered. Check it is not one of your own domains: list yours in "Your other domains" and they are left out.
- High: Any other registered lookalike, such as a homoglyph, character swap or keyword variant.
- Medium: Permutations the scan found no registration for, or whose registration could not be confirmed. They are marked Available or Unknown.
- Low: A registered lookalike that is probably yours, because the registry lists it with the brand-protection registrar your domain uses (such as MarkMonitor or CSC), which registers names only for its own clients. It is marked Probably yours, with the reason. Nameservers named after your domain are noted but do not change the rating, because anyone can list them.
What Should I Do With These Results?
- Investigate registered lookalikes: Check whether they host content, have MX records, or serve as phishing pages. Not all are malicious, but all warrant review.
- Defensively register high-risk domains: Start with your exact brand on the TLDs your customers trust, such as .co.uk and .com for a UK business. Registering them prevents attackers from doing so.
- Report malicious domains: If a lookalike is being used for phishing, report it to the registrar and to services like Google Safe Browsing.
- Enforce DMARC: Publish DMARC at p=reject so spoofed emails from your real domain are blocked. This does not stop emails from lookalike domains, but it protects your exact domain.
Frequently Asked Questions
How many permutations do you check?
We generate dozens of lookalike candidates per domain, more for longer names and for regions with more country-code TLDs, using eleven techniques: character omission, adjacent swaps, homoglyph substitution, IDN homographs (look-alike Cyrillic, Greek or accented Latin letters, up to 30), character repetition, dot insertion, hyphen manipulation, vowel swaps, plural/singular, keyword squatting, and region-aware TLD variations. Each is checked via DNS to confirm registration.
Why should I select my region?
Different regions have different country-code TLDs that your customers recognise and trust. Selecting your region ensures we check the extensions most relevant to your market. For example, a UK business should check .co.uk and .uk variants.
Which domains should I register defensively?
Start with the most convincing lookalikes: your exact brand on the TLDs your customers trust, then look-alike characters such as "rn" for "m". The scan marks permutations it found no registration for as Available. Defensively registering them is an effective way to prevent future abuse.
Does a registered lookalike mean I am being attacked?
Not necessarily. Some lookalike domains are registered by other legitimate businesses or parked by domain investors. However, any registered lookalike is a potential risk and should be investigated.
How does this differ from the ShieldMarc dashboard?
This free tool gives you a point-in-time snapshot. Lookalike monitoring in the ShieldMarc dashboard (on paid plans and the 30-day free trial) re-scans your domain about once a day and records each registered lookalike's DMARC policy, MX records and whether it serves a web page, plus its registration date and registrar where the registry provides them. It emails you when it finds a lookalike registered in the last 90 days, and again if that lookalike gains MX records while it is still within 90 days of registration, unless it publishes DMARC p=reject, has a very short name or sits on a TLD outside the alert list for your region.