Waiting
Enter a domain and run a check to see results.
Find registered lookalike (typosquat) variants of your domain — homoglyphs, TLD swaps, omissions. Early phishing defense. Free instant check.
Detected
Enter a domain and run a check to see results.
—
—
Related Tools
Generate the variant spellings of your domain that phishers actually register — homoglyph swaps (l to 1, o to 0, rn to m), TLD swaps (.com to .co), character omissions, transpositions and hyphenations — then check the 80 highest-risk variants for live DNS delegation. A domain registered without nameservers is not detected. A registered variant is a fact to verify, not an accusation: check its owner and registration date via RDAP.
The tool generates variants ranked by real-world phishing prevalence, then checks the 80 highest-risk ones for live NS delegation over DNS-over-HTTPS. Variants that resolve are listed with their technique. Variants that share your nameservers or IP, or redirect to your site, are recognised as your own defensive registrations. Review the ownership and content of the rest, and consider registering the most likely ones yourself.
Not necessarily. It may be an unrelated legitimate business or a parked domain. Check the registration date with an RDAP/WHOIS lookup — a very recent registration of a brand-shaped name is a much stronger warning sign — and see whether it serves a copy of your site or a login form.
Replacing characters with visually similar ones: paypal to paypa1, google to g00gle, rn to m. In a browser address bar or an email, the fake is hard to distinguish from the real domain, which is why homoglyph variants are checked first.
Defensive registration of the top homoglyph and TLD-swap variants is cheap insurance for a brand that handles logins or payments. You do not need every variant — prioritize the ones this tool ranks highest.