Skip to content
Email Delivery Platform
Talk to engineering

/ Free Tools — Lookalike Domain Scanner

The domains built to wear your name.

Generate the typosquat, homoglyph, and Unicode-homograph domains an attacker would use to impersonate you — then check live which are already registered and which have mail servers, meaning they're armed to phish as you. A risk map lights up each variant. In your browser, nothing sent but DNS.

Request infrastructure review How spoofing works

Generates lookalike variants and checks each for registration and mail servers live over DNS-over-HTTPS. Only candidate domain names leave your browser.

/ What this does

Phishing that wears your brand almost always starts with a lookalike domain — a typo, a character swap, a near-miss TLD, or a Unicode twin that's visually identical to your name. This scanner generates those variants the way an attacker's toolkit would, then checks each one live over DNS to see which are already registered and which publish mail servers. A registered lookalike with MX records is armed: it can send email as a convincing near-copy of you. The tool sorts every variant into a risk map — armed, registered, or available — so the live threats surface first, and shows the punycode behind each Unicode homograph so you can see the deception for what it is.

Registration tells you someone already holds a near-copy of your name; mail servers tell you it's ready to be weaponized. Seeing them mapped turns an abstract worry into a concrete list you can act on — enforce DMARC so nobody sends as your real domain, watch the registered-but-idle ones, and defensively register the obvious gaps. Only the candidate names go out as DNS queries; your brand and the results stay in the browser.

  • Attacker's toolkit

    Typos, ASCII homoglyphs, TLD swaps, combosquats, and Unicode homographs — the same families a real permutation engine generates.

  • Armed vs latent

    Registration plus MX records means a lookalike can send mail as you — the tool flags those first, above the merely registered and the available.

  • Punycode unmasked

    Unicode homographs are shown with the real xn-- name they resolve to, so the visually identical twin is exposed.

  • DNS only

    Just candidate domain names go out, as public DNS queries. Your brand and the findings never leave the page.

/ How spoofing works

How does a lookalike domain fool people?

People read shapes, not characters. A recipient skimming an inbox sees the silhouette of your brand and trusts it, which is exactly what a lookalike exploits. The crudest version is a typo the eye autocorrects — a dropped letter, a doubled one, two letters transposed. A step up are the ASCII homoglyphs: rn reads as m, vv as w, the digit one as a lowercase L. At small sizes, on a phone, they're invisible.

The most deceptive class is the Unicode homograph. Many alphabets contain characters drawn identically to Latin letters — the Cyrillic a, e, o, and p are pixel-for-pixel matches. Swap one in and the domain is visually indistinguishable from yours, yet it's a completely different registration that resolves, in DNS, to a punycode name starting with xn--. There's no typo for the eye to catch, which is why browsers and mail clients now try to flag them — and why knowing which twins of your name exist is worth doing before someone else does.

A lookalike only becomes an attack when it's registered and can send mail, and that's the pairing the scanner hunts for. But the defense that neutralizes the whole class isn't registering every variant — it's authentication. A lookalike can never pass DMARC for your real domain, so enforced DMARC stops the most damaging move, sending mail that appears to come from your exact address. The scanner finds the impostors; authentication makes impersonating the genuine article impossible.

/ The defense

You can't register every lookalike, so what actually protects you?

The permutation space is effectively infinite — no one can pre-register every typo, homoglyph, and Unicode twin of their name, and trying is a budget sink. So the strategy is tiered. Defensive registration is worth it for a short list: the handful of obvious typos, the Unicode homograph of your exact name, and the near-miss TLDs your customers might guess. Beyond that, registration stops paying off.

What scales is authentication and monitoring. Enforced DMARC at p=reject means a message forged from your real domain is rejected outright, which removes the highest-impact attack even if a hundred lookalikes exist. Watching the registered lookalikes for a shift to mail-active gives you early warning, and DMARC aggregate reports show you when an unfamiliar source starts sending as you. When a lookalike crosses into active abuse, a takedown request or a UDRP filing removes it. The scan is the reconnaissance; the standing defense is a locked-down authentication posture that makes your genuine domain unforgeable — which is what we operate.

/ Lookalike FAQ

What kinds of lookalikes does it generate?
The same permutation families an attacker's toolkit uses. Typos: dropped, doubled, and transposed characters, and adjacent-key slips like googke for google. ASCII homoglyphs: swaps that look similar in most fonts, such as rn for m, vv for w, the digit 1 for the letter l, and 0 for o. Structural tricks: extra hyphens, alternate and near-miss TLDs (.co for .com, .net, .io), and combosquats that bolt on words like secure- or -login that phishing pages love. And the dangerous one — Unicode homographs, where a Latin letter is replaced with an identical-looking Cyrillic or Greek character, producing a domain that's visually indistinguishable from yours and resolves to a punycode xn-- name. The tool builds a deduplicated set across all of these.
What makes a lookalike actually dangerous?
Registration and mail. An unregistered lookalike is only latent exposure — a slot someone could grab. A registered one means somebody already owns that near-miss of your name, whether a squatter, a competitor, or an attacker. The sharpest signal is a registered lookalike with MX records: mail servers mean the domain can send and receive email, which is exactly what's needed to run a phishing or business-email-compromise campaign wearing your brand. The scanner checks both live per variant and sorts them so the armed ones — registered, with mail — surface first.
How does it check registration and mail?
For each generated variant it asks public DNS over HTTPS two questions: does the domain have nameservers, which means it's registered, and does it publish MX records, which means it can handle mail. A domain that returns NXDOMAIN is unregistered and available. One with nameservers but no MX is registered but not obviously mail-armed — often parked, redirecting, or held defensively. One with both is the live threat. It's the same DNS anyone can query, resolved in your browser, and only the candidate domain names go out.
Why does a Unicode homograph resolve to xn-- something?
Because DNS itself is ASCII. When a domain contains non-ASCII characters — like a Cyrillic a that looks identical to a Latin a — it's encoded into an ASCII-compatible form beginning with xn--, called punycode, for the actual lookup. So a domain that reads as your brand to a human resolves, under the hood, to something like xn--pypal-4ve.com. The tool shows you both: the deceptive display form and the real punycode it becomes, so you can see the trick and search for the true registration.
What should I do about the ones it finds?
Triage by the risk tier. For registered lookalikes with mail servers, treat them as active impersonation risk: publish and enforce DMARC so mail forged from your exact domain is rejected, monitor for messages abusing the lookalike, and consider a takedown or UDRP action if it's clearly infringing. For registered-but-idle lookalikes, keep an eye on them for a change to mail-active. For the highest-value unregistered variants — the obvious typos and the Unicode twin of your exact name — defensive registration is cheap insurance. DMARC is the throughline: it doesn't stop someone registering a lookalike, but it stops them sending as your real domain.
Does anything leave my browser?
Only the generated candidate domain names, as DNS-over-HTTPS lookups — public queries any resolver handles. Your brand domain, the variant list, and the results aren't sent to us or stored. Generation, punycode encoding, and risk sorting all happen locally, which you can confirm in the network tab where the only traffic is DNS.

The scan finds the impostors. Authentication makes you unforgeable.

You can't register every lookalike, but you can make your real domain impossible to send as. Enforced DMARC, aligned senders, and monitoring for abuse is the standing defense — and it's what we operate. Scan the lookalikes, then let's lock the door.

Book infrastructure review

Related capabilities