Finds registered domains that imitate yours. Recently registered ones and those set up to receive mail are listed first.
The Lookalike Domain Scanner looks for registered domains that imitate the one you enter. Spoofed email and phishing sites often rely on lookalikes such as paypa1.com, TLD variants or added keywords. Free, no sign-up.
From your domain it generates up to 220 candidates — character swaps, whole-label homographs (IDN), TLD variants, added keywords, omitted / transposed / repeated characters, inserted hyphens and keyboard-adjacent typos — and checks in public DNS whether each is registered. Registered ones are ranked by abuse risk using mail setup (MX), web presence and registration date (RDAP / JPRS WHOIS).
| Level | Meaning |
|---|---|
| High | Registered within the last six months and able to receive mail or serve web content (e.g. under 30 days old with a website, or under six months with both mail and web). Abuse may be in preparation. |
| Medium | Has a trait worth checking: mail reception configured, registered within 30 days, or uses a homograph. |
| Low | Everything else (web only, no configuration, …). |
Domains older than a year are never rated "High", and ones held at corporate registrars such as MarkMonitor are downgraded because they are usually defensive registrations.
Limitations
• Candidates are generated from patterns and do not cover every possible lookalike (220 at most).
• "Registered" does not mean "abused" — defensive registrations by you or your affiliates are listed too.
• Verdicts use what public DNS shows; a domain without nameservers cannot be told apart from an unregistered one.
• TLDs without RDAP (e.g. .io, .de, .cn) have no registration date, so their risk tends to be understated.
• If you enter a subdomain, its registrable domain (e.g. example.co.jp) is scanned.
Are all registered lookalikes dangerous?
No. Many are defensive registrations or held by domain resellers. "High" is a pointer to ones that are new and ready to send mail or serve content.
Does DMARC also stop spoofing from lookalike domains?
No. DMARC only protects your own domain's identity. Mail sent from a different domain such as examp1e.com is out of scope, so lookalike monitoring and defensive registrations are separate measures.
Is it OK to scan someone else's domain?
The tool only reads public information (public DNS and RDAP). Still, abusing the results is prohibited.
The scan is slow.
Every candidate is queried in DNS, and registered ones also get a registration lookup, so the first run can take 5–20 seconds. Results for the same domain are cached for 1 hour.