Typosquat checker
Two jobs, one tool. Generate the lookalike domains an attacker would register against your brand, so you can monitor or register them yourself. Or compare a list of domains you have found — in certificate transparency logs, in referrer data, in a phishing report — and get each one scored against your brand with the technique named.
Summary
How to use
- Enter the domain you are protecting. A leading
www.or scheme is stripped automatically. - Generate mode: pick the techniques and read the list. Copy it into whatever you monitor with — a certificate transparency alert, a DNS monitoring service, or a registrar's bulk availability check.
- Compare mode: paste the domains you have collected. Each is scored: the brand itself, a homoglyph lookalike, one or two edits away, brand-embedded, or unrelated — with the edit distance and the reasons.
- Homoglyph comparison folds confusable characters before comparing, so
раypal.comwith Cyrillic letters is recognised as identical to the Latin spelling rather than as a distant string.
The nine techniques
Omission — a dropped character (exmple.com). Duplication — a doubled one (exaample.com). Transposition — two adjacent characters swapped (exapmle.com). These three are pure typing errors and produce the highest accidental traffic, which is why they are the most commonly registered.
Keyboard slips — a character replaced by its QWERTY neighbour (ezample.com). Also accidental, and worth noting that the variant set differs on other layouts.
Homoglyphs — a character replaced by something that looks like it: rn for m, l for I, 0 for o, or a Cyrillic а for a Latin a. These are not typing errors; nobody reaches them by accident. They exist to be clicked from a link, and they are the highest-risk category.
Hyphenation — inserting or removing a hyphen (ex-ample.com). TLD swaps — the same name under a different suffix (example.net, example.co). The .co case is particularly effective against .com, because it is one dropped keystroke and a plausible-looking domain.
Combosquatting — your brand plus a trust word: example-login.com, secure-example.com, example-support.com. No misspelling at all, which is why these read as legitimate and why they dominate real phishing campaigns.
Domain-as-subdomain — example.com.evil.test, where your entire domain becomes a subdomain of someone else's. Nothing you can register defends against this; it is here so you recognise it in a report.
What to do with the list
Registering every variant is not realistic — the generated set runs to hundreds of domains. The practical priority order: register the handful of highest-traffic typos (single omissions and transpositions of your main name) and the obvious TLD swaps in markets you operate in; then monitor the rest rather than buying them.
Monitoring is the higher-value half, and it is free. Certificate transparency logs record every publicly-trusted certificate issued, so a lookalike domain that sets up HTTPS — which a phishing site must — appears in CT within minutes. Services like crt.sh let you watch a pattern. Combine that with your own referrer logs and any brand-mention alerting you already have.
When you find a live lookalike being used for phishing, the escalation path is the registrar's abuse contact and the hosting provider's, plus reporting the URL to Google Safe Browsing and Microsoft SmartScreen so browsers warn users. That is usually faster than a legal route — a UDRP dispute takes months, and by then the campaign has moved.
FAQ
Does this check whether the domains are registered?
No — that needs WHOIS or DNS, neither of which a browser tab can query. It generates and scores names; take the list to a registrar's bulk check or a WHOIS API for registration status.
Why are there so many variants?
Because the techniques multiply: a ten-character name has ten omissions, nine transpositions, dozens of keyboard slips and hundreds of homoglyph substitutions. Untick techniques to narrow it, or raise the limit if you want the full set for a monitoring rule.
How is the edit distance calculated?
Damerau-Levenshtein, which counts an adjacent transposition as one edit rather than two. That matters for domains, where swapped letters are the most common typo — exapmle is one edit from example, not two.
Is generating these names itself a problem?
No — this is standard defensive practice, and the same technique the established brand-protection tools use. The output is a list of names to watch or register, and nothing here registers, resolves or contacts anything.