Lookalike domain checker: find registered typo and homoglyph versions of your domain
A lookalike domain checker generates near-copies of your domain, such as missing or swapped letters, rn for m, Cyrillic letters that look Latin, or .co for .com, and checks which are registered. The ones with mail servers matter most for email, because they can send messages that pass a quick glance as yours. Enter your domain to see them.
Generates up to 150 typo, homoglyph and TLD variants and checks each in public DNS. Three checks a minute.
Sample result
amce.example and acme.test, lookalikes of acme.example, are registered.
- Your domain
- acme.example
- Variants checked
- 150
- Your DMARC
- p=reject
What this means for you
Registered isn't proof of abuse; watch any that can send mail, and keep DMARC strict.
- Up to 150 typo, homoglyph and TLD variants
- Shows which are registered and delegated
- Flags variants with a website or MX records
- Reads your own DMARC policy alongside
- Typosquats
- Homoglyphs
- MX
By SimpleVerifier Team · Last updated
How do I check for lookalike domains?
- Enter your domain, such as yourbrand.com.
- Press Find lookalikes. Up to 150 variants are generated and checked in public DNS, which takes a few seconds.
- Start with the ones marked MX: those domains have mail servers set up. Then look at the ones that resolve on the web.
- Check who owns any you don't recognise with the WHOIS lookup, and download the CSV to track them over time.
Example
- You enter
- The domain
acme.example. - You get
- 150 variants checked. Registered lookalikes include
amce.example(letters swapped) andacme.test(different TLD), both with a website and no MX records, shown beside your own DMARC policy ofp=reject. - Limits
- Up to 150 variants per check and 3 checks a minute per connection.
What is a lookalike domain?
A lookalike domain is a name registered to resemble a real one closely enough to fool a reader: examp1e.com, exmaple.com, example-secure.com, or еxample.com written with a Cyrillic е. Registering them to catch mistyped visits is called typosquatting; using them in email is a common way to impersonate a company to its customers and staff.
Unicode look-alikes work because domains can contain non-Latin letters, encoded as xn-- punycode under IDNA (RFC 5891). Unicode's UTS #39 catalogues characters that are visually confusable, and browsers such as Chrome show suspicious mixed-script names as punycode, as its IDN policy explains.
How do I find lookalike domains?
Generate the plausible variants and look each one up in DNS. This checker builds nine kinds: a missing, doubled or swapped letter, a neighbouring-key slip, ASCII look-alikes (0 for o, rn for m, vv for w), Cyrillic look-alikes, an added hyphen, a different TLD, and common phishing words such as secure- or -login. The approach is the one open-source tools like dnstwist use.
Each variant is checked for NS records (registered and delegated), A or AAAA records (something answers on the web) and MX records (it can receive mail and is often set up to send). Nothing is sent to the lookalike domains themselves.
Does DMARC stop lookalike domains?
No. DMARC, defined in RFC 7489, protects the exact domain in the From address: with p=reject, mail claiming to be from yourbrand.com that fails authentication is refused. A lookalike is a different domain that its owner can authenticate perfectly well, so DMARC on your domain has no say over it.
That's why enforcement and monitoring go together. Get your own DMARC to quarantine or reject so attackers can't use the real name, the checker shows your current policy, then watch for lookalikes, especially ones with MX records, and act on those that impersonate you.
How do I protect my brand from typosquatting?
Register the few lookalikes most likely to be abused, usually your name on the main TLDs and the most obvious typos, and point them at your real site. You can't register them all, so monitor the rest: run this check periodically and compare the CSV.
For a lookalike used to impersonate you, report phishing to the registrar's abuse contact shown in the WHOIS record and to the hosting provider. Where a domain uses your trademark in bad faith, ICANN's Uniform Domain-Name Dispute-Resolution Policy is the formal route to have it transferred. Get legal advice before claiming someone else's domain is infringing.
Is this the same as a domain monitoring service?
| This checker | A monitoring service | |
|---|---|---|
| Finds existing lookalikes | Yes, on demand | Yes |
| Alerts on new registrations | No; re-run and compare | Yes |
| Variants covered | Up to 150 common patterns | Usually more, plus new-registration feeds |
| Takedown help | No | Often included |
| Cost | Free | Usually paid |
Who uses this tool, and for what?
- Security teams
- Watch for new lookalikes with MX records, the ones that can send convincing phishing to staff and customers.
- Brand managers
- Decide which typo domains to register defensively, based on which are still free and which already exist.
- Email deliverability teams
- Pair a DMARC rollout with lookalike monitoring, since enforcement pushes spoofers to similar domains.
- MSPs
- Run a quick lookalike sweep for each client domain during a security review and hand over the CSV.
What can’t this tool tell you?
- It covers up to 150 common variants, not every possible lookalike: other scripts, two-letter typos and new TLDs aren't all included.
- Registered says nothing about the owner or intent. Many lookalikes are defensive registrations or unrelated businesses.
- DNS shows set-up, not activity: we can't see whether a domain is sending email or hosting phishing.
- Some TLDs answer every name, which can make unregistered variants look registered; check ones that surprise you with WHOIS.
Common questions
- What is a lookalike domain?
- A domain registered to look like a real one, such as a typo, a swapped letter, a look-alike character or a different TLD. They're used for typosquatting and to impersonate companies in email.
- What is typosquatting?
- Registering misspellings of a well-known domain to catch people who mistype it, to show ads, collect credentials or send email that looks like it comes from the real company.
- How do I find typosquatting domains?
- Generate the likely misspellings and look them up in DNS, as this checker does. Domains with MX records are the ones set up for email.
- How do I prevent typosquatting?
- Register the most obvious variants yourself, put DMARC at enforcement on your real domain, monitor lookalikes regularly and report impersonation to the registrar and host.
- Is typosquatting illegal?
- Using a domain in bad faith to profit from someone else's trademark can breach trademark law, and the UDRP lets trademark owners challenge such registrations. Rules vary by country; get legal advice for a specific case.
- What is the difference between typosquatting and cybersquatting?
- Cybersquatting is registering a domain containing someone else's trademark in bad faith. Typosquatting is the form that relies on misspellings of it.
- Does a registered lookalike mean I'm being phished?
- No. Many lookalikes are owned by the brand itself, by domain investors or by unrelated businesses with similar names. Check the owner before acting.
Sources
You audited one domain. Cold outreach means thousands.
This tool checks a domain you type in. It will not tell you which addresses at that domain are real.
- Bulk mailbox verification with real SMTP checks
- The email finder — name plus company to a verified address
- Website enrichment for emails, owner names and socials
One plan, cancel anytime, no contract. Sign in with Google and your first 100 email checks are free, no card. The free tools stay free either way.