Typosquatting.ai

A typosquatting checker that shows its evidence

Enter a domain and get the registered lookalike names in one to three minutes, no account needed. Every finding carries its registry record, DNS answers and certificate log entries, and the checker never visits a suspect site.

CHECK A DOMAINSEE A SAMPLE REPORT
Reads:
  • Registry RDAP
  • DNS over HTTPS
  • Certificate logs
  • Passive web records
  • Public Suffix List
See the method

Generated across about 180 endings

  • .com
  • .net
  • .org
  • .io
  • .co
  • .app
  • .dev
  • .ai
  • .co.uk
  • .de
  • .shop
  • .online
  • .site
  • .xyz
  • .cloud
  • .info
  • .biz
  • .me
  • .eu
  • .store

See every pattern family

One domain in. A review list out.

The engine builds thousands of candidate names, resolves every one, and reports those that exist with the public records behind them. It never loads a suspect page to read what is on it.

  1. 1. Generate

    About twenty pattern families and 180 endings turn one domain into thousands of candidate names.

  2. 2. Resolve and search

    Every candidate is resolved over DNS and certificate transparency logs are searched for more.

  3. 3. Read the records

    Registered names get their registry record, DNS answers and passive history, then a review priority under a published rule.

Lookalike names below use the reserved .test ending, so no real registration is shown.

example.com report
24 registered of 3,001 checked2 to review
exmaple.testElevated
Transposed characters11 days old
example-login.testElevated
Keyword compoundCertificate issued
exarnple.testReview
Lookalike charactersRegistered, dormant
example.netPossibly yours
Different endingYour nameservers
exampel.testLow signal
Transposed charactersNo DNS answer
Every label links to its ruleMethod
candidate_generation
example.com3,001 candidates
Keyword and endingexample-login.test
663
Keyword compoundlogin-example.test
544
Hosting platformexample.pages.dev
347
Different endingexample.net
196
Keyboard slipezample.test
175
Lookalike charactersexarnple.test
41
registration_record
RDAP via the IANA bootstrap
created11 days ago
registrarDisclosed
registrantRedacted
dns_records
1.1.1.1
A192.0.2.24
MXConfigured
NSNot yours
Mail routing is a deliberate act
review_priority
Elevated

An impersonation keyword on a registration under a year old, or active infrastructure on a recent one.

Priority orders human review. It is not a finding of phishing.

Read a finished reportOPEN THE SAMPLE
TWO WAYS TO USE IT

Check a domain once.
Or watch it every day.

The checkerNO ACCOUNT

Enter a domain. The engine generates thousands of variations, resolves every one, and reports the names that exist with the records behind them.

It never loads a suspect page to read what is on it. A finished report is kept for 24 hours.

CHECK A DOMAINREAD THE METHOD
check example.com
normaliseexample.com
generate3,001 candidates, 20 families
resolve2,970 over DNS
certificatescrt.sh searched
registered24 names
lookupstop 80 ranked rows
❯2 findings to review
one to three minutesno account needed
exmaple.testRegistered 11 days ago
example-login.testCertificate issued
exarnple.testLookalike characters
example.netYour nameservers
exampel.testNo DNS answer
secure-example.testMail records configured
exampl.testRegistered, dormant
The panelPRO

Watch up to 25 domains with daily re-checks, certificate logs searched every 30 minutes, alert rules you set, and a ledger that remembers every decision you make about a finding.

GET /api/v1/check/example.com
Authorization: Bearer $KEY

202 { "job": "/api/v1/jobs/7f3a" }
SEE PRICINGAPI DOCS
example.com
.com.net.co

2 to review

example.net
.net.org

No change

example.org
.org.io

1 certificate

example.co.uk
.co.uk.uk

3 owned

example.io
.io.ai

1 new finding

example.shop
.shop.store

0 to review

EVERY PATTERN, NOT A SAMPLE

The variations somebody would actually register

Twenty pattern families, about 180 endings and roughly forty public hosting platforms. For a single six-letter domain that is 3,001 candidate names, every one of them resolved over DNS before anything reaches your report. Sample names use the reserved .test ending.

SEE ALL TWENTY FAMILIES

WHY THIS CHECKER

A list of names is not the useful part

Any tool can generate variations. What decides whether a finding is worth an hour of somebody's attention is the evidence under it, the rule that ranked it, and whether the decision you made last month is still recorded.

review prioritypublished
active = hasAddress || hasMailRecord

if (active && (ageDays < 90 ||
    (keywordPattern && ageDays < 365)))
  priority = 'Elevated'
else if (active || registryRecord)
  priority = 'Review'
else if (!registryRecord && !dnsAnswer)
  priority = 'Low signal'
else
  priority = 'Unknown'
Four labels. Every rule published.
01

Every rule is published, not scored

The patterns, the sources, the timeouts and the exact rule behind each review priority are on one page. There is no undisclosed score to take on trust.

Every label links to the rule that produced it

No detection-accuracy figures we cannot defend

Corrections are dated on the page they affect

exmaple.testElevated
registrationCreated 11 days ago
dns192.0.2.24
mailConfigured
registry statusUnknown (rate limited)
website evidenceNot observed
02

Findings you can argue with

Each row carries the registration record, the DNS answers and the certificate entries it rests on. Where a source stayed silent, the report says so instead of guessing.

A timeout stays unknown, never becomes a negative

No registry record is not the same as available

Similarity is never reported as intent

request path
Registry RDAP
DNS over HTTPS
Certificate logs
Passive web records
The suspect website
Never read, never submitted for scanning
03

Nothing here reads a suspect page

Evidence comes from registry RDAP, DNS, certificate transparency logs and passive records that somebody else already gathered. The checker never loads a page to read what is on it, and never submits one for scanning.

No request from your browser to the suspect host

Providers see our address, never yours

Hosting-platform names get one request, to confirm they are claimed

findings ledger1 new
example.netOwned
First seen 4 Mar
exmaple.testMalicious
Last seen today
examples.testFalse positive
First seen 11 Jan
04

Decisions that outlive the report

Mark a finding once and the decision sticks to the name, with the dates it was first and last seen. The second review is a short list of differences rather than the whole thing again.

Owned, malicious, false positive or ignored

First and last seen kept per finding

Later runs show only what changed

FOR DEVELOPERS
READ THE API DOCS

A JSON API

Ask for a check with a bearer key and poll the job. A report from the last 24 hours comes back at once, or add fresh=1 to force a new run.

LEARN MORE

Exports that fit your tooling

Every report and every query exports as JSON, JSONL or CSV, with formula characters escaped so a spreadsheet cannot execute a finding.

LEARN MORE

One request, one job

check.http
1GET /api/v1/check/example.com
2Authorization: Bearer $KEY
3
4202 { "job": "/api/v1/jobs/7f3a" }

Turn any saved query into a rule with a severity. Matches are logged, and on Pro emailed and posted to a signed webhook, or to Slack, Microsoft Teams or Discord. A rule never changes a finding's published priority.

LEARN MORE

Nothing undisclosed

Registry RDAPCreation date, registrar, status
DNS over HTTPSA, AAAA, MX and NS answers
Certificate logsNames as certificates are issued
Passive web recordsWhat a scanner saw previously

Registry RDAP through the IANA bootstrap, DNS over HTTPS, certificate transparency logs and passive web records. Each one is listed with what it answers and where it stays silent.

LEARN MORE

DATA AND SECURITY

Built to need as
little as possible

What happens to what you enter

Evidence comes from the registry, DNS, certificate transparency logs and passive records that somebody else already gathered, and no new scan is submitted to any third party. Names on a public hosting platform are the single exception: those platforms answer DNS for every possible subdomain, so each such name receives one request to confirm somebody claimed it. Nothing from the response is read or reported.

Candidate names are resolved and looked up from our servers, so the domain you enter never reaches a provider carrying your address. The domain does appear in the page URL, so it may be in your browser history.

The job record and the finished report are stored for 24 hours so the results page can show them, then deleted by a scheduled sweep. Neither holds an address or an account. Reports you run from a panel account stay until you delete them.

Session tokens, sign-in links and API keys are held as SHA-256 hashes, so a copy of the database contains no usable credential. Sign-in links are single use and expire after 15 minutes.

None of this is a certification. It is a description of how the code runs today, and the trust page lists the processors involved and how to report a vulnerability.

READ THE TRUST PAGE
COMMON QUESTIONS

Before you run a check

The longer list, including what a check costs and how to report a mistake, is on the FAQ page.

A tool that works out which variations of a domain name somebody could register, such as missing and swapped letters, lookalike characters, added words like login or secure and other endings, and then checks which of them exist. This one resolves every candidate over DNS, searches certificate transparency logs, and reads the registry record for the names that matter, so each finding arrives with its evidence rather than a score.

No. Similarity is not proof of intent. A lookalike may be a defensive registration, a parked name, a coincidence or an unrelated business. Review priority orders human attention under rules published on the methodology page, and it is never a finding of phishing.

Never. Evidence comes from registry RDAP, DNS over HTTPS, certificate transparency logs and passive web records that somebody else already gathered. No request goes from your browser or from our servers to the suspect host, and nothing is submitted for a new scan.

One row per registered variation: the pattern that produced it, registration status and age, the registrar where the registry discloses it, the addresses and mail routing that DNS returned, certificate entries, and a review priority with the rule behind it. A public report is kept for 24 hours. Reports run from a panel account stay until you delete them.

A check is a point in time and enrols you in nothing. The panel re-checks a watched domain every day, searches certificate logs every 30 minutes, applies alert rules you set, and keeps a ledger of every decision with the dates a finding was first and last seen, so the next review is a list of what changed.

Not for a check. Enter a domain, wait one to three minutes and read the report. An account is needed only to watch domains, set alerts and use the API.

See what looks like you.

CHECK A DOMAINREAD THE METHOD

No account needed for a check. A report takes one to three minutes and shows the registry, DNS and certificate evidence behind every finding.