Lookalike domain finder
Enter your domain to see which common typo versions of it are already registered, such as a missing or swapped letter, a neighbouring key or a different ending. Registered lookalikes are a common starting point for phishing emails and fake sites that impersonate a brand.
Checks up to 200 common variants using DNS only. We never visit the lookalike sites.
How it works
- We take the main part of your domain and generate common typo variants: a missing letter, two letters swapped, a doubled letter, a neighbouring key on a QWERTY keyboard, a different vowel, characters that look alike (rn for m, 1 for l, 0 for o, vv for w), an added hyphen, a missing dot after www, and the same name on endings such as .co.uk, .net, .shop and .online.
- For each variant we ask public DNS whether the name exists, by looking up its nameserver records, then its mail (MX) and address records. That is all: we never open or load the lookalike websites, because some may be malicious.
- For the first 20 registered matches we ask the registry, through RDAP, when the domain was created. If the registry does not say, the date shows as unknown. We never guess it.
- Up to 200 variants are checked per run, with a time limit, and nothing is stored.
What to do with the results
- Check ownership first: your IT team or registrar account may already hold several of these as defensive registrations.
- Recently registered: a lookalike created in the last 90 days deserves a closer look, because fresh registrations are typical of domains set up for a campaign.
- Can send and receive email: mail records mean the domain could be used to send messages that appear to come from you. Warn finance and customer service teams, and make sure your own SPF, DKIM and DMARC records are in place.
- Take action: report abuse to the registrar and host, keep a dated record of what the domain shows, and consider a UDRP complaint where it infringes a trademark.
Read more about monitoring lookalike domains with SiteGauge, or start free and watch up to 5 pages at no cost.
Frequently asked questions
A lookalike domain is a name registered to resemble yours closely enough that a person skimming a link or an email address will not notice the difference: a missing or swapped letter (examlpe.com), a neighbouring key (exanple.com), characters that look alike (rn for m, 0 for o), an added hyphen, or the same name on another ending such as .net or .shop. They are used for phishing, invoice fraud, fake shops and ad hijacking, and some are simply parked by speculators hoping to sell them.
You enter your own domain and the tool generates up to 200 common typo variants of it. It then asks the public DNS system which of those names exist, by looking up their nameserver, mail (MX) and address records. For the first 20 registered matches it also asks the registry (via RDAP) when the domain was created. It never visits or loads the lookalike websites themselves, because some of them may be malicious.
Not necessarily. Many lookalikes are owned by the brand itself as defensive registrations, especially other endings like .net or .co.uk, and many more are parked by domain resellers. Treat the list as a set of leads to look into. The signals worth prioritising are a recent registration date, which is typical of a domain set up for a campaign, and mail records, which mean the domain can send and receive email in your name.
No. It checks the most common typo patterns for your exact name, which catches a lot, but it does not search every possible variant, combinations with other words (such as yourbrand-login.com), internationalised characters, or newly registered domains as they appear. Dedicated brand protection services cover more ground. This is a fast, free first check.
First check whether your own company registered it. If not, keep a record of what the domain shows and when, then report abuse to the registrar and the hosting provider, and consider a UDRP complaint if it infringes your trademark. In the meantime SiteGauge can watch the lookalike's page and alert you when its content changes, for example when a parked page turns into a copy of your login page, with screenshots of each version.