Lookalike and typosquatting domains, explained
A lookalike domain is one registered to be mistaken for yours. The categories are well worn, which is what makes them predictable enough to search for.
Typos
The oldest form. Someone registers what your customers type when their
fingers slip: a doubled letter, a missing letter, two letters transposed, or
a neighbouring key hit instead of the right one. gogole.com and
amazn.com are the shape. Mistyped traffic is small but constant,
and it arrives already trusting the destination.
Homoglyphs
Characters chosen because they look like other characters. The classic is a
digit 1 standing in for a lowercase l, as in
paypa1.com. A zero replaces an o. The pair
rn reads convincingly as an m at normal text size,
which is how rnicrosoft.com works.
These are harder to spot than typos because nothing looks wrong. A reader scanning an address bar is pattern-matching a shape, not reading letters.
Different endings
Your exact name, registered under another ending. This needs no cleverness at all, which is why it is the most common category by volume. Cheap, lightly vetted endings attract the most abuse, but any ending your brand does not own is available to someone else.
Added words
The vocabulary of credential phishing, bolted onto a real brand name:
login, secure, verify,
account, support, billing. A domain
like yourbrand-login.com is not trying to catch a typo. It is
built to look like the legitimate address of a sign-in page, usually reached
through a link in an email rather than by typing.
What rules cannot predict
Every category above can be generated from a brand name. That is both the strength and the limit of permutation scanning: it finds anything inside its rule space, including domains registered but not yet used, and it misses everything outside it.
The gap is filled by Certificate Transparency. Every publicly trusted TLS certificate is written to public, append-only logs. Since a phishing page needs HTTPS to look legitimate, issuing that certificate announces the hostname. Searching those logs is observational rather than predictive: it returns names that really exist, in any shape at all.
That catches two things rules never will. Novel word combinations nobody
would think to generate. And hosting-platform subdomains: phishing
kits deployed to free app-hosting services, where a host like
yourbrand-login.pages.dev has no domain registration of its own
to find and no registrar to complain to.
Read a certificate for what it is. It records that a certificate was issued for a hostname at a point in time. It does not mean the name resolves in DNS today, that anything is served on it now, or that whatever is served is hostile. Certificates are routinely issued for names that never go live, and a name can go dark long before its certificate expires. That is why this tool probes a host separately and reports liveness as its own column rather than inferring it. The coverage has limits in the other direction too: logs only contain certificates from participating publicly trusted authorities, so a site using a private or untrusted certificate, or no HTTPS at all, leaves no entry to find.
Neither source replaces the other. Rules find registered-but-dormant names before they are used; the logs surface certificate observations for names no rule would generate. Neither tells you what is reachable at this moment, which is what the separate liveness check is for.
You cannot register your way out
A short brand name generates hundreds of plausible typos before you multiply by every available ending. Defensive registration of everything is not affordable for anyone. Monitoring is: know which variants someone has actually taken, which of those are serving pages, and which are naming your brand on those pages. That list is short enough to act on.
Questions
What is typosquatting?
Registering a domain that is a likely typo of a real one, such as a doubled letter, a dropped letter or two letters swapped, so that mistyped traffic lands on the attacker's site.
What is a homoglyph domain?
A domain using characters that look like others: a digit one in place of a lowercase L, a zero for an O, or the pair r-n which reads as an m at small sizes.
How many lookalike domains can exist for one brand?
Thousands are possible. A short brand name generates hundreds of plausible typos alone, before multiplying by every domain ending it could be registered under.
Scan for lookalikes →Enter a brand and find the variants someone has already registered. Free, no account.