Lookalike domain finder
Enter your domain to see which typo and lookalike versions of it are already registered, and which of those have mail servers. Fraudsters use domains like these for phishing and fake invoices. The check runs in your browser, over DNS.
By using these tools you accept the Terms and the Privacy page.
How the lookalike domain finder works
The finder takes your domain, makes a fixed list of typo and lookalike versions of it, and asks public DNS which of them are registered. For each registered one it asks whether it has mail servers and a web address, then lists them riskiest first.
What happens during a check
A pasted URL or email address is reduced to its domain, and subdomains are ignored: mail.example.co.uk is read as example.co.uk. The name is the label before the ending, and a short built-in list of two-label endings such as co.uk, com.au and co.jp keeps those together; any other domain uses its last label as the ending.
Up to 400 variants are made, each kind with an equal share, and a kind that needs fewer leaves its places to the others. Variants are looked up from your browser, 10 at a time, with a progress line. First comes a name server (NS) lookup. Only for a variant that has name servers come the mail server (MX) and address (A) lookups, so a full check sends at most 1,200 lookups (each can be retried once at Google). If the first 24 name server lookups all fail, the check stops and says your browser couldn’t reach the resolvers.
The kinds of variants
- Other domain ending: the same name under 14 common endings (.com, .net, .org, .co, .io, .ai, .app, .biz, .info, .online, .site, .shop, .xyz, .top). A .com name also gets 10 large country endings, and a two-label ending such as
co.ukits bare country code. - Typing slips: a letter left out, a letter doubled, two neighbours swapped, a neighbouring key typed instead or added, a vowel changed, and a hyphen added or removed.
- Look-alike letters:
rnandm,vvandw,clandd,l,1andi,oand0, and a few more, one occurrence at a time. - Foreign look-alike letters: a short table of Cyrillic and Greek letters and of accented and other Latin letters, one position at a time, plus an all-Cyrillic spelling when every letter has a twin. These are looked up as their
xn--form, and both forms are shown. - One bit flipped: a character one bit away in memory, which a faulty device can produce.
- Missing dot and added words: forms such as
wwwexample.comandexample-com.com, and nine words fraudsters like (secure, login, pay, billing, invoice, support, mail, account, verify) before or after the name, with and without a hyphen.
What “registered” means here
A variant counts as registered when it has name servers at its own name. Name servers are asked first because some endings answer every name with a parking or wildcard address, and those names have no name servers of their own. A domain that is registered but has no name servers set, or is on hold, is not found this way. A variant whose lookup fails is “couldn’t check”, never registered or free; a SERVFAIL often means the name is registered but its own DNS servers don’t answer.
Mail servers mean the domain can receive email. A null MX record says it accepts none. A domain with no MX could in principle still receive mail at its address, but rarely does, so only MX records count.
Limits
This is a fixed set of likely variants, not every possible lookalike. Names longer than 40 characters skip added keys, foreign letters and flipped bits, and an xn-- name gets other endings only. Many registries refuse a name that mixes scripts, so many foreign-letter variants can’t be registered at all. A registered lookalike isn’t proof of fraud, and DNS can’t show who owns it or when it was registered: use the WHOIS lookup for that.
Updated · Maintained by Hertza L.L.C.
Questions
What is a lookalike domain?
A domain that is easy to mistake for yours. Typosquatting domains are one keystroke away, such as a letter left out, doubled or swapped. Homoglyph domains swap a letter for one that looks the same, such as rn for m, the digit 1 for l, or a Cyrillic а for a Latin a (an internationalised domain, stored as an xn-- name). Others keep your name under a different ending, or add a word such as secure or invoice.
How do fraudsters use lookalike domains?
Mostly in two ways. In invoice fraud (business email compromise), mail from a lookalike of a supplier’s domain asks a customer to pay into a new bank account, often as a reply inside a real conversation. In credential phishing, a lookalike hosts a copy of a sign-in page and collects the passwords people type into it.
What does it mean when a lookalike has mail servers?
It has MX records, so whoever controls it can receive email there, including replies. Any registered domain can send email, with or without MX records. Mail servers are the signal that matters most for reply fraud. A null MX (a single MX record pointing to “.”) says the domain accepts no mail, and is shown as no mail servers.
What should I do about a registered lookalike?
Open its WHOIS record (linked on each row) to see the registrar and the domain’s age. If it is used for phishing or fraud, report it to the registrar’s abuse contact and to your bank or customers as needed. Register the lookalikes that matter most yourself before someone else does. Once your DMARC reports show your own mail passes, set your DMARC policy to reject, so mail that spoofs your exact domain fails; a lookalike has its own DNS, so tell staff and customers to check sender domains and to confirm changes of bank details by phone.
Does it find every lookalike of my domain?
No. It checks a fixed set of likely variants, at most 400, built from the kinds listed below. There are far more possible lookalikes, especially with foreign letters and added words, and new ones can be registered at any time. A clean result means none of the checked variants has name servers, nothing more. A domain that is registered but has none set, or is on hold, isn’t found.
Is a registered lookalike proof of fraud?
No. Many belong to unrelated businesses with a similar name, are parked by domain investors, or were registered defensively by the brand itself. DNS can’t show who owns a domain or why. Treat the list as a set of names to look at, starting with the ones that can receive email.
What is sent, and where?
The check runs in your browser. Each variant name is sent from your browser to Cloudflare’s public DNS-over-HTTPS resolver, or to Google’s when Cloudflare’s doesn’t answer, as a name server, mail server or address lookup. The check itself uploads nothing to zerobounce.ai’s servers. The domain is kept in the page address, so a reload or a shared link sends it to us like any page request. Recent domains you checked are kept in your browser only.