How to find lookalike domains of your company

What counts as a lookalike

A lookalike domain is any registrable name that a reader could mistake for yours. Four families cover nearly all of them:

• Typosquats: one keystroke away. A letter dropped, doubled, swapped or replaced, such as amazn[.]com or microsott[.]com.
• Homoglyphs: a character that looks the same, such as rn for m, 0 for o, or a Cyrillic letter in place of a Latin one. See homoglyph and punycode domains.
• Combosquats: your name spelled correctly with a word attached, such as yourcompany-login[.]com. See what combosquatting is.
• TLD swaps: your exact name under another ending, yourcompany[.]co instead of .com.

Across the 1,250 public brands Greyphish watches, these are the lookalikes first seen in the 90 days to 1 October 2026 (excluding a wave of unregistered .ph names explained in the CT monitoring guide):

Counts use whole-word brand matches; an earlier version counted brand names inside other words.

The split matters for how you search. Typos and homoglyphs can be generated from your name alone. Combos cannot, because the attacker picks the extra word, so they need a word list or a live feed that matches your name anywhere in a new domain.

Step 1: generate the variants

dnstwist is the standard open-source tool for this, and it is what Greyphish uses to build permutations. Install it with pip or run the Docker image:

pip install "dnstwist[full]"
# or
docker run -it --rm elceef/dnstwist yourcompany.com

With no options it prints every permutation it can generate, registered or not, grouped by the method that produced it: addition, bitsquatting, homoglyph, hyphenation, insertion, omission, repetition, replacement, transposition, vowel-swap and a few more. A ten-letter .com name typically yields a few thousand candidates. That list is the raw material, not the answer.

Two options widen it to the families above:

# combosquats: append and prepend words from a dictionary
dnstwist --dictionary dictionaries/english.dict yourcompany.com

# TLD swaps: try your name under other endings
dnstwist --tld dictionaries/common_tlds.dict yourcompany.com

The dictionaries ship in the dnstwist repository. For combos, a short list of your own beats a long generic one: login, secure, support, account, billing, portal, app, my, plus your product names and the words your customers associate with you. The combosquatting guide lists the words that turn up most often in real registrations.

Step 2: find which ones are registered

Add --registered and dnstwist resolves each candidate and keeps only the ones with DNS records. The other flags worth turning on:

dnstwist --registered --mxcheck --whois --format csv yourcompany.com > lookalikes.csv

• --mxcheck tests whether the lookalike's mail server would accept mail for it, which is the first sign it could be used in an email scam.
• --whois adds the registrar and creation date. It is slow and rate-limited by WHOIS servers, so expect a long run on a big list.
• --format csv gives you a file you can sort and hand to someone else.

For one domain at a time, RDAP is the modern replacement for WHOIS and returns JSON. ICANN's lookup.icann.org does the same in a browser.

curl -s https://rdap.org/domain/example.com | jq '.events[] | {eventAction, eventDate}'

Most registered typos are old

The first scan of a well-known domain usually returns dozens of registered typos, and the instinct is to treat all of them as an attack in progress. The data says otherwise. When Greyphish first sees a lookalike in a certificate log, it compares that date with the domain's WHOIS creation date. For the 9,517 lookalikes where both were known:

Typosquats of big names were mostly registered years ago and are now renewing certificates. Many belong to domain investors, typo-traffic parkers, or the brand itself. Combosquats are the opposite: more than half were under a week old the first time a certificate appeared for them.

The registrar tells you a lot about who owns an old typo. Of the lookalikes with a known registrar, 15.4% were held at brand-protection registrars (Corsearch, CSC, MarkMonitor, SafeNames, Com Laude, Ascio), which almost always means a defensive registration. Before you report anything, check whether your own company, or its agency, registered it.

Step 3: decide which ones matter

A registered lookalike is a fact, not an incident. What raises the risk is what the domain can do. Work through these in order:

1. Does it have MX records? A lookalike that can receive mail can be used to reply inside an existing thread with a supplier or customer. This is the one finance teams lose money to. See lookalike domains with MX records.
2. Does it serve a site? Open it in an isolated browser or use curl -sI. Note whether it is a parking page, a redirect, or a login form with your logo.
3. When was it created, and where? A name created this week at a retail registrar is a different case from one held since 2014 by a brand-protection firm.
4. Does it look like your pages? dnstwist's --lsh option fetches each site and compares it to yours with a fuzzy hash; --phash compares screenshots.

Of the 716 registered lookalikes of public brands Greyphish checked in the same 90 days, 46.6% served a website, 28.2% had mail records, and 19.8% had both. Many of the websites were parking pages. Parked domains are worth keeping an eye on, because a parked name can be pointed at a phishing kit in minutes.

Step 4: keep watching

A scan is a snapshot. The combosquats that matter most are registered and given a certificate within hours of being used, so a monthly rerun of dnstwist sees them after the damage. Ongoing monitoring needs two feeds:

• Certificate Transparency logs, which record every publicly trusted certificate. A new lookalike that wants a padlock shows up here first. The CT monitoring guide covers doing this yourself.
• Zone files from ICANN's Centralized Zone Data Service, which list new registrations in most generic TLDs, including ones that never get a certificate.

This is what Greyphish does. Add your domain and it runs the day-one scan for lookalikes that are already registered, then checks every new certificate and zone-file registration against your permutations, with a daily email digest. Each finding comes with DNS, MX, live-site and registrar evidence so the triage above is already done. One domain is free; Pro covers every domain you own.

What this will not catch

Domain-based monitoring, Greyphish included, has blind spots worth knowing:

• Your name in a subdomain of someone else's domain, such as yourcompany[.]login-secure[.]example. Permutation matching looks at the registrable domain.
• Free hosting subdomains on platforms like pages[.]dev, web[.]app or github[.]io. They share the platform's certificate patterns and are better found through the platform's abuse team.
• Display-name spoofing, where the email says it is from you but the address is a random free mailbox. No domain is involved.
• Combos with words nobody predicted. Live matching on your name anywhere in a new domain catches more of these than a dictionary does.

Questions