Lookalike Domain Checker
Homoglyph and typosquatting domain checker — Unicode lookalike variants that can impersonate your brand in links and email.
About this tool
Attackers register domains that look identical to a trusted brand on screen but swap confusable Unicode letters — Cyrillic а for Latin a, Greek ο for o, and similar tricks. Browsers may render them the same; DNS stores punycode (xn--…). Generate plausible variants from your domain to build a monitoring or blocking checklist.
What you get
- Lookalike hostnames derived from the domain you enter
- Which character was substituted and at which position
- Punycode form when the variant contains non-ASCII letters
- Copyable list of all variants (one hostname per line)
Often yes, in principle — domains with non-Latin letters are called IDN (Internationalized Domain Names) and are stored in DNS as punycode (xn--…). That is how a hostname can look like a familiar brand on screen while resolving differently behind the scenes.
- Mixed-script blocking — inserting one Cyrillic or Greek letter into an otherwise Latin name is often rejected (e.g. Latin paypal + Cyrillic а)
- Confusable bundling — if you own example.com, visually similar IDN variants may be reserved for you or blocked for others
- TLD differences — some zones allow broad IDN, others ASCII-only; rules vary between .com, .ru, country codes, and new gTLDs
So the list here is a theoretical threat model, not a shopping list of domains you can buy today. Variants may still matter for brand monitoring, security awareness training, and spotting tricks in links, email, or subdomains — even when direct registration is blocked.
- Does not check WHOIS or whether a variant is already registered
- Does not catch typosquatting (paypa1.com) — only Unicode homoglyphs
- Does not generate every theoretical combination — focused on single- and double-character swaps
How to use
Enter the brand domain you want to protect (e.g. example.com). Review variants and copy the list for security monitoring, registrar alerts, or user awareness training.
Step-by-step playbook
When users report a phishing link, compare the suspect name to your brand and legitimate domains.
- Generate homograph and typo variants Catch swapped letters, punycode, and TLD swaps.
- Check which variants are registered Look up live registration for suspicious hits.
- Inspect DNS and TLS on active clones See where impostor sites point and whether certs look legitimate.
- Validate the real site certificate Confirm your official hostname and issuer for user education.
Glossary
- Typosquatting
- Registering domains that differ by one character from a well-known brand.
- Homograph attack
- Using visually similar Unicode characters (e.g. Cyrillic а vs Latin a).
- Punycode
- ASCII encoding (xn--…) for internationalized domain labels.
FAQ
How to find typosquatting domains for my brand?
Enter your brand domain to generate common typo and TLD variants, then see which names resolve in DNS today.
What are homograph or lookalike domain attacks?
Attackers register domains visually similar to yours—typos, homoglyphs, or swapped TLDs—to phish users or intercept mistyped traffic.
How to detect Cyrillic or Unicode homograph domains?
Unicode confusables that look like Latin letters are included in variant generation; punycode output shows the ASCII form registrars use.
Why monitor domains similar to my brand?
Early detection lets security, legal, and marketing teams act before fake sites damage customers, credentials, or SEO.
Does the tool check if lookalike domains are registered?
Variants are checked against live DNS—names that resolve today are highlighted so you can prioritize takedowns or acquisitions.
How to protect users from typo domain phishing?
Monitor lookalike registrations, enforce SPF/DMARC on your real domain, and warn staff when new resolving typos appear in this report.
By using this tool you agree to our Terms of Use and Privacy Policy. Results are provided as-is without warranty.