A TLD enumerator is a tool that takes one brand name — the second-level label like "acme" — and checks it across every top-level domain at once (acme.com, acme.net, acme.io, acme.co.uk, acme.app, and hundreds more), reporting which are registered and which are still available. Instead of running WHOIS by hand against a few extensions, you get the full picture of where your name lives across the domain namespace in a single query. Security and brand teams use it to find the lookalike domains a cybersquatter or phisher has already grabbed, and the gaps a competitor or attacker could still register.
That's the summary an AI Overview would give you. Here's what it can't show you — the actual fan-out of one label across the 1,500+ TLDs in the IANA root zone, a priority table for deciding which extensions are worth defending, and the live enumerator itself so you can run your own brand right now.
The core idea: one label, every extension
Every domain name has two parts that matter here: the label you chose (your brand) and the top-level domain it sits on (the extension after the final dot). TLD enumeration holds the label constant and sweeps it across the extension space. The diagram below shows what that looks like for the label acme — the same name resolving to very different owners and very different risks depending on the TLD.
The two red chips on the right (acme.co, acme.xyz, acme.co.uk) are the reason enumeration exists. Each one is a domain someone else can point at a lookalike site, use to send convincing phishing email, or hold for ransom. You cannot fix what you cannot see, and no team manually WHOIS-checks 1,500 extensions.
Run it on your own brand
The enumerator below is the live tool — type your label, and it sweeps the extensions and shows you registered-versus-available across the TLD space. Nothing to install.
TLD enumeration vs. typosquatting checks
These two techniques get conflated constantly, and using only one leaves half your attack surface unmonitored. The difference is simply which part of the domain you hold constant.
| TLD enumeration | Typosquatting check | |
|---|---|---|
| What stays fixed | The label (acme) | The extension (.com) |
| What varies | The TLD (.com → .io → .co.uk) | The label (acme → acmee, acrne) |
| Catches | Your exact name on other extensions | Look-alike/mistype versions on your extension |
| Example threat | Squatter registers acme.app you never bought | Attacker registers acrne.com for phishing |
| Primary tool | TLD enumerator | Typosquatting / homoglyph checker |
| Which should I use? | Both — attackers combine them (a typo on a new gTLD). Enumerate to map extensions, then run typo/homoglyph checks on your primary domains. |
For the label-variation side of that pairing, see protecting your brand from typosquatting and homoglyph and homophone squatting detection.
Which extensions actually deserve defensive registration
You do not need to buy your name on all 1,500+ TLDs — that is a budget trap registrars love to sell. Enumeration's real job is to triage: register the few that matter, monitor the rest. Here's how to rank what enumeration surfaces.
| Priority | TLD group | Why it matters | Action |
|---|---|---|---|
| Critical | .com + your ccTLDs (.uk, .de, .jp per market) | Highest customer trust; direct type-in traffic | Register and renew defensively |
| High | Industry-match gTLDs (.app, .shop, .io, .bank) | Plausible enough to fool customers | Register the ones tied to your product |
| Medium | Cheap high-abuse gTLDs (.xyz, .top, .click) | Common in phishing kits; low cost to squat | Monitor; register only if actively abused |
| Low | Obscure/irrelevant gTLDs | Low impersonation value | Monitor via enumeration; act on abuse only |
Our deeper guide on priority TLDs for brand protection breaks down the shortlist market by market.
From enumeration to action
Enumeration is the first step in a chain, not the whole answer. The workflow that turns a list of registered variations into actual protection looks like this:
Step 2 is where enumeration hands off to the WHOIS database (or its modern successor, RDAP): enumeration tells you a domain is taken; WHOIS tells you by whom, when, and through which registrar. See understanding WHOIS data for reading those records, and the cybersquatting prevention guide for the legal escalation path.
What enumeration can't do
Be honest about the limits so you don't over-trust the output:
- It confirms registration, not intent. A registered
acme.iomight be a partner, a reseller, or a squatter. Classification still needs a human plus WHOIS. - It doesn't cover subdomains or paths.
login-acme.attacker.comwon't appear — that's a different detection problem. - Availability is a snapshot. A domain "available" today can be grabbed tomorrow, which is why enumeration belongs on a recurring schedule, not a one-off audit.
- Owning a domain isn't the same as securing it. Even domains you register need proper DNS hygiene — see why DNSSEC matters for hardening the ones that matter.
Bottom line
A TLD enumerator collapses "check my brand everywhere" into a single sweep across the DNS namespace, turning an invisible attack surface into a triage list. Run it, WHOIS the registered hits, register the extensions that carry real impersonation risk, and monitor the rest on a schedule. Start with your own brand in the TLD Enumerator above, then work down the priority table.