TLD Enumerator

TLD Enumerator: Check Your Brand Across 150+ Domain Extensions

Enter a domain and this tool generates the same name across more than 150 top-level domains, then checks which of those are already registered. You get a grouped list — legacy generic TLDs, country codes, new gTLDs, and sponsored TLDs — with registration status, registrar, creation date, and expiry date for each one you check. Copy the list, or export it as TXT, CSV, or JSON for a brand-protection register.

This is a defensive exercise. If your company owns example.com and someone else has quietly registered example.net, example.co, and example.support, you want to know that before a customer receives an invoice from one of them. Enumerating the extensions is how you find out what exists, who registered it, and when.

What the Tool Does

• Extracts the base label from whatever you paste — protocol, path, port, and the existing extension are stripped, so https://www.example.com/pricing becomes example.
• Generates one variation per TLD across a database of 151 extensions: 7 legacy generic, 62 country-code, 74 new gTLDs, and 8 sponsored, each with a description and the year it was introduced.
• Groups results by TLD type so you can work through the categories that matter to you rather than a flat alphabetical wall.
• Filters by TLD type and by a free-text search that matches both the extension and its description — typing “bank” finds .bank, typing “Germany” finds .de.
• Checks registration for a single domain or for the whole visible list, returning registered or available, the registrar, the creation date, the expiry date, and how many days remain until expiry. Recently checked domains are served from cache and marked as such.
• Flags near-expiry domains so an entry with under 30 days left stands out — useful both for your own renewals and for spotting an abandoned lookalike about to drop.
• Exports the full list as TXT, CSV, or JSON, and copies individual domains or the entire set to the clipboard.

One thing it deliberately does not do: it does not mutate the name itself. It varies the extension only, so example.com produces example.net and example.io, not exarnple.com or exampel.com. Character-level typosquat generation is a separate exercise — see the note below on covering both.

How to Use It for Brand Protection

1. Enter your primary domain. Any format works; the base label is extracted automatically.
2. Narrow to what is relevant. Filter to the TLD types you care about — most organisations start with legacy generics and the country codes for markets they operate in, rather than all 151.
3. Run Check All Registration on the filtered set. This is the step that turns a list of hypotheticals into evidence.
4. Triage the registered ones. Some will be yours. Some will be legitimate unrelated businesses with a similar name — a common and entirely lawful situation. A small number will be neither, and those are the ones to investigate.
5. Look at the dates. A lookalike registered last week is a different problem from one registered in 2011. Registration immediately before a phishing wave, or immediately after a funding announcement, is a meaningful signal.
6. Export and keep the baseline. Re-run quarterly and diff against the previous CSV. New registrations of your brand name are the thing worth alerting on, and you can only see them if you have last quarter’s list.

Understanding the TLD Categories

The categories matter because they carry different levels of risk. Sponsored TLDs are the safest: nobody is registering yourbrand.bank to defraud your customers unless they can satisfy a financial-institution verification process. Restricted extensions are flagged in the database so you can see which ones are gated.

Country codes are the subtlest trap. Several are repurposed as generic-looking extensions — .co (Colombia) reads as an abbreviation of “company” and is one character from .com, .io (British Indian Ocean Territory) became a technology convention, .ai (Anguilla) followed the same path. Those blend in well enough that a customer glancing at a sender address rarely notices. Meanwhile registering in a ccTLD you do not operate in may be governed by local presence rules, which cuts both ways: it constrains you, and it constrains an impersonator.

New gTLDs are where volume lives. There are well over a thousand of them, several priced low enough to be disposable, and they supply the semantic half of a convincing lure — yourbrand.support, yourbrand.security, yourbrand.billing. Those read as plausible corporate subdomains to someone who is not looking closely, which is precisely the point of them.

What to Do With a Suspicious Registration

Finding a registered lookalike is not by itself evidence of wrongdoing. Before escalating, gather:

• The registration timeline from the creation date — is it contemporaneous with something of yours?
• Whether it resolves and whether it serves content. A parked page bought by a domain investor is a commercial nuisance; a pixel-perfect copy of your login page is an incident.
• Whether it has mail records. A lookalike domain with MX records configured is set up to send or receive mail, which is the strongest single indicator that it exists for phishing rather than for resale.
• Whether certificates have been issued for it, which shows up in certificate transparency logs and reveals subdomains you would otherwise never see.

Where the evidence supports it, the remedies are the registrar abuse process, a UDRP or URS complaint through ICANN’s dispute procedures, and takedown requests to the hosting provider. Where it does not, the sensible response is usually to register the handful of extensions that would be most convincing in an attack and move on — defensive registration of every plausible extension is neither affordable nor necessary for most organisations.

A workable budget rule: buy the legacy generics, the ccTLDs for countries where you actually trade, and any new gTLD that matches a function your customers would believe (.support, .shop, .app if you ship one). Monitor the rest rather than owning it. Monitoring is what the quarterly export and diff is for.

Remember also that extension-swapping is only one class of lookalike. The others are character substitution (rn for m, 1 for l), homograph attacks using visually identical Unicode characters from other scripts, hyphenation (your-brand.com), and combosquatting (yourbrand-login.com). A complete programme covers all of them; this tool covers the extension axis thoroughly and should be paired with tooling for the others.

Related Tools

Look up full registration records for a specific domain with the WHOIS lookup, check for character-level lookalikes and mail-authentication weaknesses with the domain spoofing detector, find issued certificates and hidden subdomains through the certificate transparency lookup, and inspect the DNS records of anything suspicious with the DNS lookup tool.

Frequently Asked Questions

Does this generate typo variations of my domain name?

No. It varies the extension while keeping the name intact — example.net, example.io, example.shop. Character-level typosquats such as exampel.com are a different technique; use the domain spoofing detector alongside this for that axis.

How many extensions does it cover?

151 in the built-in database: 7 legacy generic, 62 country-code, 74 new gTLDs, and 8 sponsored. That is a curated set of the extensions that matter most for brand protection, not the full list of over a thousand delegated TLDs.

How accurate is the registration check?

It queries registration data for each domain and reports registered or available with the registrar and dates where they are published. Results may be served from a short-lived cache, which is indicated on the result. Some registries publish limited data, and privacy services mask registrant details, so treat “registered” as reliable and the accompanying detail as best-effort.

Should I register my brand in every extension?

Almost certainly not — the cost scales badly and the coverage is never complete. Register the legacy generics, the country codes for markets you trade in, and the few new gTLDs that would be genuinely convincing in an attack against your customers. Monitor the remainder.

Is enumerating domains like this legal?

Yes. Generating name variations is arithmetic, and registration data is published by design so that domain ownership is accountable. This is the same information a trademark attorney or a brand-protection service would gather, and the intended use here is defensive.

Someone has registered my brand on another extension. What can I do?

Gather evidence first: creation date, whether it resolves, whether it serves imitative content, and whether it has mail records. Then use the registrar’s abuse process, a UDRP or URS complaint if you hold trademark rights, or a hosting takedown request. A registration alone, with no infringing use, is a weaker case than one backed by a copied login page.

Why do some country-code domains look like generic ones?

Because several registries market them that way. .co is Colombia, .io is the British Indian Ocean Territory, .ai is Anguilla, .tv is Tuvalu. Their generic appearance is exactly what makes them effective for impersonation, so they deserve attention even if you have no presence in those territories.

What does the expiry warning mean?

Domains with fewer than 30 days remaining are highlighted. For your own domains that is a renewal reminder. For a lookalike it may signal an abandoned registration that is about to drop — which is either an opportunity to acquire it or a warning that someone else will.

Can I export the results?

Yes — TXT, CSV, or JSON, plus clipboard copy for individual domains or the whole list. CSV is the practical choice for keeping a quarterly baseline you can diff.

How often should I re-run this?

Quarterly is a reasonable cadence for most organisations, and immediately after any event that raises your profile: a funding round, a product launch, an acquisition, or a breach disclosure. Those are the moments when opportunistic registration of your name spikes.