Check a domain for homograph attacks and typosquatting, with RDAP registration age, DNS, Certificate Transparency and Wayback history in one report.
Enter a suspicious domain and this tool analyses it for the two techniques attackers use to make a fake domain look like a real one: homograph attacks, which substitute visually identical characters from other alphabets, and typosquatting, which exploits predictable mistyping. It scores the result, then enriches it with live data — RDAP registration records, DNS records over DNS-over-HTTPS, Certificate Transparency log entries, and Wayback Machine history — because a domain registered nine days ago with no history is a very different proposition from one registered in 2004.
A second mode works defensively: give it your own domain and it generates the lookalike variants an attacker would plausibly register, so you can check which are already taken and decide which to register or monitor yourself.
Internationalised Domain Names let domains contain non-ASCII characters, encoded in DNS using Punycode — a domain displayed as xn--80ak6aa92e.com in one place may render as something that looks exactly like apple.com in another. The attack works because many characters in different scripts are visually identical or near-identical in common fonts.
The Cyrillic alphabet is the classic source. Cyrillic а (U+0430) and Latin a (U+0061) are different characters with different code points that render identically in most fonts. So do Cyrillic е/e, о/o, р/p, с/c, у/y, and х/x. Greek contributes its own set: α/a, ο/o, ρ/p, τ/t, ν/v. A domain spelled with a single Cyrillic о in place of the Latin o is a completely different domain that is, on screen, indistinguishable.
The detection technique is skeleton comparison: map every confusable character back to its Latin equivalent, then compare the resulting skeleton against the legitimate domain. Two domains with the same skeleton but different code points are a homograph pair, whatever they look like.
Be clear about the scope here: this tool’s confusables map covers Cyrillic and Greek — roughly sixty character mappings, which is where the overwhelming majority of real-world homograph attacks live. It is not the full Unicode confusables table from UTS #39, which runs to thousands of entries across dozens of scripts. A domain using an unusual script outside those two may not be flagged, so treat a clean result as “no Cyrillic or Greek substitution found” rather than “no possible homograph.”
Browsers do provide some protection: most display Punycode rather than the rendered form when a domain mixes scripts in suspicious ways. That defence is real but partial — it does not help in email clients, chat applications, or anywhere else a link is rendered outside the address bar, and single-script attacks (an entire label written in Cyrillic characters that happen to spell a Latin-looking word) have historically slipped past it.
Typosquatting needs no Unicode at all — it just needs a plausible mistake. The tool generates and recognises the standard families:
exmple.com for example.com.exaample.com.exmaple.com.rxample.com.0 for o, 1 for l or i, 5 for s, rn for m. The rn/m substitution is especially effective at small sizes.my-bank.com versus mybank.com..co, .net, .org, or a country-code TLD.paypal.com.security-check.net contains the real brand as a subdomain of an attacker-controlled domain. The registrable domain is security-check.net; everything to the left is decoration. On a phone, where the URL bar truncates, this is very hard to catch.Similarity between two domains is measured with Levenshtein edit distance — the number of single-character insertions, deletions, or substitutions needed to turn one into the other. An edit distance of one or two against a well-known brand is a strong signal.
To be explicit about what this tool does not do: it does not query Google Safe Browsing or any blocklist, and it makes no claim that a domain is or is not known-malicious. It gives you structure, similarity, and provenance — the judgement is yours.
A lookalike domain is usually one artefact of a phishing campaign. Analyse the message itself with the phishing email analyzer and its routing with the email header analyzer. For deeper registration and infrastructure detail see the WHOIS lookup and DNS lookup tools, and for certificate history the Certificate Transparency lookup.
Registering a domain that uses characters from another script which look identical to Latin letters — Cyrillic а for a, Greek ο for o — so the fake domain is visually indistinguishable from the real one while being a completely different address.
Paste it here. The tool maps confusable characters back to Latin and reports which positions are non-Latin. You can also check whether the domain displays as Punycode (xn--) in your browser’s address bar, which is a strong signal.
Cyrillic and Greek — about sixty confusable mappings, covering the substitutions used in nearly all real attacks. It is not the complete Unicode confusables set, so an unusual script may not be flagged.
No. It does not check blocklists or Safe Browsing. It reports structural similarity, character substitution, registration age, DNS configuration, certificate history, and archive presence, and leaves the conclusion to you.
Registration age. A domain closely resembling an established brand and registered within the last few weeks is very rarely legitimate. Combine it with MX records — a new lookalike configured to receive email is being prepared to send or receive it.
Putting a real brand name in the subdomain of a domain you control, as in brand.com.login-verify.net. It is not a typo and contains no unusual characters, so it evades both homograph and typo detection — always read a domain from the right.
Registering the highest-risk handful — the common typos and the obvious TLD swaps — is cheap insurance. Registering every generated variant is not economical. Use the generated set to prioritise, and monitor Certificate Transparency logs for the rest.
The homograph and typosquat analysis runs in your browser. Enrichment necessarily involves network calls — to RDAP, to the DNS-over-HTTPS resolver, to the Wayback Machine, and to a same-origin proxy for Certificate Transparency — so the domain you look up is visible to those services. Lookup history is stored locally in your browser only.
Domain spoofing is a cyberattack technique where an attacker impersonates a legitimate domain to deceive users, bypass email filters, or conduct phishing campaigns. Spoofed domains may use look-alike characters (homograph attacks), typosquatting (common misspellings), or subdomain tricks to create URLs and email addresses that appear to belong to trusted organizations.
Domain spoofing is a primary vector for business email compromise (BEC), which caused over $2.9 billion in reported losses in 2023 according to the FBI's Internet Crime Report. Detecting spoofed domains is essential for email security, brand protection, and anti-phishing operations.
Attackers use several techniques to create convincing fake domains:
| Technique | Example | How It Tricks Users |
|---|---|---|
| Typosquatting | gooogle.com, amazom.com | Common typing errors users might not notice |
| Homograph attack | аpple.com (Cyrillic "а") | Visually identical Unicode characters replace Latin letters |
| Subdomain abuse | login.microsoft.com.attacker.com | Legitimate domain appears in the URL but is actually a subdomain of the attacker |
| TLD swapping | company.co instead of company.com | Different top-level domain looks similar at a glance |
| Combosquatting | microsoft-security.com | Adds plausible words to a legitimate brand name |
| Bitsquatting | Micrksoft.com | Single-bit errors in DNS lookups caused by hardware faults |
Domain spoofing is the practice of creating fake domains that impersonate legitimate ones for phishing, fraud, or brand abuse. Types of domain spoofing: (1) Typosquatting - gooogle.com (extra "o"), amaz0n.com (zero for O), micr0soft.com. (2) Homograph attacks - аpple.com (Cyrillic "а" looks like Latin "a"), раypal.com (Cyrillic letters), using Unicode lookalikes. (3) Combosquatting - apple-security.com, paypal-verify.com, combining legitimate brand + keyword. (4) Level squatting - subdomain tricks like login.apple.com.evil.com, looks like apple.com at quick glance. (5) TLD substitution - example.co instead of example.com, example.net instead of example.com. Dangers: (1) Phishing attacks - steal credentials from users who think they're on legitimate site, 90% of data breaches start with phishing. (2) Brand damage - customers lose trust when attacked via fake domains, reputational harm. (3) Financial loss - direct theft through fake payment pages, wire fraud via spoofed email domains. (4) Malware distribution - lookalike domains serve malware. (5) Business email compromise - domain spoofs used in CEO fraud. Real-world impact: 2017 Ethereum phishing: myetherwallet.com vs myethervvallet.com stole $150K+, Google/Facebook wire fraud: $100M+ lost to lookalike domain invoices, COVID-19: 200,000+ coronavirus-related spoofing domains registered.
Homograph attacks exploit visual similarity between characters from different alphabets: Mechanism: (1) IDN (Internationalized Domain Names) - Allow non-ASCII characters in domains, convert to Punycode for DNS (apple.com → xn--80ak6aa92e.com), browser displays Unicode version. (2) Mixed scripts - Latin: apple.com (legitimate), Cyrillic: аррӏе.com (all Cyrillic, looks identical), Punycode: xn--80ak6aa92e.com. Common character substitutions: Latin "a" ↔ Cyrillic "а" (U+0061 vs U+0430), Latin "e" ↔ Cyrillic "е", Latin "o" ↔ Greek "ο" (omicron), Latin "p" ↔ Cyrillic "р", Latin "c" ↔ Cyrillic "с", Latin "y" ↔ Cyrillic "у", Latin "i" ↔ Cyrillic "і". Attack examples: paypal.com vs pаypal.com (Cyrillic "а"), microsoft.com vs micrοsoft.com (Greek omicron), amazon.com vs аmazon.com (Cyrillic). Browser defenses: (1) Punycode display - Chrome/Firefox show xn-- version for suspicious domains, mixed-script domains shown as Punycode. (2) Script mixing detection - Latin + Cyrillic triggers warning, exception for some language combinations (Latin+Japanese OK). (3) Certificate validation - SSL certs for homograph domains flagged by CAs, Certificate Transparency logs help detect impersonation. How to detect: Check URL encoding (right-click → Inspect element), copy-paste URL to see actual characters, use tools like this domain spoofing detector, verify SSL certificate details. Notable incidents: 2017 Xudong Zheng demo (xn--80ak6aa92e.com), Epic Games phishing via frееfortnite.com (zero-width spaces), cryptocurrency phishing via IDN homographs. Defense: Use bookmarks for sensitive sites, verify Punycode encoding, enable browser warnings, implement DMARC for email protection.
Typosquatting registers domains similar to legitimate ones to capture mistyped traffic: Common typosquatting techniques: (1) Character omission - gogle.com (missing "o"), facebok.com. (2) Character addition - gooogle.com (extra "o"), amazoon.com. (3) Character substitution - amaz0n.com (zero for O), micr0soft.com, g00gle.com. (4) Adjacent key - googke.com (k near l), ywhoo.com (w near a). (5) Character swap - gogle.com → golge.com, payapl.com. (6) Wrong TLD - example.cm instead of .com, example.om. (7) Hyphen insertion - face-book.com, pay-pal.com. Attacker motivations: Generate ad revenue from mistyped traffic (typosquatting parking pages), phishing and credential theft, malware distribution, trademark infringement, brand hijacking/ransoming domains, competitive advantage. Brand protection strategies: (1) Defensive registration - Register common typos of your domain, register all relevant TLDs (.com/.net/.org/.io), register with/without hyphens, consider homograph variants. (2) Monitoring - Use domain monitoring services (DomainTools, MarkMonitor), set up Google Alerts for brand name + common terms, monitor Certificate Transparency logs, check WHOIS for suspicious registrations. (3) Trademark protection - Register trademarks in key jurisdictions, use UDRP (Uniform Domain Dispute Resolution Policy) to reclaim domains, file complaints with registrars, pursue legal action for blatant infringement. (4) Technical controls - Implement DMARC, SPF, DKIM for email, use Certificate Transparency monitoring, deploy browser extensions warning users, educate users to check URLs. Tools for detection: This domain spoofing detector, URLscan.io, PhishTank, WHOIS lookups, VirusTotal domain reports. Cost: Defensive registration: $10-50/domain/year, Monitoring services: $500-$5000/month, UDRP filing: $1,500-$3,000 per case. Major brands like Microsoft, Google, Apple register thousands of defensive domains.
Multiple detection methods and monitoring strategies: Method 1: Certificate Transparency Logs - All SSL certificates publicly logged, monitor for certs containing your brand name, tools: crt.sh, Censys, Facebook CT Monitor, alert on suspicious certificates. Method 2: Passive DNS - Track DNS queries worldwide, identify newly registered lookalike domains, services: Farsight Security, PassiveTotal (RiskIQ), Cisco Umbrella Investigate. Method 3: WHOIS Monitoring - Daily WHOIS database queries for: brand name + common typos, similar domain patterns, registrations in bulk, newly registered domains (NRDs). Method 4: Phishing Reports - Customer reports of suspicious emails/sites, analyze sender domains and linked URLs, report to abuse contacts, takedown requests. Method 5: Search Engine Monitoring - Google search for: "your-brand-name phishing", site:similar-domain.com, your brand name in quotes, common phishing terms + brand. Method 6: Brand Monitoring Services - Commercial: MarkMonitor, BrandShield, DomainTools, Bolster, free: Google Alerts, Twitter searches, PhishTank submissions. Method 7: Email Authentication Monitoring - Check DMARC reports for spoofing attempts, monitor SPF/DKIM failures, look for similar domains sending email, identify unauthorized mail servers. Automated alerting: Set up feeds for: newly registered domains matching patterns, SSL certificates with your brand, phishing submissions to PhishTank/OpenPhish, DMARC aggregate reports. Response workflow: (1) Confirm domain is malicious (not legitimate reseller), (2) Document evidence (screenshots, WHOIS, phishing emails), (3) Report to registrar abuse contact, (4) Report to hosting provider, (5) Submit to Google Safe Browsing / Microsoft SmartScreen, (6) Consider UDRP if trademark infringement, (7) Notify customers via official channels. Typical takedown timeline: 24-72 hours for registrar action, 1-2 weeks for UDRP. For active attacks: Contact registrar by phone, escalate to FBI IC3 (for US companies), notify customers immediately.
Combosquatting combines legitimate brand names with additional keywords to appear legitimate: Combosquatting patterns: (1) Security keywords - apple-security.com, paypal-verify.com, microsoft-login.com, amazon-account-verification.com. (2) Regional keywords - paypal-uk.com, google-canada.com, facebook-europe.com. (3) Product keywords - apple-iphone.com, microsoft-office.com, adobe-pdf.com. (4) Action keywords - paypal-refund.com, netflix-billing.com, amazon-returns.com. (5) Hyphenated versions - pay-pal.com, micro-soft.com, face-book.com. Why combosquatting is effective: (1) Looks more legitimate than typos, appears to be official subdomain or regional site, uses real keywords users might search, harder to defend (infinite combinations), passes casual inspection. Vs Typosquatting: Typosquatting: gooogle.com, amaz0n.com (exploits typing mistakes), combosquatting: amazon-support.com (exploits trust in brand + plausible purpose). Real-world examples: paypal-secure.com → phishing for credentials, apple-icloud.com → credential harvesting, microsoft-support.com → tech support scams, amazon-delivery.com → package scam phishing. Detection challenges: (1) May be legitimate (brand owns some combo domains), resellers/partners use combo domains, harder to trademark protect, more expensive to defensively register all combinations. Defense strategies: (1) Register key combinations (brand-support, brand-security, brand-login), trademark enforcement via UDRP, user education ("we never use brand-keyword domains"), implement DMARC to prevent email spoofing, monitor Certificate Transparency logs. Legal precedent: UDRP decisions generally favor trademark holder if: domain is confusingly similar, registrant has no legitimate interest, domain registered/used in bad faith. Statistics: Combosquatting increased 350% from 2019-2023, 60% of phishing sites use combosquatting, legitimate companies defend against average 50 combosquat domains. This tool helps identify combosquatting patterns in your brand monitoring.
Visual similarity scoring quantifies how closely domains resemble each other: Algorithm types: (1) Edit distance (Levenshtein) - Counts character insertions/deletions/substitutions, example: "apple" → "aple" = 1 deletion, distance of 1, simple but doesn't account for visual similarity. (2) Jaro-Winkler distance - Favors matching prefixes (important for domains), gives higher scores to transpositions, range 0-1 (1 = identical). (3) Homoglyph detection - Maps lookalike characters: {'a': ['а', 'ɑ', 'α'], 'o': ['0', 'ο', 'о']}, checks if characters are visually similar, Unicode confusability mapping (Unicode TR39). (4) OCR-based similarity - Render text as image, use computer vision to measure similarity, captures visual appearance accurately. (5) Phonetic similarity - Soundex, Metaphone algorithms, example: "amazon" vs "amazin" sound similar. Combined scoring: This tool uses weighted combination: Levenshtein distance (40%), homoglyph detection (30%), keyboard proximity (20%), length similarity (10%). Scoring interpretation: 0.9-1.0: Extremely similar (likely spoofing), 0.8-0.9: Very similar (investigate), 0.7-0.8: Similar (possible false positive), <0.7: Low similarity. Factors considered: (1) Character substitution cost (a→e is lower cost than a→z), (2) Position importance (first/last chars weighted higher), (3) Length difference penalty, (4) Visual confusability (Unicode data), (5) Keyboard layout proximity. Example calculations: "paypal.com" vs "paypa1.com": high visual similarity (l→1 homoglyph), Levenshtein distance = 1, homoglyph detected = +0.3 score. "google.com" vs "gooogle.com": medium-high similarity (repeated char), Levenshtein = 1 insertion. "apple.com" vs "аpple.com": extremely high visual similarity (Cyrillic "а"), requires homoglyph detection (not caught by Levenshtein alone). Implementation: Use libraries like python-Levenshtein, jellyfish, Unicode Confusables, or this tool's built-in scoring. Adjust thresholds based on false positive rate in your monitoring.
Multiple legal mechanisms exist to combat domain abuse: 1. UDRP (Uniform Domain Dispute Resolution Policy) - Required by ICANN for all registrars, faster and cheaper than court, typical cost: $1,500-$3,000, timeline: 60-90 days. UDRP requirements: You must prove: (a) domain identical or confusingly similar to your trademark, (b) respondent has no legitimate rights/interest in domain, (c) domain registered and used in bad faith. UDRP outcomes: Transfer domain to complainant, cancel domain registration, respondent retains domain (if they win). 2. Trademark Infringement (Court) - File lawsuit in appropriate jurisdiction, slower and expensive ($50K-$500K), can recover damages + legal fees, may get injunction immediately. 3. ACPA (Anticybersquatting Consumer Protection Act - US) - Specific US law against cybersquatting, statutory damages: $1,000-$100,000 per domain, can also get actual damages, domain transfer. ACPA requirements: Bad faith intent to profit, domain identical/confusingly similar to trademark, trademark was distinctive when domain registered. 4. Registrar Complaints - Report abuse to domain registrar, most registrars have abuse policies, free but slower, takedown in 24-72 hours if clear violation. 5. Takedown Requests - Report to hosting provider (often faster than registrar), report to Google Safe Browsing, report to browser vendors (Firefox, Edge), submit to phishing databases. 6. Criminal Prosecution - FBI, IC3 for US cases, Interpol for international, wire fraud, identity theft charges, rarely pursued unless large-scale operation. Evidence to collect: (1) Screenshots with timestamps, (2) WHOIS records (before registrant hides them), (3) Phishing emails or malware samples, (4) Victim testimonials, (5) Financial records (if damages), (6) Trademark registration certificates. Case timeline: Registrar abuse: 1-7 days, UDRP: 2-3 months, Court litigation: 1-3+ years. Success rates: UDRP: 90%+ for trademark holders (if proper evidence), Registrar complaints: 60-70%, Court cases: varies by jurisdiction. When to use each: Quick takedown: registrar abuse report, clear trademark: UDRP, seeking damages: court litigation, criminal activity: law enforcement. Many brands pursue parallel tracks simultaneously.
Multi-layered user protection strategies: 1. User Education - Train employees to check URLs before clicking, recognize phishing indicators (urgency, spelling errors), use bookmarks for sensitive sites, never click email links to login pages, verify sender before responding to requests, hover over links to see real destination. Regular phishing simulations: Send test phishing emails, measure click rates, provide immediate training for clickers, track improvement over time, services: KnowBe4, Proofpoint, PhishMe. 2. Technical Controls - Email security: DMARC (reject spoofed emails from your domain), SPF records (authorize sending servers), DKIM signatures (cryptographically sign emails), implement "external sender" warnings. Browser protections: Deploy browser extensions (Netcraft, PhishTank), use DNS filtering (Cisco Umbrella, Cloudflare Gateway), enable Google Safe Browsing / Microsoft SmartScreen, whitelist known-good domains. Endpoint protection: EDR tools detect credential theft, browser isolation for risky sites, password managers only autofill on correct domains, multi-factor authentication (even if phished, credentials insufficient). Network security: Web proxy blocks known phishing domains, SSL inspection of encrypted traffic, monitor for DNS queries to lookalike domains, block newly registered domains (NRDs) by default. 3. Brand Protection Measures - Display security indicators on your site (real domain in SSL cert), use EV (Extended Validation) certificates (shows company name), publish official domains on your site, use consistent URL structure, never use shortened URLs in official communications, implement app-based authentication (bypass phishing). 4. Incident Response - Clear reporting mechanism (security@yourcompany.com), rapid investigation process, coordinate takedowns within hours, notify affected users promptly, provide breach notification if needed. 5. Proactive Monitoring - Daily monitoring for: newly registered lookalike domains, phishing reports mentioning your brand, social media impersonation, app store fake apps. Use this domain spoofing detector to find lookalikes before attackers register them. ROI of protection: Average phishing attack cost: $14.8M per company (Ponemon), Training reduces click rate by 60%+, Technical controls block 90%+ of phishing, Combined approach = 95%+ effectiveness. Continuous improvement: Monthly phishing tests, quarterly security awareness training, annual third-party security assessments, track metrics (click rate, report rate, mean time to detect/respond).
Legal options include filing UDRP complaints for trademark infringement, sending cease and desist letters, reporting to domain registrars, and pursuing civil litigation. Document evidence of the spoofed domain and any damages to your brand before taking action.