// tool reference · Incident & Response
Typosquat Domain Finder Free
Discover look-alike domains that could impersonate yours.
Open Typosquat Domain Finder → Engine: /security-tools/typosquat_finder
What it does
Generates the permutations of your domain an attacker would register — character swaps, omissions, homoglyphs, TLD swaps — and reports which already exist.
When to use it
- Brand protection; pre-empting a phishing campaign against your users.
Inputs
Field names are the actual form parameters, verified against source.
| Field | Type | Required | Notes |
|---|---|---|---|
| domain | text | required | Your domain, e.g. example.com. |
What you get back
Permutations with registration status and risk.
Worked example
Input
example.com
Output (abridged)
12 permutations checked -- 3 REGISTERED
REGISTERED exarnple.com rn->m homoglyph <- highest risk
Registered 6 days ago. A fresh registration against an
existing brand is the classic pre-phishing signature.
REGISTERED example.co TLD truncation
REGISTERED exampIe.com capital I for lowercase l
available exmaple.com transposition
-> Check MX on exarnple.com. Mail records mean phishing, not squatting.
-> Warn users BEFORE the campaign, not after.
How it works
Deterministic permutation generation plus resolution checks.
Limits
Read live from the platform configuration.
| Rate limit | 30 requests / 60s (platform default) |
Limitations — what it does not do
It generates plausible permutations -- not every possible one -- and cannot see a lookalike built from a different string (e.g. 'example-support.com'). Registration is a signal, not proof of intent.
Privacy
The queried domain is not associated with your account.
Standards
MITRE ATT&CK (T1583.001)