Builds typo, look-alike, TLD-swap, and extra-word variants, then checks which ones are live and scores them for phishing.
A high score means the site looks like yours.
Target
The brand domain to protect. Default example.com.
Results
A ranked watchlist PDF with screenshots.
Also writes report.json.
Overview
Somebody registers a domain one keystroke from yours, points it at a copy of your
login page, and mails it to your customers or your staff. You find out when
someone reports it, which is after the credentials are gone. The registration
itself is public the day it happens, and nobody is watching.
This runs the attacker's name generation forward and checks what is already live.
You get the variants that resolve, what each is serving, and a phishing-readiness
score built from the signals that separate a parked domain from a staged attack:
a favicon matching yours, your brand in the page title, a fresh registration, an
MX record ready to receive mail. The output is a takedown watchlist, ordered so
the top of it is worth acting on today. Names registered against your brand are
part of what you expose, so on a schedule this belongs with the rest of your
exposure management.
Pipeline
Read the brand domain.
Four permutation generators run in parallel: character typos, homoglyph
substitutions, TLD swaps, and combosquat prefixes and suffixes.
The candidate sets merge and deduplicate.
httpx probes every candidate across the fleet and records
which resolve, what they serve, their title and their TLS detail.
Each live candidate is scored for phishing readiness.
gowitness screenshots the scored look-alikes as evidence.
The scored watchlist is written to a PDF.
Inputs
Brand domain. The apex you are defending. Every candidate is generated from
this one string, so pass the registrable domain rather than a subdomain or a
URL, and run each brand you own separately.
Permutation families. Four generators, on by default: character typos,
homoglyph substitutions, TLD swaps, and combosquat prefixes and suffixes.
Leaving all four on is the default worth keeping, because an attacker is not
restricted to one of them either.
Probe surface. HTTP and TLS on each candidate, plus a screenshot of the
ones that answer. No form is submitted and no credential is sent, so this is
safe to point at domains you do not own.
Outputs
Live candidate list. The permutations that resolved and answered, with
status code, page title and TLS detail. Everything dead drops out at the probe,
which is what turns thousands of generated names into a readable list.
Phishing-readiness score. One rank per live candidate, built from a favicon
matching yours, your brand in the page title, a recent registration date, and
an MX record.
Screenshots. The real brand rendered next to every live look-alike, so a
takedown request carries a picture rather than a URL.
Ranked watchlist (PDF). The run in score order, which is the document you
hand to a registrar, a brand protection contact, or your own abuse queue.
Sample output
From a completed run against trickest.com.
The probe is what makes the list finite. Of 282 generated names, 12 resolved and
11 answered:
domain
url
status_code
score
verdict
favicon_match
title_match
registered_days_ago
fresh
has_mx
title
trickest-login.com
https://trickest-login.com
200
55
medium
false
true
53
true
true
null
trickest.co
http://trickest.co
200
20
low
false
null
2812
false
true
Coming Soon
trickesst.com
https://trickesst.com
200
35
medium
false
false
120
false
false
null
triickest.com
https://triickest.com
403
15
low
false
false
890
false
false
null
trickest-pay.com
https://trickest-pay.com
200
45
medium
false
false
14
true
true
null
trickest.io
https://trickest.io
200
25
low
false
false
410
false
true
null
Permutation produces the candidate set, bucketed by how each name was derived:
The score is what to read. The first ranks higher because it was registered 53
days before the run and accepts mail, the signal of a look-alike being stood up;
the second has been parked for years and is scored low, a different signal with a
different response. Neither matched the brand favicon or title, so nothing on
this run scored high, and the run summary says so:
Four families, each on its own branch. Character typos of the brand name,
homoglyph substitutions that swap a character for one that looks the same,
TLD swaps that keep the name and change the ending, and combosquats that bolt a
word like login or pay onto the brand.
How do you tell a staged phishing site from a parked squatter?
Four signals, and they are what the score is made of: a favicon matching the real
brand, your brand name in the page title, a registration only days old, and an MX
record able to receive mail. A parked page carries none of them, which usually
means resale rather than an incident in progress.
Does the run touch the look-alike domains?
Only as a visitor would. Each candidate gets an HTTP request for its status,
title, favicon and TLS detail, and the live ones get a screenshot. Nothing is
submitted and no credential is sent.
What is the output actually for?
Takedowns. A registrar or a hosting abuse team wants the evidence, and a row on
this watchlist carries the screenshot, the title, the matching favicon and the
registration date in one place.
Related workflows
Check Email Spoofing (DMARC SPF DKIM).
Reach for this instead when the attacker does not need a look-alike at all,
because weak mail authentication lets them forge mail from your real domain.
Find Subdomain Takeovers. Reach for
this when the impersonation risk is inside your own DNS zone rather than beside
it, on a name that already points somewhere you no longer control.
Website Screenshot & Visual Recon.
Reach for this when you want the same visual triage across your own estate
rather than across squatted variants of it.