Typosquat & Look-alike Domain Scanner

Overview

Somebody registers a domain one keystroke from yours, points it at a copy of your login page, and mails it to your customers or your staff. You find out when someone reports it, which is after the credentials are gone. The registration itself is public the day it happens, and nobody is watching.

This runs the attacker's name generation forward and checks what is already live. You get the variants that resolve, what each is serving, and a phishing-readiness score built from the signals that separate a parked domain from a staged attack: a favicon matching yours, your brand in the page title, a fresh registration, an MX record ready to receive mail. The output is a takedown watchlist, ordered so the top of it is worth acting on today. Names registered against your brand are part of what you expose, so on a schedule this belongs with the rest of your exposure management.

Pipeline

1. Read the brand domain.
2. Four permutation generators run in parallel: character typos, homoglyph substitutions, TLD swaps, and combosquat prefixes and suffixes.
3. The candidate sets merge and deduplicate.
4. httpx probes every candidate across the fleet and records which resolve, what they serve, their title and their TLS detail.
5. Each live candidate is scored for phishing readiness.
6. gowitness screenshots the scored look-alikes as evidence.
7. The scored watchlist is written to a PDF.

Inputs

• Brand domain. The apex you are defending. Every candidate is generated from this one string, so pass the registrable domain rather than a subdomain or a URL, and run each brand you own separately.
• Permutation families. Four generators, on by default: character typos, homoglyph substitutions, TLD swaps, and combosquat prefixes and suffixes. Leaving all four on is the default worth keeping, because an attacker is not restricted to one of them either.
• Probe surface. HTTP and TLS on each candidate, plus a screenshot of the ones that answer. No form is submitted and no credential is sent, so this is safe to point at domains you do not own.

Outputs

• Live candidate list. The permutations that resolved and answered, with status code, page title and TLS detail. Everything dead drops out at the probe, which is what turns thousands of generated names into a readable list.
• Phishing-readiness score. One rank per live candidate, built from a favicon matching yours, your brand in the page title, a recent registration date, and an MX record.
• Screenshots. The real brand rendered next to every live look-alike, so a takedown request carries a picture rather than a URL.
• Ranked watchlist (PDF). The run in score order, which is the document you hand to a registrar, a brand protection contact, or your own abuse queue.

Sample output

From a completed run against trickest.com.

The probe is what makes the list finite. Of 282 generated names, 12 resolved and 11 answered:

Permutation produces the candidate set, bucketed by how each name was derived:

{"brand": "trickest.com", "sld": "trickest", "tld": "com", "candidates": 282, "buckets": {"typo": 121, "homoglyph": 19, "tldswap": 24, "combosquat": 120}}

The score is what to read. The first ranks higher because it was registered 53 days before the run and accepts mail, the signal of a look-alike being stood up; the second has been parked for years and is scored low, a different signal with a different response. Neither matched the brand favicon or title, so nothing on this run scored high, and the run summary says so:

{"brand": "trickest.com", "total_candidates": 282, "candidates_probed": 12, "live_lookalikes": 11, "high_risk": 0, "medium_risk": 1, "baseline_favicon": "1298679005"}

FAQ

Which permutations does it generate?

Four families, each on its own branch. Character typos of the brand name, homoglyph substitutions that swap a character for one that looks the same, TLD swaps that keep the name and change the ending, and combosquats that bolt a word like login or pay onto the brand.

How do you tell a staged phishing site from a parked squatter?

Four signals, and they are what the score is made of: a favicon matching the real brand, your brand name in the page title, a registration only days old, and an MX record able to receive mail. A parked page carries none of them, which usually means resale rather than an incident in progress.

Does the run touch the look-alike domains?

Only as a visitor would. Each candidate gets an HTTP request for its status, title, favicon and TLS detail, and the live ones get a screenshot. Nothing is submitted and no credential is sent.

What is the output actually for?

Takedowns. A registrar or a hosting abuse team wants the evidence, and a row on this watchlist carries the screenshot, the title, the matching favicon and the registration date in one place.

Related workflows

• Check Email Spoofing (DMARC SPF DKIM). Reach for this instead when the attacker does not need a look-alike at all, because weak mail authentication lets them forge mail from your real domain.
• Find Subdomain Takeovers. Reach for this when the impersonation risk is inside your own DNS zone rather than beside it, on a name that already points somewhere you no longer control.
• Website Screenshot & Visual Recon. Reach for this when you want the same visual triage across your own estate rather than across squatted variants of it.