---
title: "Typosquat & Look-alike Domain Scanner"
canonical: https://trickest.com/library/typosquat-and-look-alike-domain-scanner
description: "Generate typo, homoglyph, TLD-swap and combosquat variants of a brand domain, probe every candidate, and score the live ones for phishing readiness."
---

# Typosquat & Look-alike Domain Scanner

## Overview

Somebody registers a domain one keystroke from yours, points it at a copy of your
login page, and mails it to your customers or your staff. You find out when
someone reports it, which is after the credentials are gone. The registration
itself is public the day it happens, and nobody is watching.

This runs the attacker's name generation forward and checks what is already live.
You get the variants that resolve, what each is serving, and a phishing-readiness
score built from the signals that separate a parked domain from a staged attack:
a favicon matching yours, your brand in the page title, a fresh registration, an
MX record ready to receive mail. The output is a takedown watchlist, ordered so
the top of it is worth acting on today. Names registered against your brand are
part of what you expose, so on a schedule this belongs with the rest of your
[exposure management](/use-cases/exposure-management).

## Pipeline

1. Read the brand domain.
2. Four permutation generators run in parallel: character typos, homoglyph
   substitutions, TLD swaps, and combosquat prefixes and suffixes.
3. The candidate sets merge and deduplicate.
4. [httpx](/tools/httpx) probes every candidate across the fleet and records
   which resolve, what they serve, their title and their TLS detail.
5. Each live candidate is scored for phishing readiness.
6. [gowitness](/tools/gowitness) screenshots the scored look-alikes as evidence.
7. The scored watchlist is written to a PDF.

## Inputs

- **Brand domain.** The apex you are defending. Every candidate is generated from
  this one string, so pass the registrable domain rather than a subdomain or a
  URL, and run each brand you own separately.
- **Permutation families.** Four generators, on by default: character typos,
  homoglyph substitutions, TLD swaps, and combosquat prefixes and suffixes.
  Leaving all four on is the default worth keeping, because an attacker is not
  restricted to one of them either.
- **Probe surface.** HTTP and TLS on each candidate, plus a screenshot of the
  ones that answer. No form is submitted and no credential is sent, so this is
  safe to point at domains you do not own.

## Outputs

- **Live candidate list.** The permutations that resolved and answered, with
  status code, page title and TLS detail. Everything dead drops out at the probe,
  which is what turns thousands of generated names into a readable list.
- **Phishing-readiness score.** One rank per live candidate, built from a favicon
  matching yours, your brand in the page title, a recent registration date, and
  an MX record.
- **Screenshots.** The real brand rendered next to every live look-alike, so a
  takedown request carries a picture rather than a URL.
- **Ranked watchlist (PDF).** The run in score order, which is the document you
  hand to a registrar, a brand protection contact, or your own abuse queue.

## Sample output

From a completed run against `trickest.com`.

The probe is what makes the list finite. Of 282 generated names, 12 resolved and
11 answered:

```jsonl
{"domain": "trickest-login.com", "url": "https://trickest-login.com", "status_code": 200, "score": 55, "verdict": "medium", "favicon_match": false, "title_match": true, "registered_days_ago": 53, "fresh": true, "has_mx": true}
{"domain": "trickest.co", "url": "http://trickest.co", "status_code": 200, "title": "Coming Soon", "score": 20, "verdict": "low", "favicon_match": false, "registered_days_ago": 2812, "fresh": false, "has_mx": true}
{"domain": "trickesst.com", "url": "https://trickesst.com", "status_code": 200, "score": 35, "verdict": "medium", "favicon_match": false, "title_match": false, "registered_days_ago": 120, "fresh": false, "has_mx": false}
{"domain": "triickest.com", "url": "https://triickest.com", "status_code": 403, "score": 15, "verdict": "low", "favicon_match": false, "title_match": false, "registered_days_ago": 890, "fresh": false, "has_mx": false}
{"domain": "trickest-pay.com", "url": "https://trickest-pay.com", "status_code": 200, "score": 45, "verdict": "medium", "favicon_match": false, "title_match": false, "registered_days_ago": 14, "fresh": true, "has_mx": true}
{"domain": "trickest.io", "url": "https://trickest.io", "status_code": 200, "score": 25, "verdict": "low", "favicon_match": false, "title_match": false, "registered_days_ago": 410, "fresh": false, "has_mx": true}
```

Permutation produces the candidate set, bucketed by how each name was derived:

```json
{"brand": "trickest.com", "sld": "trickest", "tld": "com", "candidates": 282, "buckets": {"typo": 121, "homoglyph": 19, "tldswap": 24, "combosquat": 120}}
```

The score is what to read. The first ranks higher because it was registered 53
days before the run and accepts mail, the signal of a look-alike being stood up;
the second has been parked for years and is scored low, a different signal with a
different response. Neither matched the brand favicon or title, so nothing on
this run scored high, and the run summary says so:

```json
{"brand": "trickest.com", "total_candidates": 282, "candidates_probed": 12, "live_lookalikes": 11, "high_risk": 0, "medium_risk": 1, "baseline_favicon": "1298679005"}
```

## FAQ

### Which permutations does it generate?

Four families, each on its own branch. Character typos of the brand name,
homoglyph substitutions that swap a character for one that looks the same,
TLD swaps that keep the name and change the ending, and combosquats that bolt a
word like login or pay onto the brand.

### How do you tell a staged phishing site from a parked squatter?

Four signals, and they are what the score is made of: a favicon matching the real
brand, your brand name in the page title, a registration only days old, and an MX
record able to receive mail. A parked page carries none of them, which usually
means resale rather than an incident in progress.

### Does the run touch the look-alike domains?

Only as a visitor would. Each candidate gets an HTTP request for its status,
title, favicon and TLS detail, and the live ones get a screenshot. Nothing is
submitted and no credential is sent.

### What is the output actually for?

Takedowns. A registrar or a hosting abuse team wants the evidence, and a row on
this watchlist carries the screenshot, the title, the matching favicon and the
registration date in one place.

## Related workflows

- [Check Email Spoofing (DMARC SPF DKIM)](/library/email-spoofing-scanner-dmarc-spf-dkim).
  Reach for this instead when the attacker does not need a look-alike at all,
  because weak mail authentication lets them forge mail from your real domain.
- [Find Subdomain Takeovers](/library/subdomain-takeover-scanner). Reach for
  this when the impersonation risk is inside your own DNS zone rather than beside
  it, on a name that already points somewhere you no longer control.
- [Website Screenshot & Visual Recon](/library/website-screenshot-and-visual-recon).
  Reach for this when you want the same visual triage across your own estate
  rather than across squatted variants of it.

---
_Markdown source of https://trickest.com/library/typosquat-and-look-alike-domain-scanner._