Typosquatting checker
Find the lookalike domains someone could use to impersonate yours, and see which of them are already registered.
Related tools: WHOIS lookup · All free tools
The domains one typo away from yours
Typosquatting is registering a domain that differs from a real one by a mistake a person makes or misses: a missing letter, a key next to the right one, an rn that reads as m, an accented é, the same name under .co instead of .com. Those names catch mistyped visits and mistyped email, and they are what phishing links are built on. This tool generates the lookalikes for your domain across twelve kinds of variation, asks Cloudflare's 1.1.1.1 resolver whether each one is delegated, and for every registered one checks whether it serves a website, receives email, or is parked.
The lookalike that does the most damage is your own domain, registered by someone else the week after it lapses. Upcheck checks every website's registration daily and warns your team weeks before it expires.
Three steps, no signup
- 01
Enter your domain
Any hostname works; www.example.co.uk is reduced to example.co.uk before the lookalikes are generated.
- 02
We generate the lookalikes
Typos, adjacent keys, look-alike and accented characters, bit flips, hyphens, brand + keyword names, and over 30 other TLDs.
- 03
Each one is resolved
Registered names are then checked for web and mail servers, and sorted by what they could be used for.
Frequently asked questions
What is typosquatting?
Registering a domain that looks like, or is a likely misspelling of, someone else's: exarnple.com for example.com, or examp1e.com, or example-login.com. A typosquatted domain collects visitors and email that were meant for the real one, and gives phishing a link or sender address that survives a quick glance. It is also called URL hijacking or domain squatting, and look-alike character variants are known as homograph attacks.
Does a registered lookalike mean someone is targeting me?
No. Many lookalikes belong to unrelated businesses with a similar name, to speculators who park thousands of names, or to you, if you registered variants defensively. The ones worth a closer look are recently registered names that receive email or serve a website, and don't belong to you. For those, a WHOIS lookup shows the registrar and registration date.
How are lookalike domains with accented or foreign characters checked?
Domain names can contain Unicode, like é or Cyrillic а, stored in DNS as punycode beginning with xn--. The checker generates look-alike characters for each letter, converts them to punycode, and resolves that. Results show both forms: the one a browser or mail client may display, and the xn-- name registries actually hold.
Why might a registered lookalike be missing from the results?
The check uses DNS, so it finds names that are delegated to nameservers. A domain registered but never given nameservers, or put on hold, doesn't appear in DNS at all. The checker also covers the variations people most often use, not every possible string, and a handful of lookups can time out on slow nameservers; the result says when that happened.
What should I do about a lookalike domain?
If it's parked or for sale and close to your brand, consider buying it. If it serves a site impersonating you or sends phishing, report it to the registrar's abuse contact (shown in a WHOIS lookup) and to the hosting provider, and file a UDRP complaint if you hold a trademark. Publishing a DMARC policy of p=reject on your own domain stops attackers sending as your exact domain, which pushes them toward lookalikes you can find here.
Is this typosquatting checker free?
Yes, with no signup. Each scan resolves hundreds of names, so it's rate limited to a few scans a minute per visitor.
Lookalikes are someone else's domains. Keep yours from becoming one.
Add your domains to Upcheck and get alerted by email, Slack, Discord, Teams, or webhook before a registration lapses, a certificate expires, or DNS changes.