What Is Typosquatting?
Typosquatting is registering a domain that closely resembles a brand's domain: gogle.com instead of google.com, paypa1.com instead of paypal.com. Attackers use these domains for phishing, fake email and tricking users. Accented letters and Cyrillic characters (e.g. gооgle.com, where both о are Cyrillic) also enable IDN homoglyph attacks.
The DNSBil Typosquatting Hunter generates hundreds of variations for your domain, including keyboard-neighbour typos, omitted, repeated and swapped letters, look-alike characters, bit-flips, other TLDs and keyword combinations (-login, -support), and checks each one.
How Do I Read the Results?
High risk means the domain has both a website (A record) and mail infrastructure (MX) and does not appear to belong to the brand owner, so it could be prepared for phishing. Domains in the same infrastructure group are mostly the brand owner's defensive registrations. Available names are variations nobody has taken yet; registering them is the cheapest protection.
The scan only looks at DNS and does not see site content, so results are a lead, not a verdict. For anything suspicious, run a full lookup to see WHOIS and SSL details.
Frequently Asked Questions
Which records does this tool check?
NS, A and MX records are queried for every variation. If there are none, the domain is considered available.
Can I scan someone else's domain?
Yes, every query relies on public DNS data. We recommend using it for your own brand or a client's brand.
What are IDN / homoglyphs?
Using look-alike letters from different alphabets. In the browser address bar gооgle.com looks normal, but behind the scenes it is a different address starting with xn--.
Does a high-risk result mean a crime was committed?
No. Many similar domains are used legitimately by the brand owner, resellers or unrelated companies. The result only highlights the ones worth a closer look.