Find lookalike domains

Find lookalike domains compares spelling variants against recorded WHOIS observations. Enter the domain you want to investigate, then inspect the evidence for the returned candidates.

Variants may include substituted, omitted or repeated characters and related spelling patterns. A candidate or priority indicator is not proof of phishing, live content or current registration. The tool works from observed records and can miss newly registered or unobserved domains.

Filter the returned inventory, open a candidate's WHOIS/domain records and export the loaded results when useful. Inspect source dates and coverage before escalating a finding. A locally generated spelling variant without a supporting observation is different from an observed match.

The interface shows the operation's access requirements and credit cost. To follow future changes to a known domain, create a monitor separately; running this tool does not automatically enable brand monitoring.

The tool works on a Free account: it searches WHOIS by domain name only. Without a paid plan or purchased credits, the returned records show public fields only: domain, registrar, name servers, expiration date and observation date. See Cross-search.