Spot lookalike domains: punycode and Unicode, mixed scripts and UTS #39 confusables.
New
Lookalike Domain Generator
Network: DoHNew
Use Lookalike Domain Generator
What it does
Enter a domain to generate dnstwist-style permutations in your browser. Press Check DNS to look up the NS and A records of the candidates you select through PhishDestroy's DNS relay.
DNS names you look up are sent to the PhishDestroy DNS relay (/api/dns-resolve.php), which asks Cloudflare or Google DNS over HTTPS.
Example
Permutations of example.com
example.com329 candidates for example[.]com (label example under com) from 15 fuzzers, generated in your browser. Nothing has been sent.
Rows alternate between fuzzers, so the first rows sample every technique. Showing 329 rows.Lists 329 candidates from 15 fuzzers, such as exmaple.com (transposition), examle.com (omission), examp1e.com (homoglyph) and example-login.com (dictionary). Nothing is looked up until you press Check DNS.
FAQ
Which permutations does it generate?
Addition, bitsquatting, homoglyphs (ASCII swaps such as rn for m, 1 for l and 0 for o, plus accented IDN letters listed with their punycode), a whole-label Cyrillic copy, hyphenation, insertion, omission, repetition, QWERTY replacement, subdomain, transposition, vowel swap, 13 dictionary words, a list of 52 common and abused TLDs, and the www- and -com patterns of dnstwist. Invalid host names and duplicates are dropped and at most 2,000 candidates are listed.
What does the DNS status mean?
NXDOMAIN means the name does not exist: it is not registered or has been taken out of the zone. NS records mean the domain is registered and delegated, and an A record means it also resolves to an address. A registered lookalike is not proof of abuse, because brands often register their own typos.
What is sent over the network?
Generating the list happens in your browser. Only when you press Check DNS are the selected candidate names (up to 300, about one query per second) sent to PhishDestroy's DNS relay, which asks Cloudflare or Google DNS over HTTPS; nothing else leaves the page.