By the numbers
The FBI’s 2024 Internet Crime Report recorded $2.77 billion in Business Email Compromise losses across more than 21,000 complaints. Most BEC attacks begin with a lookalike domain the target brand never knew existed. A typosquat checker is the fastest way to see what your brand looks like from an attacker’s perspective.
What Is a Typosquat Checker and Why Every Brand Needs One
Your domain is one character swap away from being used against your customers. Attackers do not need to hack your servers. They register yourcompany-login.com, build a convincing clone, and wait for someone to mistype or click a phishing link. The APWG tracked over 1.1 million unique phishing attacks in 2024, and most of them ran through lookalike domains the targeted brand had never scanned for.
A typosquat checker (also called a typosquatting checker or lookalike domain scanner) closes that blind spot. It generates every plausible misspelling and variant of your domain, checks each one against live DNS and WHOIS data, and surfaces the ones that are already registered and potentially staged for a campaign. This guide covers how that process works under the hood, what signals separate a real threat from a harmless coincidence, and what to do when you find something.
What Is Typosquatting?
Typosquatting is the practice of registering domain names that closely resemble a legitimate brand’s domain, with the intent to intercept traffic, run phishing campaigns, or profit from consumer confusion. Unlike most cyberattacks, it requires no technical skill. A $10 domain registration fee is the only barrier to entry.
Attackers rely on a small set of well-documented mutation techniques:
- Character transposition: two adjacent letters swapped (
payapl.cominstead ofpaypal.com). Transposition is the most common keyboard typo humans make. - Character omission: a single letter dropped and easy to miss, like
paypl.comoramazn.com. - Homoglyph substitution (IDN homograph attacks): Latin characters replaced with visually identical Unicode or Cyrillic equivalents. The “a” in
pаypal.commay look identical in a browser address bar but resolves to a completely different domain. - TLD swapping: the same name registered under a different top-level domain such as
.net,.co,.org,.io, or any of the hundreds of newer gTLDs. - Combosquatting: a high-trust word appended or prepended to the brand name, like
paypal-secure.comorlogin-amazon.com. The Interisle Cybercrime Supply Chain report found combosquatting accounts for roughly 60% of brand-abusive domain registrations. - Subdomain abuse: registering a generic domain and placing the brand name in a subdomain, such as
paypal.account-verify.com, which exploits users who check the subdomain rather than the registrable part. - Separator insertion: adding hyphens (
pay-pal.com) or removing them from hyphenated brand names. - Double-character insertion: repeating a letter as in
payypal.comorgooggle.com.
Proofpoint’s 2025 State of the Phish report found over 94% of organizations experienced at least one phishing attack in 2024. Lookalike domains are the delivery mechanism behind the majority of those incidents.
How a Typosquat Checker Works: The Technical Breakdown
A modern typosquat checker is not a simple dictionary lookup. It runs a systematic pipeline of checks designed to surface genuine threats while filtering out noise. Here is what happens at each stage.
Permutation Generation
The engine applies a library of character-level mutation algorithms to the input domain. For a 12-character domain like yourcompany.com, this typically produces 500 to 2,000+ unique candidate domains depending on permutation depth. The mutations cover transpositions, insertions, omissions, substitutions, keyboard-adjacency swaps (keys that sit next to each other on a QWERTY layout), homoglyph replacements, TLD variants, combosquatting patterns, and dot-notation variants.
DNS Resolution
Each generated variant is queried for A and AAAA records. A resolved IP address means a live web server exists. This is the first hard signal that a domain has been activated. Unresolved domains are not discarded entirely, since an attacker may not yet have pointed DNS, but resolved ones are prioritized for deeper analysis.
MX Record Enumeration
Mail exchange records reveal whether a domain has email infrastructure configured. A live MX record on a lookalike domain is one of the most dangerous signals a typosquat checker can detect. It means the domain owner can already send and receive mail that appears to come from your brand. Research from PhishLabs indicates more than 15% of lookalike domains that resolve in DNS carry active MX records. That is not a passive squatter waiting to flip the domain. That is an inbox ready to launch a campaign.
WHOIS Enrichment
For each resolved domain, the scanner fetches publicly available registration metadata: creation date, registrar, registrant country, and privacy proxy status. Domains registered within the last 30 days receive a high-risk flag. Attackers typically register campaign-specific lookalikes immediately before a phishing launch, so finding a fresh registration before the campaign fires is the best possible outcome of a scan.
Risk Scoring
Individual signals are weighted and combined into a composite risk score. The table below shows how those signals stack up. When active DNS, a live MX record, and a registration age under 30 days align on the same domain, that combination reliably identifies a domain that is operationally ready for a phishing campaign regardless of whether abuse has been reported yet.
| Signal | Why It Matters | Risk Weight |
|---|---|---|
| Live DNS (A record resolves) | Domain is active and hosted | Medium |
| MX record present | Can send phishing email right now | High |
| Registered under 30 days ago | Freshly registered, likely pre-campaign | High |
| SSL certificate issued | Padlock makes phishing page convincing | Medium |
| Redirect to the real domain | Traffic hijacking or ad arbitrage | Medium |
| Known-risk registrar or registrant country | Correlates with abuse patterns in threat data | Low-Med |
The Typosquatting Threat Landscape by the Numbers
Typosquatting is not a theoretical risk. It is one of the most cost-effective attack vectors available to criminals, and the data makes that clear.
The economics strongly favor the attacker. A domain registration costs under $15. A successful BEC attack nets an average of $125,000 per incident according to FBI IC3 data. Digital risk protection research consistently finds that every major global brand has 15 to 50 or more registered lookalike domains at any given time. A typosquat checker makes the attack surface visible so defenders can respond before a campaign launches.
What Makes a Lookalike Domain High-Risk?
Not every registered lookalike is a threat. Some are defensive registrations by the brand itself; others are genuinely coincidental overlaps with unrelated businesses. These are the signals that separate actionable threats from background noise.
Active DNS Resolution
A domain that resolves to an IP address is being hosted somewhere. This is the minimum threshold for active use. Parked domains with a registrar’s placeholder page are less immediately dangerous than domains pointing to a real server, but the registrar parking page itself can contain pay-per-click ads that monetize misdirected traffic.
Live MX Records
This is the most dangerous signal a typosquatting checker can surface. MX records are not needed for a website. They exist to route email. A lookalike domain with an MX record is configured to send or receive messages, which means an attacker is one spoofed invoice away from a successful BEC attack. When a scan surfaces a newly registered lookalike with an active MX record, it should be treated as an immediate priority.
Recent WHOIS Registration
Domains registered within the past 30 days deserve immediate attention. Attackers do not register campaign infrastructure months in advance. They spin up fresh domains as close to the campaign launch as possible to stay ahead of blocklists. Finding a recently registered lookalike during a scan is the closest a defender gets to catching an attack in its preparation phase.
SSL Certificate Presence
Free SSL certificates are available to anyone within minutes of domain registration. A lookalike with HTTPS enabled shows a padlock in the address bar, and a significant percentage of users still treat that padlock as a trust signal. Certificate Transparency logs also allow retrospective detection. Even if a domain’s DNS is later cleaned up, its SSL issuance history persists in publicly accessible logs.
Redirect Behavior
A lookalike domain that 301-redirects to the legitimate site may be engaged in traffic arbitrage, intercepting users who mistyped and monetizing that traffic through affiliate links or ad networks before passing them through. While less obviously malicious than a phishing clone, this still diverts revenue and exposes visitors to intermediary tracking.
Free vs. Paid Typosquat Checkers
Both have a place in a brand protection strategy, but they serve different needs.
| Feature | Free Typosquat Checker | Paid / Continuous Monitoring |
|---|---|---|
| Permutation scan | On demand | Continuous |
| Live DNS + MX detection | ✓ | ✓ |
| WHOIS enrichment | Limited | Full history |
| Real-time new-registration alerts | ✗ | ✓ |
| Historical change tracking | ✗ | ✓ |
| Takedown support | ✗ | ✓ |
| Multiple domains | One at a time | Portfolio-wide |
For a founder running a one-time audit before a product launch, a free typosquatting checker is the right starting point. For any brand running paid advertising, processing transactions, or operating in a regulated industry, continuous monitoring is not optional. The threat landscape changes daily, and a lookalike domain found 48 hours after a campaign launch has often already reached thousands of inboxes.
Frequently Asked Questions About Typosquat Checkers
Conclusion: Do Not Wait for a Customer to Report It
Every day your domain goes unmonitored is a day an attacker could register yourbrand-secure.com, configure an inbox, and start targeting your customers. The tools to prevent that are not expensive, and the first scan takes under a minute.
A typosquat checker turns an invisible threat into a visible, prioritized list of domains you can act on. Whether that means filing a UDRP complaint, reporting a phishing domain to its registrar, or simply knowing which MX-equipped lookalike to watch most closely, the data above makes clear this is not a hypothetical category. It is the most common delivery mechanism behind the most financially damaging type of cybercrime operating right now.