dnstwist is the best-known free tool for finding domains that look like yours. It's good at what it does. What it doesn't do is keep watching: it runs once, and a lookalike registered tomorrow won't show up until you run it again.
Tools in this space find lookalikes in one of three ways, and that matters more than the feature list:
- Permutations: generate typos and swaps of your name and check which are registered. Finds old and new domains, but only the variations the tool thinks of.
- Newly registered domains: compare each day's new registrations against your name. Catches unexpected variations, but only new ones.
- Certificate Transparency: watch new certificates for names like yours. Catches domains as soon as they get HTTPS, which many phishing sites do.
Free and open-source tools
| Tool | How it finds lookalikes | Checks | Keeps watching? | Licence | Last release |
|---|---|---|---|---|---|
| dnstwist | Permutations (16 fuzzers incl. Cyrillic, homoglyph, bitsquatting, dictionary, TLD swap) | DNS, MX, WHOIS, GeoIP, page similarity, screenshots | No | Apache-2.0 | Jan 2025 |
| URLCrazy | Permutations, 4 keyboard layouts | DNS, popularity | No | Custom (commercial use needs a licence) | Jul 2025 |
| urlinsane | Permutations, 32 algorithms, many keyboards and languages | DNS incl. MX, WHOIS, GeoIP | No (compares saved scans) | GPL-3.0 | Nov 2024, rewrite in progress |
| ail-typo-squatting | Permutations, 22 algorithms | DNS | No | BSD-2-Clause | Dec 2023 |
| openSquat | Newly registered domains feed, plus optional CT search | DNS, VirusTotal, phishing lists | Only if you schedule it daily | GPL-3.0 (paid feeds) | Active, no releases |
| Phishing Catcher | CT logs via CertStream, keyword scoring | none | Yes, while running | GPL-3.0 | Unmaintained since 2020 |
Notes:
- dnstwist is the most complete permutation scanner. Use
-rto show only registered domains and-mto check which have mail servers that could receive or send mail in your name. There's a web version at dnstwist.it. - openSquat is the free option that looks at new registrations, so it catches variations no permutation list contains. Run it from cron and you have a basic daily monitor.
- Phishing Catcher calls itself "just a working PoC" and depends on the public CertStream feed, which we couldn't get data from when we tested.
Paid monitoring
| Service | How it finds lookalikes | Alerts | Price |
|---|---|---|---|
| Have I Been Squatted | Permutations (its open-source twistrs engine) | Rule-based alerts; Slack, Teams, webhooks on Business | $199.99/yr Pro, $799.99/yr Business |
| Netcraft | Permutations and infrastructure clustering, with takedown | Not stated | Quote |
| Red Points | Not stated; detection plus domain recovery | Not stated | Quote |
| EasyDMARC | Lookalike domains in its enterprise threat intelligence module | Not stated | Quote |
| Nameward (this site) | Permutations, plus daily newly registered domains from ICANN zone files | Alerts when a lookalike can send email | Free for 1 domain; $49/mo Protect, $99/mo MSP |
Nameward is ours, so weigh that. It's built for small companies and MSPs that want the lookalike check alongside certificate and email authentication monitoring, not for brand-protection teams that need takedowns at scale: for those, Netcraft or Red Points are the category.
Which to use
- One-off check, or a security review: dnstwist with
-r -m. Free, thorough, and the MX column tells you which lookalikes matter. - Ongoing, free, and you're happy running a server: openSquat on a daily schedule, plus dnstwist every month for older registrations.
- Ongoing with alerts, no server: a paid monitor. Check how it finds lookalikes: permutations alone miss the unexpected ones; new-registration feeds alone miss the domain registered two years ago.
- You need domains taken down for you: a brand-protection service with takedown.
Whichever you use, a lookalike with mail servers is the one to act on first: see report a lookalike domain, and warn the people it's likely to target with these warning email templates. For lookalikes made with other alphabets, see punycode and xn-- domains.
Check your domain
The lookalike domain checker runs a permutation scan in your browser and shows which lookalikes are registered and can send email, without installing anything.
Sources
Checked on 31 October 2026 against each project's repository and each vendor's own pricing or product page, linked in the tables above.