# dnstwist alternatives: lookalike domain tools compared

[dnstwist](https://github.com/elceef/dnstwist) is the best-known free tool
for finding domains that look like yours. It's good at what it does. What
it doesn't do is keep watching: it runs once, and a lookalike registered
tomorrow won't show up until you run it again.

Tools in this space find lookalikes in one of three ways, and that matters
more than the feature list:

- **Permutations**: generate typos and swaps of your name and check which
  are registered. Finds old and new domains, but only the variations the
  tool thinks of.
- **Newly registered domains**: compare each day's new registrations
  against your name. Catches unexpected variations, but only new ones.
- **Certificate Transparency**: watch new certificates for names like
  yours. Catches domains as soon as they get HTTPS, which many phishing
  sites do.

## Free and open-source tools

| Tool | How it finds lookalikes | Checks | Keeps watching? | Licence | Last release |
|---|---|---|---|---|---|
| [dnstwist](https://github.com/elceef/dnstwist) | Permutations (16 fuzzers incl. Cyrillic, homoglyph, bitsquatting, dictionary, TLD swap) | DNS, MX, WHOIS, GeoIP, page similarity, screenshots | No | Apache-2.0 | Jan 2025 |
| [URLCrazy](https://github.com/urbanadventurer/urlcrazy) | Permutations, 4 keyboard layouts | DNS, popularity | No | Custom (commercial use needs a licence) | Jul 2025 |
| [urlinsane](https://github.com/rangertaha/urlinsane) | Permutations, 32 algorithms, many keyboards and languages | DNS incl. MX, WHOIS, GeoIP | No (compares saved scans) | GPL-3.0 | Nov 2024, rewrite in progress |
| [ail-typo-squatting](https://github.com/ail-project/ail-typo-squatting) | Permutations, 22 algorithms | DNS | No | BSD-2-Clause | Dec 2023 |
| [openSquat](https://github.com/atenreiro/opensquat) | Newly registered domains feed, plus optional CT search | DNS, VirusTotal, phishing lists | Only if you schedule it daily | GPL-3.0 (paid feeds) | Active, no releases |
| [Phishing Catcher](https://github.com/x0rz/phishing_catcher) | CT logs via CertStream, keyword scoring | none | Yes, while running | GPL-3.0 | Unmaintained since 2020 |

Notes:

- **dnstwist** is the most complete permutation scanner. Use `-r` to show
  only registered domains and `-m` to check which have mail servers that
  could receive or send mail in your name. There's a web version at
  [dnstwist.it](https://dnstwist.it).
- **openSquat** is the free option that looks at new registrations, so it
  catches variations no permutation list contains. Run it from cron and
  you have a basic daily monitor.
- **Phishing Catcher** calls itself "just a working PoC" and depends on the
  public CertStream feed, which we couldn't get data from when we tested.

## Paid monitoring

| Service | How it finds lookalikes | Alerts | Price |
|---|---|---|---|
| [Have I Been Squatted](https://haveibeensquatted.com/pricing) | Permutations (its open-source twistrs engine) | Rule-based alerts; Slack, Teams, webhooks on Business | $199.99/yr Pro, $799.99/yr Business |
| [Netcraft](https://www.netcraft.com/platform/threat-detection-and-takedown/preemptive-domain-disruption) | Permutations and infrastructure clustering, with takedown | Not stated | Quote |
| [Red Points](https://www.redpoints.com/pricing/) | Not stated; detection plus domain recovery | Not stated | Quote |
| [EasyDMARC](https://easydmarc.com/pricing) | Lookalike domains in its enterprise threat intelligence module | Not stated | Quote |
| Nameward (this site) | Permutations, plus daily newly registered domains from ICANN zone files | Alerts when a lookalike can send email | Free for 1 domain; $49/mo Protect, $99/mo MSP |

Nameward is ours, so weigh that. It's built for small companies and MSPs
that want the lookalike check alongside certificate and email
authentication monitoring, not for brand-protection teams that need
takedowns at scale: for those, Netcraft or Red Points are the category.

## Which to use

- **One-off check, or a security review:** dnstwist with `-r -m`. Free,
  thorough, and the MX column tells you which lookalikes matter.
- **Ongoing, free, and you're happy running a server:** openSquat on a
  daily schedule, plus dnstwist every month for older registrations.
- **Ongoing with alerts, no server:** a paid monitor. Check how it finds
  lookalikes: permutations alone miss the unexpected ones; new-registration
  feeds alone miss the domain registered two years ago.
- **You need domains taken down for you:** a brand-protection service
  with takedown.

Whichever you use, a lookalike with mail servers is the one to act on
first: see [report a lookalike domain](/guides/report-lookalike-domain-takedown),
and warn the people it's likely to target with these
[warning email templates](/guides/lookalike-domain-warning-email-template).
For lookalikes made with other alphabets, see
[punycode and xn-- domains](/guides/punycode-homograph-domains).

## Check your domain

The [lookalike domain checker](/tools/lookalike-domain-checker) runs a
permutation scan in your browser and shows which lookalikes are registered
and can send email, without installing anything.

## Sources

Checked on 31 October 2026 against each project's repository and each
vendor's own pricing or product page, linked in the tables above.

---
Source: https://nameward.app/guides/dnstwist-alternatives (updated 2026-10-31)