Impostor domains
The lookalike check
How variations are generated and ranked, how many are checked on each plan, how many lookalikes are examined in detail, and why the result states its coverage.
Updated · 4 min read
The check generates variations of your domain, asks DNS which of them exist, searches certificate logs for names that contain yours, and reads what each existing one is set up to do. It is free on every plan and public on the website. The public tool reads only public records and never touches the other party's server. In your account, once the domain is verified (see Verifying a domain for deep scans), the check also compares each lookalike's homepage with yours.
Where
- Public: nhmohio.com/lookalike-domain-check, no account needed, rate limited per IP.
- Web: Security, Impostor domains. iOS: a domain's Impostor domains module. The check is on by default when a domain is added.
- API/MCP:
POST /api/lookalike-check(public),POST /api/domains/:id/lookalike-scan; toolrun_lookalike_scan(takes up to a minute; prefer the stored list unless a fresh check is wanted).
How candidates are made
The permutation engine is a TypeScript port of the ail-typo-squatting algorithms from CIRCL (BSD-2-Clause): character omission, repetition, replacement and transposition, adjacent-key typos, vowel swaps, homoglyphs (letters that look alike, including non-Latin ones), hyphenation, added and removed words, common TLD swaps, subdomain-style prefixes, and more. A seven-character name yields well over a thousand candidates, and each costs a lookup, so generation is ranked: algorithms whose output most often turns out to be a real registration go first, and the list is cut at the plan's budget.
| Plan | Candidates checked per scan |
|---|---|
| Public tool | 100 |
| Free | 150 |
| Starter | 250 |
| Pro | 750 |
| Enterprise | 2,000 |
What is read about each lookalike
Every scan examines up to 40 registered lookalikes in detail. For each one it reads the A and NS records, the MX records (can it receive mail?) and the registry record (when it was registered, and by which registrar). Certificate history is looked up for at most 10 lookalikes per scan, and only for those that resolve, receive mail, or were found in certificate logs. In the account (never on the public tool) the scan also fetches the lookalike's homepage title and site icon to compare with yours; see Risk bands and signals.
When more than 40 lookalikes are found, the ones examined are chosen in a fixed order: those that were Active threat or Suspicious last time, then ones never seen before, then the rest, with homoglyph names and certificate-log finds ahead of ordinary typos, and names on shared hosting platforms last. The same names are examined on every run, so a lookalike does not appear and vanish from one scan to the next because of the cut.
Names on shared hosting platforms (pages.dev, vercel.app, github.io, myshopify.com and similar) are projects, not registrations. They get no registry or certificate lookup, and they are described as set up on a shared hosting service.
The result
Lookalikes are listed worst first with the reason each matters. The one that matters most is a lookalike that can already receive mail, because that is what somebody sets up before sending invoices that appear to come from you.
The result always says what it covered, so "nothing found" never reads as "nothing is out there". The coverage line says how many of the possible variations were checked, how many lookups did not come back (those are unknown, not clear), and whether the certificate log search or certificate records failed this run. When more than 40 lookalikes were found, it says so: "Found 57 registered lookalikes and examined the 40 most important; the other 17 were not looked at this run."
Three ways a lookalike is found
- Resolution: a permutation that answers DNS.
- Certificates: a name in the certificate logs that contains your domain name, even if it does not resolve yet. Runs on every scan when your domain name is at least 5 characters long.
- New registrations: a daily list of newly registered domains, matched against the names you watch. The list arrives about two days after registration and covers most common domain endings, not all of them. It needs an active watch (Starter and up). Nothing from that list is stored except the matches. See Risk bands and signals.
Common questions
Is my own www. or a sister brand a lookalike? It will show up if it is a permutation. Give it the verdict ours and it is silenced. See Verdicts.
Why does the public tool find fewer than the app? It checks 100 candidates; a Free account checks 150 and the paid plans more.
The coverage line says some lookalikes were not examined. A short or common name can have more registered lookalikes than one scan examines. The most important 40 are examined each run. The rest are counted, not ignored silently.
Keep reading
Related articles
- The lookalike check found nothingWhat an empty result means, why it always comes with a coverage count, how to widen the check, and when a known impostor does not show up.Troubleshooting ·Updated
- What runs automatically, and what you pressThe line between Free and paid: how many domains are watched, what watched means on each plan, and what happens over the allowance.Getting started ·Updated
- Lookalike watch and alertsKeeping the check running: weekly on Starter, daily on Pro and Enterprise, with an opt-in alert when a lookalike can receive mail or becomes an active threat. Off is always free.Impostor domains ·Updated