Impostor domains
The lookalike check
How variations are generated and ranked, how many are checked on each plan, what is read about each registered one, and why the result states its coverage.
Updated · 2 min read
The check generates variations of your domain, asks DNS and the registry which of them exist, and reads what each existing one is set up to do. It is free on every plan and public on the website, because it reads only public records and never touches the other party's server.
Where
- Public: nhmohio.com/lookalike-domain-check, no account needed, rate limited per IP.
- Web and iOS: a domain's Impostor domains module; the check is on by default when a domain is added.
- API/MCP:
POST /api/lookalike-check(public),POST /api/domains/:id/lookalike-scan; toolrun_lookalike_scan(takes up to a minute; prefer the stored list unless a fresh check is wanted).
How candidates are made
The permutation engine is a TypeScript port of the ail-typo-squatting algorithms from CIRCL (BSD-2-Clause): character omission, repetition, replacement and transposition, adjacent-key typos, vowel swaps, homoglyphs (letters that look alike, including non-Latin ones), hyphenation, added and removed words, common TLD swaps, subdomain-style prefixes, and more. A seven-character name yields well over a thousand candidates, and each costs a lookup, so generation is ranked: algorithms whose output most often turns out to be a real registration go first, and the list is cut at the plan's budget.
| Plan | Candidates checked |
|---|---|
| Public tool | 100 |
| Free | 150 |
| Starter | 250 |
| Pro | 750 |
| Enterprise | 2,000 |
What is read about each hit
For every candidate that resolves or appears in certificate logs: its A and NS records, its MX (can it receive mail?), its registrar record from RDAP (when it was registered, by whom, where), and its certificates from Certificate Transparency (up to 10 certificate lookups per scan). On a cleared domain the scan also fetches the lookalike's homepage head and favicon to compare with yours; see Risk bands and signals.
The result
Lookalikes are listed worst first with the reason each matters. The one that matters most is a lookalike that can already receive mail, because that is what somebody sets up before sending invoices that appear to come from you.
The result always says how many variations were checked, so "nothing found" never reads as "nothing is out there". Coverage is a number, and a bigger plan buys a bigger number.
Three ways a lookalike is found
- Resolution: a permutation that answers DNS.
- Certificates: a permutation that appears in CT logs even if it does not resolve yet.
- New registrations: the daily feed of newly registered domains, matched against your brand, which catches a name registered this morning before it has DNS or a certificate. Nothing from that feed is stored except the matches.
Common questions
Is my own www. or a sister brand a lookalike? It will show up if it is a permutation. Give it the verdict ours and it is silenced. See Verdicts.
Why does the public tool find fewer than the app? It checks 100 candidates; a Free account checks 150 and the paid plans more.
Keep reading
Related articles
- The lookalike check found nothingWhat an empty result means, why it always comes with a coverage count, how to widen the check, and when a known impostor does not show up.Troubleshooting ·Updated
- Verdicts, change events and the evidence packTell DomainGuard what a lookalike is (ours, unrelated or known), read the change history for each, and assemble the pack for an abuse report or takedown filing.Impostor domains ·Updated
- What runs automatically, and what you pressThe line between Free and paid: how many domains are watched, what watched means on each plan, and what happens over the allowance.Getting started ·Updated