— Ingenious AI security check.
Key figure: Reported cybercrime losses in the United States reached $16.6 billion in 2024, up 33% from 2023 (FBI IC3, 2024 Internet Crime Report).
Phishing is tricking you into trusting a fake identity — and lookalike domains are its favorite tool. Attackers register paypa1.com or rnicrosoft.com so links and sender addresses look legitimate at a glance. This page scores any domain for those impersonation tricks: swapped letters, punycode, hyphen stuffing, and suspicious TLDs.
Paste any domain — a suspicious link from an email, or your own brand's domain to see how easily it could be faked. This free typosquatting check gives an instant impersonation-risk score, computed entirely in your browser. Nothing you type ever leaves this page.
Tip: paste the full URL if you like — we will extract the domain.
Lookalike characters — "paypa1.com" swaps a letter for a number; "rnicrosoft.com" uses r+n to mimic m. Punycode — domains starting with xn-- can render as foreign characters that look identical to Latin letters. Hyphen stuffing — "secure-login-paypal-support.com" buries the real brand in noise. Abused TLDs — some cheap top-level domains show up in phishing far more often than others.
DomainGuard watches your actual domains around the clock and alerts you the moment a lookalike is registered. This free check is the first taste.
Typosquatting is registering domain names that look like a trusted brand — swapped letters (paypa1.com), added hyphens, lookalike Unicode characters, or a different TLD — to trick people into visiting a phishing site or trusting a scam email. This page scores domains for exactly those tricks.
Register the most abused lookalike variants of your own domain, repeat this check regularly, and consider continuous monitoring — the DomainGuard early access linked above alerts you the moment a lookalike of your brand is registered.
A typosquatted domain is a lookalike domain registered to exploit typing mistakes or visual similarity — like “rnicrosoft.com” mimicking “microsoft.com”. Attackers use them for phishing, credential theft, and brand impersonation.