Discuss your project

TOOLBOX · SECURITY CHECK

Find Look-alike Domains.

Are there domains that look confusingly like yours? Enter a domain and see which of up to 40 typo and confusable variants exist in DNS and can receive email.

The bot check protects the toolbox against automated abuse.

We generate up to 40 variants of your domain and only query their DNS records. We do not open the domains found and do not query owner data. We do not store results permanently.

HOW THE VARIANTS ARE CREATED

Nine Rules.
At Most 40 Variants.

Variants of your domain are created by fixed rules, one per rule in turn, until 40 are reached. Same input, same list. The examples apply to example.com; we leave out subdomains and www and check the registrable domain.

  • 01

    Other Ending

    example.at, example.de, example.eu, plus .net, .org, .ch, .co.at and .com.

  • 02

    Character Missing

    exmple.com, xample.com: one letter is left out.

  • 03

    Characters Swapped

    exmaple.com, xeample.com: two adjacent characters are swapped.

  • 04

    Neighbouring Key

    wxample.com, rxample.com: a character is replaced by a neighbouring key of the German keyboard (QWERTZ).

  • 05

    Confusable Characters

    examp1e.com: sequences that Unicode lists as confusable, rn instead of m, 1 instead of l, 0 instead of o and vice versa.

  • 06

    Character Doubled

    exaample.com, exxample.com: a character appears twice.

  • 07

    Hyphen

    ex-ample.com: a hyphen is inserted.

  • 08

    Cyrillic Look-alike

    еxample.com with a Cyrillic е, in DNS xn--xample-2of.com: looks the same but is a different domain (internationalized domain name, IDN).

  • 09

    www Without a Dot

    wwwexample.com: the dot after www is missing.

Sources: MITRE ATT&CK T1583.001 (similar domains, homoglyphs, other endings, IDN homographs; on the framework see our glossary: MITRE ATT&CK), Unicode UTS #39 with the list of confusable characters (confusables.txt, as of 6 August 2026) and RFC 5891 for internationalized domain names.

WHAT THE RESULT MEANS

Exists Does Not Mean
Malicious.

For every variant we query the name servers, and for existing variants also the mail server and IPv4 address. We do not give a grade.

  • Exists in DNS: there are name server (NS) records. The domain is registered and in operation; DNS does not show who owns it.
  • With a mail server (MX): the domain can receive email. Replies to fake emails really arrive at such a domain; we mark it as a warning.
  • Not in DNS (NXDOMAIN): usually not registered. A registered domain without name servers would look the same.
  • Without a usable answer: the resolver did not answer or answered with an error, for example with faulty name servers.
  • No owner data: we do not query WHOIS and RDAP. The IANA RDAP directory names no service for .at, .de and .ch (as of 22 October 2026), and WHOIS often contains personal data.

WHAT YOU CAN DO

Not Prevent.
But Defuse.

Anyone can register any free domain. What works is knowing look-alikes early and preparing people and processes for them.

DMARC and similar domains: RFC 7489, Section 2.4 (“does not address the use of visually similar domain names”).

QUESTIONS

Good to Know.

What is a look-alike domain?

A domain that is confusingly similar to yours: with a typo, another ending or a character that looks the same. Attackers register such domains to make fake emails look credible, for example in CEO fraud, or to collect credentials on copied sign-in pages. MITRE ATT&CK describes this as technique T1583.001.

Does “exists in DNS” mean that someone is attacking me?

No. The domain can belong to you, to a company with a similar name or to a dealer who resells domains. The check only shows that there are DNS records. The mail server matters: if a similar domain has an MX record, it can receive email, and convincingly real emails with a reply option can be sent from it.

Why do you not open the websites found?

Because domains that resemble a real one can deliver malware. We only query DNS: whether there are name servers (NS), a mail server (MX) and an IPv4 address (A). Please do not open the addresses found in the browser yourself either.

Does DMARC help against look-alike domains?

No. DMARC only protects your own domain from being forged as a sender. It has no effect against a domain that looks similar, as the DMARC standard RFC 7489 also states. What helps are attentive staff, the firm rule to confirm payments and changed bank details by calling back and, depending on the situation, registering important variants yourself.

Which data goes to whom, and does TOMORIS store anything?

Our server queries the DNS records of the variants through the DNS resolver it uses at its hosting provider. That is at most 121 queries per check. We do not query owner data (WHOIS). The result stays in memory for five minutes and is deleted after six minutes at the latest.

TOOLBOX

More
Tools.

YOUR NEXT STEP

You Have the Result.
What Comes Next?

We assess findings, prioritize by risk and put changes into practice on request: as a project with EXPERTS or as ongoing operations with GRID.

Discuss the Result