In brief
A typosquatting checker generates variations of a domain and checks for DNS activity. Use it to find leads for investigation. It cannot determine intent, prove a domain is safe or reliably tell you a name is available to buy.
- Search for a domain, not a full URL or email address.
- Read DNS results as observations, not threat scores.
- Keep a record of the findings you want to investigate.
Run your first check
Use the domain people know you by. If your customers receive mail from someone@example.com, enter example.com. Leave out the person’s name, https:// and any page path.
The form opens DNSTwister’s own scanner. Let the checks finish before treating the result count as complete. The report lists similar names and DNS observations; you can also export the results as CSV.
If you are investigating a particular email, start by writing down the exact sender domain separately. A generated list is useful context, but it should not replace investigating the name that actually appeared in the message.
References: [1]
First, understand what changed in the name
Most people read a familiar word as a whole. That is why a domain can feel right even when one character is wrong. Looking at the change deliberately is more useful than relying on a quick glance.
These fictional examples use example.test as the legitimate name. They illustrate common sources of confusion, not a promise that every variation appears in every scan.
| Example | What changed | Why you might miss it |
|---|---|---|
| examp1e.test | The letter l became the digit 1. | Some fonts make the difference subtle. |
| exampl.test | The final e is missing. | The remaining word still looks familiar. |
| examlpe.test | Two adjacent letters swapped places. | A reader may mentally correct the order. |
| example-login.test | An extra word was added. | A plausible purpose can make an unfamiliar domain seem official. |
| example.test.login.invalid | The familiar name is at the left of a longer hostname. | The registered domain in this example is login.invalid, not example.test. |
Do not reduce every hostname to its last two labels. Registration boundaries vary: suffixes such as co.uk use more than one label. The practical habit is to identify the actual registered domain, rather than assuming the leftmost familiar word owns the address.
Internationalized domain names need particular care. A browser may show Unicode characters or their ASCII encoding, often beginning xn--. Neither display is a verdict on legitimacy; compare the full name and your evidence.
What the DNS columns tell you
A domain can have a website, receive email, do both or do neither. The checker’s DNS results help separate those observations. They do not tell you what the operator intends.
| Result | Reasonable interpretation | What not to conclude |
|---|---|---|
| A record / IP address found | The queried name resolved to an IPv4 address. | That a website exists, or that the operator is malicious. |
| MX record present | Mail-routing records were returned. | That the domain has sent phishing, or that a particular mailbox exists. |
| No A or MX answer | The queried records were not returned at this check. | That the name is unregistered, safe or available to buy. |
| Lookup error | That check did not establish a reliable result. | That no relevant DNS record exists. |
MX is about receiving mail. A sender can send a message without publishing an MX record for its domain. There is also a special “null MX” configuration that declares a domain does not accept mail; a simple present-or-absent indicator is not enough to interpret that detail.
If you see a section labelled “Available” in a DNS-based report, verify availability with registration data before making a purchase decision. Lack of a DNS answer is not a registration check.
A result worth reviewing is not yet an incident
Suppose your fictional business uses example.test and a scan finds examp1e.test. It resolves to an address and has an MX record. That is enough to put it in a review queue, but not enough to accuse its operator of fraud.
Now add a customer report: a message from accounts@examp1e.test asks them to change the bank account for an unpaid invoice. The investigation has changed. You have a specific message, a request and a person affected—not just a spelling similarity.
Preserve the message, verify the request with your finance team through a known channel and follow the response process. Do not click the domain just to see what happens.
Keep the useful parts of the search
Save the domain you searched, the time of the check and the results you intend to follow up. If you export a CSV, retain the original file so you can distinguish the scan’s observations from your own notes.
A second search may return a different set of results because DNS and the available observations change. Differences are worth explaining; they are not automatically evidence of a new attack.
When a one-off check stops being enough
A free check works well for an initial review or a reported message. It becomes less dependable as a routine when it relies on someone remembering to repeat the search and compare old files.
If you need to track a brand over time, monitoring gives the review a regular input. The important follow-up is still human: understand the change, collect supporting evidence and decide whether to act.
A few common questions
Does a padlock or HTTPS mean the lookalike is legitimate?
No. HTTPS protects the connection to the domain you reached. A separate domain can have a valid certificate while impersonating a different business.
Can a scan find every phishing domain?
No. Generated variations have limits, and a campaign may use an unrelated name, a compromised legitimate site or a domain without the queried records.
References
- DNSTwister — Free scanner and FAQ: domain input, variations and DNS observations.
- Cloudflare Learning Center — What is a DNS MX record?: inbound mail routing.
- IETF RFC 7505 — Null MX: a domain can explicitly declare that it accepts no mail.
Product details were checked against the available documentation on . Fictional examples are labelled in the guide.
