# Lookalike Domain Generator

URL: https://iblockspam.com/tools/lookalike-domain-generator
Last updated: 2026-10-22

> See the look-alike versions of your domain that attackers are most likely to use, from a missing letter to rn in place of m, and which of them already exist or can receive email.

Free tool: See typo, look-alike character and other-ending versions of your domain, and which of them exist in DNS or have a mail server. Use it at https://iblockspam.com/tools/lookalike-domain-generator

## What the Lookalike Domain Generator does

Your DMARC policy stops other people sending email from your exact domain. It can't stop someone registering a name that only looks like it, such as `examp1e.com`, `exampel.com` or `example.co`, and sending perfectly authenticated mail from that. The FBI's Internet Crime Complaint Center tells businesses to watch for "misspellings of the actual domain name" in its [business email compromise warning](https://www.ic3.gov/PSA/2024/PSA240911), which puts reported exposed losses at more than $55 billion between October 2013 and December 2023.

Enter your domain and the generator:

1. Builds up to 60 look-alike names, riskiest first, using the same rules as iBlockSpam's Lookalike Domain Watch.
2. Looks each one up in public DNS: first its name servers, then, for names that exist, its address (A) and mail server (MX) records.
3. Sorts the results so names with a mail server come first, then names that exist without one, then names that aren't in DNS.

We only read public DNS. Nothing is registered, contacted or changed, and the names are shown as plain text, not links.

## Which look-alikes it builds

| Technique | Example for `example.com` | Why attackers use it |
|---|---|---|
| Same name, different ending | `example.net`, `example.co` | Easy to miss when the name itself is right |
| Look-alike characters | `exarnple.com` (rn for m), `examp1e.com` (1 for l) | Nearly identical in many fonts |
| Look-alike international characters | Cyrillic а in place of Latin a, as punycode (`xn--…`) | Can look identical in a browser or mail client |
| Missing letter | `exmple.com` | A common typing slip |
| Swapped letters | `exapmle.com` | People read the word, not the letters |
| Doubled letter | `exxample.com` | Hard to spot in a long name |
| Added or removed hyphen | `ex-ample.com` | Looks like a variant the brand might own |
| Mistyped or extra letter | `exanple.com`, `exampler.com` | Neighbouring keys on a keyboard |

International look-alikes are encoded as punycode ([RFC 3492](https://www.rfc-editor.org/rfc/rfc3492.html)) in DNS, so the table shows both the form people see and the `xn--` form DNS uses. The Unicode Consortium's [security mechanisms report (UTS #39)](https://www.unicode.org/reports/tr39/) describes how characters from different scripts can be confusable; we use a small, well-known set of Cyrillic letters rather than every possible confusable. Our guide on [punycode and homograph phishing](https://iblockspam.com/blog/punycode-idn-homograph-phishing) explains the trick in detail.

The list is capped at 60 names per domain so each check stays quick. A longer label produces more typo variations than that, so the least likely ones (mostly extra letters) are left out.

## How to read the results

| Status | What we saw | What it means |
|---|---|---|
| Has a mail server | MX records | The domain can receive email. Look at these first. |
| In DNS, resolves to an address | An A record, no MX | Often a website or a parking page. It can get a mail server later. |
| In DNS, no website or mail | Name servers only | Registered and delegated, but not in use yet. |
| Not in DNS | NXDOMAIN or no records | No DNS records today. Not proof the name is unregistered or available. |
| Not checked | A lookup failed or the run hit its limit | Unknown. Try again later. |

A null MX record (`0 .`) is a domain's way of saying it accepts no mail ([RFC 7505](https://www.rfc-editor.org/rfc/rfc7505.html)), so we don't count it as a mail server.

**A look-alike in DNS isn't proof of an attack.** Many are parked by domain investors, some are owned by your own company, and some belong to unrelated businesses with similar names. The result tells you where to look, not who registered the name.

## What to do when you find one

1. **Check whether it's yours.** Ask whoever manages your domains. Many businesses own their .net, .co or obvious typo names.
2. **Look up who holds it.** [ICANN Lookup](https://lookup.icann.org/en) shows the registrar and registration date. Owner details are often private.
3. **Block it.** Add the domain to the blocked senders list in your spam filter or mail platform, so mail from it doesn't reach your users.
4. **Warn the people it could fool.** Tell staff, and customers who pay you, to check the sender's domain and to confirm any change of bank details by phone. Our guide on [vendor invoice fraud](https://iblockspam.com/blog/vendor-invoice-fraud-payment-redirection) covers the payment side.
5. **Report abuse.** If it's used for phishing, report it to the registrar and the host with the evidence you have. Under the [ICANN Registrar Accreditation Agreement](https://www.icann.org/resources/pages/approved-with-specs-2013-09-17-en) (section 3.18), accredited registrars must publish an abuse contact and take reasonable and prompt steps to investigate reports. If your customers have already been targeted, follow [what to do when customers are phished by a fake version of your company](https://iblockspam.com/blog/customers-phished-by-fake-version-of-your-company).

Read [how lookalike domain phishing works](https://iblockspam.com/blog/lookalike-domain-phishing) for the attacker's side, and protect your exact domain with an enforced DMARC policy; the [DMARC Checker](https://iblockspam.com/tools/dmarc-checker) shows where you stand.

## Watch these names every day

This tool is a one-off snapshot. [Lookalike Domain Watch](https://iblockspam.com/features/lookalike-domain-watch), included in every iBlockSpam plan, checks up to 150 look-alike names for each protected domain every day through DNS and public Certificate Transparency logs, and emails you when one is registered or gets a mail server. It detects look-alikes; it can't take domains down.

## Limitations

- **Up to 60 names.** Names that are very different from yours, such as `example-payments.com` or `example-support.net`, aren't generated.
- **DNS only.** We don't check registration records, websites or certificate logs here, and a registered domain with no DNS records shows as "Not in DNS".
- **A time and query limit.** Each check has a fixed DNS budget. For well-known brands, where many look-alikes exist, some names may show as "Not checked".
- **Results are cached for 24 hours** per domain, and each IP address can check a limited number of new domains per hour, so the tool stays fast for everyone.

## Sources

- [FBI IC3: Business Email Compromise: The $55 Billion Scam (September 2024)](https://www.ic3.gov/PSA/2024/PSA240911)
- [RFC 3492: Punycode](https://www.rfc-editor.org/rfc/rfc3492.html)
- [Unicode Technical Standard #39: Unicode Security Mechanisms](https://www.unicode.org/reports/tr39/)
- [RFC 7505: A "Null MX" No Service Resource Record](https://www.rfc-editor.org/rfc/rfc7505.html)
- [ICANN 2013 Registrar Accreditation Agreement, section 3.18](https://www.icann.org/resources/pages/approved-with-specs-2013-09-17-en)
- [ICANN Lookup (registration data)](https://lookup.icann.org/en)

## Frequently asked questions

### Which look-alike names does the generator check?

Up to 60 per domain, riskiest first: the same name on other endings such as .com, .net, .co and your country ending, look-alike characters such as rn for m or 0 for o, a few Cyrillic look-alikes as punycode, then typos such as a missing, swapped, doubled or mistyped letter.

### Does Not in DNS mean I can register the name?

Not necessarily. It means the name returned no DNS records when we looked. A domain can be registered without being published in DNS, and some names are reserved. Check availability with a registrar before you rely on it.

### Should I register look-alikes of my own domain?

Registering a few of the riskiest ones, such as your name on .com or .net and the most obvious typo, is a common defensive step. You can't register every variation, so pair it with sender-domain checks for payment requests and with a filter that blocks known look-alikes.

### Why does a look-alike domain with a mail server matter more?

MX records mean the domain can receive email, and a domain set up for mail can usually send it too, including replies in a conversation with your customers. A parked name with no mail server is less urgent, but it can get one at any time.

### Can iBlockSpam take a look-alike domain down?

No. We detect look-alikes; we can't remove them. Removal is up to the registrar, the hosting provider or a court. Registrars accredited by ICANN must publish an abuse contact and investigate reports, so a clear report with evidence is the usual first step.

---

Source: iBlockSpam, https://iblockspam.com/tools/lookalike-domain-generator (this is a Markdown copy; the HTML page is canonical). Quote with attribution and a link. Site index for AI assistants: https://iblockspam.com/llms.txt