Pricing

Rating

Developer

Actor stats

Categories

Share

Lookalike & Typosquat Domain Scanner

Find domains that impersonate your brand before they are used for phishing. Give it one brand domain; the Actor generates lookalike permutations, keeps the ones that are actually registered, enriches them, scores the phishing risk, and suppresses your own and allowlisted domains.

What it does

• Permutations: homoglyph, typo, transposition, omission, insertion, repetition, bitsquatting, hyphenation, TLD swap and addition. Multi-label TLDs (co.uk, com.au, ...) are handled.
• Registration check: live DNS (NS, A, MX) plus RDAP for registrar and registration date.
• Liveness: whether the lookalike actually serves content.
• Risk score (0-100, low / medium / high) weighting registration, live status, mail records, certificate presence, recency and permutation confidence.
• Allowlist: suppresses your own infrastructure and any domains you trust, so the results stay actionable.

Input

{"domain":"example.com","depth":"medium","allowlist":["cdn.example.com"]}

Depth levels

• Shallow (default): is it registered, does it resolve, who is the registrar, when was it registered, does it answer HTTP at all. Fast.
• Medium: shallow plus full HTTP response (status, Server header, final redirect target), TLS certificate (issuer, SAN count, expiry, valid yes/no) and favicon SHA-256 compared against your brand's favicon. A favicon match is the single strongest brand-impersonation signal and weights heavily in the risk score.

Pricing is the same per run for both depths during this iteration.

Output

One dataset item per registered lookalike, highest risk first:

When depth=medium the dataset gains: http_status, http_server, http_final_url, tls_issuer, tls_san_count, tls_not_after, favicon_sha256, favicon_matches_brand.

Pricing

Pay per event: $0.50 per scan run. One run scans a brand across all permutations and returns every registered lookalike found, regardless of how many domains were checked.

Use cases

• Brand and anti-phishing monitoring for security teams.
• Pre-launch checks before a product or marketing campaign.
• Feeding a SIEM or threat-intel pipeline with candidate phishing domains.

Development

pip install -e ".[dev]"
python -m pytest -q
python -m lookalert.cli scan example.com
python -m lookalert.cli lookup example.com