Typosquat & Brand-Impersonation Scanner
Someone registering a look-alike of your domain usually isn't doing it for fun. This finds the registered impersonations of a brand — across misspellings and risky extensions — checks whether each is yours or a stranger's, and flags the ones that are freshly registered, hidden behind privacy, or already flagged for abuse. The brand-protection sweep that turns look-alikes into a prioritised list.
How it uses the graph
Traverses the DNS, threat-intel, BGP, GeoIP, WHOIS, historical layers of the graph, in 11 steps:
Generating registered look-alike variants…
Resolving who owns the real brand domain…
Threat-assessing each look-alike with assess()…
Pulling a sourced verdict for each variant…
Resolving each variant to its IP and ASN…
Geolocating each variant's IP…
Reading each variant's WHOIS and registration age…
Canonicalising each variant's registered owner…
Look-alikes across all TLDs (keyword sweep)…
Bulk co-registered domains (shared registrant email)…
Public-suffix (PSL) submitter affiliation…
Why each step runs
- 01Registered look-alikes. Builds the candidate set — only variants that actually exist in the graph — that every later enrichment step is scoped to.
- 02Who owns the brand. Canonicalises the legitimate registrant via SAME_ORG_AS so a look-alike registered to that same owner reads as defensive, not hostile.
- 03Threat verdict per look-alike. Batch-scores the variants so malicious squats separate from benign or parked ones before deeper, costlier enrichment.
- 04Sourced verdict (threat feeds). Runs explain() per variant to back each verdict with cited threat-feed sources — the evidence a brand-protection takedown needs.
- 05Where they point (IP → ASN). Maps where each look-alike actually points and the network behind it, clustering variants that share hosting into one operator.
- 06GeoIP city + country. Adds city and country per variant, the jurisdiction context that shapes which squats are reachable for takedown.
- 07WHOIS — registrar, registrant & age. Surfaces registrar, registrant and creation date — newly-registered look-alikes are the strongest abuse signal.
- 08Ownership of each look-alike. Resolves whether a third party (not the brand owner) registered the look-alike, the line between your own defensive domains and a real squat.
- 09Look-alikes across all TLDs (keyword sweep). Surfaces registered hostnames anywhere in the graph that carry the brand's apex label — catching look-alikes on other TLDs and buried in subdomains that permutation-based variant generators never enumerate.
- 10Bulk co-registered domains (shared registrant email). Pivots off the WHOIS registrant email to reveal every other domain the same party registered — a large shared-email cluster is the bulk-registration signature of a burner/scam operator.
- 11Public-suffix (PSL) submitter affiliation. Reveals who submitted the host's private suffix to the Public Suffix List, so a look-alike hiding under a private suffix can be traced to its real operator for ownership and takedown audits.