whisper.variants() — Lookalike Generation

Generate typosquat and homoglyph lookalikes of a domain, keep only the registered ones, and pivot the hits straight into a threat verdict.

Updated July 2026Procedures

whisper.variants() — Lookalike Generation Documentation

whisper.variants() generates lookalike domains for a name you give it and, by default, returns only the ones registered in the graph. One call replaces the usual pipeline of an offline typosquat generator plus a bulk registration check. Because the generation and the existence check happen where the rest of the investigation lives, you can chain the hits straight into DNS resolution, routing, and threat-feed context in the same query.

The procedure takes the domain as its first argument. By default it filters to variants that exist as HOSTNAME nodes; pass a node label as the second argument to check a different node type, or false as the filter argument to return every generated variant, registered or not. Each row carries the variant, the method that produced it, an exists flag, and a confidence score with a confidenceLabel.

Generation strategies

The domain is run through a set of generation algorithms: character omission, repetition, transposition, keyboard-adjacent replacement and insertion, homoglyph substitution, bitsquatting, TLD swap, and others. The method column names the strategy behind each row (OMISSION, TRANSPOSITION, HOMOGLYPH, ...), and confidence ranks how plausible the variant is as a lookalike, so you can sort the shortlist before triaging it.

// Registered lookalikes of paypal.com, highest-confidence first
CALL whisper.variants("paypal.com")
YIELD variant, method, exists, confidence, confidenceLabel
WHERE exists
RETURN variant, method, confidence, confidenceLabel
ORDER BY confidence DESC
LIMIT 25

[
  {"variant": "paypa1.com", "method": "HOMOGLYPH", "confidence": 0.9, "confidenceLabel": "high"},
  {"variant": "paypall.com", "method": "REPETITION", "confidence": 0.8, "confidenceLabel": "high"},
  {"variant": "papyal.com", "method": "TRANSPOSITION", "confidence": 0.7, "confidenceLabel": "medium"},
  {"variant": "aypal.com", "method": "OMISSION", "confidence": 0.7, "confidenceLabel": "medium"}
]

What the exists flag means

exists: true means the variant is registered. It does not mean the variant is malicious. A parked typosquat and a live phishing page both show up as registered, so treat every hit as a candidate that still needs triage.

The unregistered side is useful too. Pass false as the filter argument and the full generated space comes back, which is the list worth reviewing for defensive registration before someone else stands one up.

Pivot the hits to a verdict

The standard triage read chains the generator into resolution and the reconciled verdict properties in one pass: which registered lookalikes are live, where they resolve, and which already carry a blocking verdict.

// Registered variants → where they resolve → reconciled verdict, all at once
CALL whisper.variants("paypal.com")
YIELD variant, method, exists
WHERE exists
WITH variant, method LIMIT 50
MATCH (h:HOSTNAME {name: variant})-[:RESOLVES_TO]->(ip:IPV4)
RETURN variant, method, ip.name AS resolves_to,
       ip.verdictLevel AS ip_verdict, ip.verdictBlocking AS blocking
ORDER BY blocking DESC, ip_verdict DESC
LIMIT 25

For any single suspect, explain() returns the full evidence chain: score, level, the contributing feeds with their weights, and first/last-seen timestamps you can paste into a takedown ticket.

CALL explain("paypa1.com")

Keep the coverage caveat in mind: a NONE verdict means the domain is not on any feed the graph carries; it can still be a brand-new phishing page. Fresh lookalikes routinely beat feed coverage, so a variant that resolves but has no verdict yet is often the one to look at first.

Where it fits
  • The Brand Protection use case and its Lookalike Hunting recipes build the full loop on this procedure: surface scans, cluster expansion through co-hosting and shared nameservers, and certificate-transparency monitoring.
  • To run the generate-and-triage loop in the browser without writing Cypher, use the Typosquat Scanner workflow.
  • On the AI side, the same capability is exposed as the domain_variants MCP tool; see the MCP reference.
  • For the other procedures and when to prefer them over a hand-written traversal, see the procedures overview.
Previousexplain() — Threat VerdictsNextwhisper.history() — Point-in-Time