Typosquat & Brand-Impersonation Scanner

Legal forwards a phishing mail whose link points at paypl.com — paypal.com with one letter gone. WHOIS dates the name to 2000-05-03 and hides the current registrant behind a privacy service, so the two heuristics you were reaching for, freshly registered and hidden owner, disagree with each other on the first name you look at.

Do I open takedowns on this brand's look-alikes this week, and what would tell me I picked the wrong ones?

Not "is paypl.com malicious". One name is a ticket. The set of names is the exposure, and the expensive mistake lives in the set.

• Names that are not permutations of the string. whisper.variants generated 159 registered look-alikes of paypal.com across 13 methods. The graph holds 18,386 hostnames beginning paypal-, and not one of them is in the 159. Prefix and suffix abuse is outside this run.
• Whether any of them has been used against your customers. Whisper reads the name, the registration and the hosting. It does not read your mail.
• Who holds a name today. HAS_EMAIL is a union over WHOIS history, not the current record. xn--pypal-0jc.com carries both hostmaster@paypal.com and gugeky@gmail.com, and its history runs Dynadot in 2017, then MarkMonitor and PayPal Inc. from 2019 on.
• A stable count of feed-listed look-alikes. The LISTED_IN traversal over the 152 is non-deterministic on production: four runs on 2026-08-09 returned 20, 13, 12 and 11, and membership moved with the count. Read the rows. Every number here is qualified by Coverage.

whisper.variants returns 159, of which 152 survive dropping the brand and its own subdomains — the same 152 on three consecutive runs.

whisper.assess over those 152 returns 152 rows: 128 clean / NONE, 11 malicious / HIGH, 11 benign-allowlisted / NONE, 2 unknown / UNKNOWN. Three consecutive runs, same split. The two unknown rows are the point — an absence of evidence arrives as a populated row that says unknown. Zero rows is never a verdict.

explain() backs the verdict with its sources, and shows why this workflow strips the popularity lists before counting: paypal.me, the brand's own short-link domain, returns 0 / NONE with tranco-top1m and cloudflare-radar-top1m as its only cited sources. A list of popular domains, read as feed evidence, makes every real brand domain look sourced.

Three of the eleven malicious / HIGH look-alikes belong to the brand. xn--papal-ouc.com, xn--pypal-0jc.com and xn--pypal-4ve.com canonicalise to PayPal Inc., carry hostmaster@paypal.com as registrant and sit on MarkMonitor nameservers: corporate defensive registrations of homoglyph names, listed by a malware feed and scored on it.

xn--pypal-0jc.com scores 46.40. paypl.com, a third-party squat, scores 46.07. The brand's own domain outscores the squat. Registration is the column the verdict does not carry, and it is the column that decides whether a name is a takedown or an asset.

"Ours" is an inference, so attack it. 48 of the 152 match paypal.com on at least one identity signal — canonical organisation 28, registrant email 33, nameserver 22, mail host 20 — leaving 104 third-party. Two of those signals are weak alone: hostmaster@ebay.com is one of the brand's three registrant emails and attaches to 6,454 hostnames, and ns1.markmonitor.com serves more than 511,000 zones. Match on either by itself and "ours" means "a MarkMonitor customer".

Then check the ownership arm ran at all. (:HOSTNAME)-[:REGISTERED_BY]->(:ORGANIZATION)-[:SAME_ORG_AS]->(:ORGANIZATION) composed in one pattern returns 0 rows at HTTP 200; split across a WITH, the three canonical names come back. An ownership arm that fails silently files every defensive registration as a squat.

Then the dates. whisper.history.whois covers 146 of the 152 in 1,781 records; 50 of them carry more than one creation date and one carries nine. Three dot-insertion variants come back with an advisory that the record shown belongs to the registrable parent — p.aypal.com answered with aypal.com, pay.pal.com with pal.com. Their registrar and age describe a different domain than the row's name.

Eight names, not 152 and not 11: paypl.com, payapl.com, pa7pal.com, pasypal.com, paypalp.com, paypal.cam, paypcl.com, xn--paypa-8nc.com. Each reads malicious / HIGH, each is cited to hagezi-tif-full under a Malware Distribution category, and none touches any of the brand's four identity signals. That is the takedown queue. The other three malicious verdicts are the brand's own property, and the 96 remaining third-party look-alikes carry a verdict with no feed evidence behind it — a watchlist, not a case.

Four things would overturn it, and each is a query:

• the ownership arm returning empty, which reads exactly like a clean sweep of squats;
• a name among the eight turning out to be brand-held under a registrant the brand-owner step did not surface — paypal.jp canonicalises to eBay, Inc and is only recovered as the brand's by its shared registrant email, nameservers and mail hosts;
• one of the 96 picking up a feed listing, which is why the unstable traversal above is re-run rather than cached;
• a look-alike being parked rather than used. 123 of the 152 resolve to an IP, and the graph says nothing about what is served there.

Running these against your own brand: Brand protection recipes.