# Typosquat & Brand-Impersonation Scanner

> Someone registering a look-alike of your domain usually isn't doing it for fun. This finds the registered impersonations of a brand — across misspellings and risky extensions — checks whether each is yours or a stranger's, and flags the ones that are freshly registered, hidden behind privacy, or already flagged for abuse. The brand-protection sweep that turns look-alikes into a prioritised list.

*Source: https://www.whisper.security/docs/workflows/typosquat*

---
## How it uses the graph

Traverses the DNS, threat-intel, BGP, GeoIP, WHOIS, historical layers of the graph, in 10 steps:

01. **Registered look-alikes** _(DNS, threat-intel, GeoIP, BGP, WHOIS)_ — Enumerating registered look-alike variants…
02. **Who owns the brand** _(DNS, threat-intel, GeoIP, BGP, WHOIS)_ — Resolving the legitimate brand's owner, nameservers and mail…
03. **Threat verdict per look-alike** _(DNS, threat-intel, GeoIP, BGP, WHOIS)_ — Threat-assessing each look-alike…
04. **Sourced verdict** _(DNS, threat-intel, GeoIP, BGP, WHOIS)_ — Pulling a sourced verdict per variant…
05. **Threat-feed listings (popularity excluded)** _(DNS, threat-intel, GeoIP, BGP, WHOIS)_ — Checking each variant against real abuse feeds…
06. **Where they point (IP → prefix → ASN)** _(DNS, threat-intel, GeoIP, BGP, WHOIS)_ — Resolving each variant to its IP, prefix and ASN…
07. **GeoIP city + country** _(DNS, threat-intel, GeoIP, BGP, WHOIS)_ — Geolocating each variant's IP…
08. **WHOIS — registrar, registrant & age** _(DNS, threat-intel, GeoIP, BGP, WHOIS)_ — Reading the authoritative WHOIS record and age per variant…
09. **Graph ownership of each look-alike** _(DNS, threat-intel, GeoIP, BGP, WHOIS)_ — Canonicalising each variant's registered owner…
10. **Shared registrant email / nameserver / mail** _(DNS, threat-intel, GeoIP, BGP, WHOIS)_ — Reading the linkage that ties look-alikes to one operator…

## Why each step runs

1. **Registered look-alikes.** The candidate set every later arm is scoped to — permutations that actually exist as hostnames, minus the brand itself and its own subdomains.
2. **Who owns the brand.** The identity signals a defensive registration shares with the brand — canonical org, registrant email, nameservers, mail hosts — so a look-alike the brand owns reads as defensive, not hostile.
3. **Threat verdict per look-alike.** Batch verdict so malicious squats separate from parked or benign ones.
4. **Sourced verdict.** Backs each verdict with a score and cited feeds — with the popularity lists stripped out so a domain being popular never reads as a threat.
5. **Threat-feed listings (popularity excluded).** A feed listing is independent evidence a look-alike is already being used in abuse. The Cypher excludes six non-threat categories (popularity/trust, VPNs, ad-tracking, OFAC sanctions, proxies, Tor — 21 of the graph's 134 feeds) by CATEGORY id, not by naming individual feeds, so a look-alike merely listed on a VPN or ad-tracking feed is not reported as abuse evidence.
6. **Where they point (IP → prefix → ASN).** Maps where each look-alike actually points and the network behind it.
7. **GeoIP city + country.** The jurisdiction each look-alike sits in — context for the IP column and takedown reach.
8. **WHOIS — registrar, registrant & age.** The current registrar, registrant and creation date — the "registered by" and "age" the rows show, folded in rather than split into a separate WHOIS section.
9. **Graph ownership of each look-alike.** Whether a third party (not the brand owner) registered the look-alike — the line between your own defensive domains and a real squat.
10. **Shared registrant email / nameserver / mail.** A shared registrant email, nameserver or mail host is the signature of one party registering many squats — the basis for both self-detection and operator clustering.

[Open the full use-case page, with the live runner](/use-cases/brand-protection/typosquat)