Who has registered a domain that looks like yours?
Enter your domain. We check the look-alikes a human falls for, letter swaps, wrong endings, inserted words and look-alike letters, against public DNS, and show which are registered and which are already set up to send mail. About 30 seconds.
A Cloudflare human check runs in the background and only asks for a click when it has to.
Free · No sign-up · Public sources only · See plans and prices
Scanning
About 30 seconds. Every check reads public sources only, and each one appears here as it finishes.
Reading DNS, mail authentication, look-alikes, certificates and breach signals…
Your exposure snapshot
The sources these checks read did not answer during this scan. They are left out, not counted as clean, so there is no overall grade until they run. Scan again later, or monitor this domain and it is checked again on its own.
A free scan looks up your domain, not each person. It does not check which staff addresses turn up in other companies' breaches. Monitoring does, for every address you add.
Who it affects, and what to do.
Counted from malware logs and breach records for your domain. Nobody is named on this page: names go only to an inbox at your domain, in the full report.
Each check, and what it found.
A check that could not run says so. It is never counted as nothing found.
Where to start.
Ranked by what an attacker would use first, and what to change in your own DNS or accounts. The full report names the exact accounts, people and hosts.
How this could be used The usual way in, against what this scan saw
Select a stage to see what it is, and what breaks it.
What a free scan sees, and what monitoring adds.
This free scan
- Malware logs: your staff, your customers and outside services, counted
- Breaches of your own website
- Mail spoofing, look-alike domains, sign-in pages, web and certificate settings
- Leaders named on your site
Your domain only, once. Counts here; names and evidence in the full report.
With monitoring
- Every staff address checked against breach data, named, with what leaked
- Checked again on a schedule, with an alert when something new appears
- Every domain you add, its subdomains, and on Professional your leaders' addresses
- Each fix proved with a re-scan
Get the full report at your company inbox.
It names the people and accounts behind each finding, so we only send it to an address at the domain you scanned.
- Every finding, with the evidence behind it
- What breach and infostealer data shows for your domain
- How many leaders your pages name, and in which roles
- Every registered look-alike, with its mail and web status
- The record or setting that fixes each one, and what was not checked
One email with a private link to the report, which works for 14 days. Free scan results are deleted after 90 days. The domain's stolen-login counts (numbers only) are kept to show change over time. See our privacy notice.
Exposure changes every week. New look-alikes get registered and new leaks surface. Monitoring re-scans on a schedule, tells you what changed and proves each fix with a re-scan.
The look-alikes that actually fool people, and which are armed.
We check the permutations a human falls for, not every string on the internet, so a flag is a real risk and not noise.
What this checks
- Registered look-alikes of your domain. Letter swaps, wrong endings, inserted words and look-alike letters from other alphabets, checked against public DNS for which are registered.
- Which are ready to send mail. A look-alike with mail records is primed to impersonate you now; those are flagged first.
- The other half of impersonation. Whether your own email can be forged (SPF, DKIM, DMARC), because that is what makes a look-alike convincing.
What it does not
- Register or buy anything for you. We show you what exists. Defensive registration and takedowns are yours to decide.
- Watch every string on the internet. We check the permutations that fool people. Monitoring widens and repeats the check over time.
- Need access or a key. A domain is enough.
Thirty seconds, then a plan.
No account, no agent, nothing installed. We read what anyone on the internet can already see, and what is already on sale.
Enter your domain.
Your company domain, or your work email and we take the domain from it.
Seven checks run at once.
DNS, certificate logs, your public pages, stealer logs and breach records. You watch each one finish.
See what it means.
A grade, what each check found, and the first things to fix, ranked by what an attacker would use first.
Then keep it fixed.
Monitoring checks again on a schedule, tells you what changed, and proves each fix with a re-scan.
Seven checks, and where each one looks.
Named, so you know what a clean result covers. Nothing here touches your systems.
| Check | What it looks at | Where it comes from |
|---|---|---|
| Leaked credentials | Staff computers caught by password-stealing malware, and breaches of your own website. | Hudson Rock's infostealer intelligence; Have I Been Pwned's list of breached sites |
| Email spoofing | Whether mail can be forged as your domain: SPF, DKIM and DMARC as published. | Your domain's public DNS |
| Look-alike domains | Registered near-copies of your name, and which of them can already send or receive mail. | Public DNS |
| Executive exposure | Leaders named on your public pages: the target list for CEO fraud. With monitoring, their addresses are checked against breach data. | Your own public web pages |
| Sign-in surface | VPN portals, webmail and admin logins anyone can find under your domain. | Certificate transparency logs and public DNS |
| Third parties | Who runs your DNS, who may send mail as you, and who sees your mail flow. | Public DNS records |
| Web and TLS | Certificate health and the security headers a modern site is expected to send. | Your website, as any browser sees it |
We read. We do not touch.
- Public sources only. Nothing is installed, nothing logs in, and no password is ever tried.
- Nobody at your company is contacted. The only email is the full report, and only if you ask for it at an address on your domain.
- Your result is yours. It opens at a private link that only you are given, and never shows the names behind a finding.
- Kept for 90 days. Then the result and its link are deleted. Scan again any time.
More in our privacy notice.
Questions, answered.
What is a look-alike domain?
How do you find them?
Why does it matter whether one can send mail?
Do you check every possible variation?
Can you take a look-alike domain down?
What do I do with the result?
Find the fakes before they fool anyone.
See which look-alikes of your domain are registered and which are armed to send mail, then warn your people and start a takedown.