Quick answer
How do you find look-alike domains of your brand?
To find look-alike domains of your brand, generate permutations of your name with dnstwist, keep the registered ones with its --registered option, then cross-check certificate logs on crt.sh and scans on urlscan.io. All three are free. Wardmint sells the registrations that close the gaps you find: a .com costs $12.49/year.
The three free tools, side by side
| Tool | What it finds | Cost | Main limit |
|---|---|---|---|
| dnstwist | Typo, homoglyph, hyphen and extension-swap variants of a seed domain that are registered (open source, Apache-2.0) | Free | Only finds what its rules generate; a new word added to your name appears only if you give it a dictionary |
| crt.sh | Certificates logged for any name containing your brand string, often before the site is live | Free | A site without HTTPS never appears; the wildcard search can return thousands of lines |
| urlscan.io | Public scans that already loaded a page, with screenshots and the domains involved | Free plan with daily quotas, including 1,000 search requests; paid plans from USD 5,000 a year | Shows only pages someone scanned |
Six steps from a brand name to a triaged list
Write down your seed names
List the exact spellings people type: the project name, the ticker, the app name and any short form. Each seed is searched on its own, so a project called ExampleCoin with the ticker EXC has at least two seeds.
Install dnstwist
The tool runs on Python and has a Docker image. The command is in the first code block below; the project page is the reference for other installers.
List the registered variants
Run dnstwist with --registered on each seed. The unfiltered output runs to thousands of lines of names nobody owns, so this option keeps only the names that resolve.
Search the certificate logs
Query crt.sh for your brand string with a wildcard on both sides. Every certificate issued for a name containing the string appears with its date.
Search urlscan.io
Ask for domains that start with your seed. Open the results page rather than the suspect site itself, so your own browser never touches the page.
Triage into three piles
Sort every name into: yours already, free to register for your brand, or held by someone else. The last pile goes to the ownership check and, if the page is hostile, to a report.
pip install dnstwist[full]
# registered variants of your own seed, as a readable table
dnstwist --registered --format csv examplecoin.com | column -s, -t
# the same, saved as JSON, then only the domain names
dnstwist --registered --format json examplecoin.com > lookalikes.json
jq -r '.[].domain' lookalikes.jsoncurl -s "https://crt.sh/?q=%25examplecoin%25&output=json" | jq -r '.[].name_value' | sort -ucurl -s -G "https://urlscan.io/api/v1/search/" \
--data-urlencode "q=page.domain.keyword:examplecoin*" \
--data-urlencode "size=100"Why look for look-alikes before anyone reports them?
Because most phishing domains are registered by the attacker for the attack, so they exist before the first victim. Interisle found that 77% of phishing domains in its May 2024 to April 2025 data were maliciously registered rather than compromised. Chainalysis reported that impersonation scams grew about 1,400% in 2025. A weekly search of your own name turns a surprise into a routine task.
The search also tells you which variants are still free. A free variant is a registration you can make for your own brand, and a taken one is a candidate for the ownership check.
How does dnstwist generate and check variants?
dnstwist applies a fixed set of rules to your seed domain and asks DNS which results exist. The rules cover the families described on the look-alike domain types page: omitted or doubled letters, swapped neighbours, hyphens, look-alike characters and a different extension.
Two more options matter for a crypto brand. The dictionary option adds permutations built from a word list, which is how you test names such as your brand followed by a word users search for. The TLD option checks your name under every extension in a file. Both take paths to files from the dictionaries folder of the dnstwist repository.
Run the tool from a machine you can wipe or from a throwaway container: the output lists names you do not control.
What do certificate logs add that DNS does not?
Certificate logs show a name before its site is advertised, because most phishing pages request an HTTPS certificate. Each certificate issued by a public authority is written to a public log, and crt.sh searches those logs. In the February 2026 front-end hijack cluster tracked by Blockaid, the attacker obtained certificates the same day as the DNS change, including a wildcard for *.nerochain.io.
A one-time search catches what exists today. For a standing watch, follow the certificate transparency monitoring guide, which uses the same logs as a feed.
How do you triage what you find?
Sort every name by who holds it and what its page does, never by how close it looks. A name that parks on an advertising page is a nuisance; a name that serves a copy of your login page is an incident.
- Free and valuable: register it for your brand. The method for choosing which ones is in how to build a defensive domain list.
- Held by a third party, parked: note the date and the registrar; watch it.
- Held by a third party, hostile: collect evidence and report it.
Register variants of your own name only. Wardmint does not register look-alikes of someone else's brand, and its acceptable-use policy forbids it.
Which extensions will your search results fill with?
The extensions with the most phishing domains are the ones your results will fill with. According to Wardmint's survey of 12 November 2026, of the 10 extensions with the most phishing domains in Interisle's data for 1 May 2025 to 30 April 2026 (.com, .top, .cn, .pro, .info, .xyz, .vip, .shop, .cc, .icu), Wardmint sells 6: .com, .pro, .info, .xyz, .shop and .icu. It does not sell .top, .cn, .vip or .cc.
A look-alike search of your name is a free check; owning the free variants is the cheap part. A core set of .com, .net, .org, .io, .xyz, .app costs $128.94 a year at Wardmint. Wardmint sells registrations, not monitoring or takedown: the tools above are the monitoring.
What is the short version?
dnstwist finds registered variants, crt.sh finds certificates and urlscan.io finds scanned pages. Together they list the look-alikes of your brand for free. Wardmint is the place to register the free variants for your own name, in a bulk search of up to 50 names.
Questions about finding look-alike domains
How often should I search for look-alike domains?
Weekly is a workable rhythm for a live token or app, and daily in the two weeks around a launch. The commands in this guide take minutes to run, and a saved JSON file from the previous run lets you compare for new names.
Is it safe to open a suspected phishing site?
Open it in a scanner such as urlscan.io, not in your own browser. The scan result shows the page and the domains it loads without your machine connecting to it.
Does dnstwist cost anything?
No. dnstwist is open source under the Apache-2.0 licence and free to run. The only costs are your time and the registrations you decide to make.
Can I register the look-alikes I find to stop them?
Only if they are variants of your own brand and still free. A name already held by someone else cannot be registered, and registering look-alikes of another brand is forbidden at Wardmint.
What if the look-alike is already live and hostile?
Collect evidence and follow the report a phishing domain guide. For a domain registered through Wardmint, action comes within 24 hours of a well-documented report.
In summary
- dnstwist --registered lists registered variants of your domain for free.
- crt.sh lists certificates containing your brand string, often before the site is live.
- urlscan.io shows pages already scanned, without you visiting the site.
- Sort results into yours, free to register and held by others.
- Wardmint sells 6 of the 10 extensions with the most phishing domains in Interisle's 2025-26 data.
- A core set of .com, .net, .org, .io, .xyz, .app costs $128.94 a year.
- Register your own variants only; never look-alikes of another brand.
Sources (8)
- dnstwist (README) — GitHub, elceef (read 2026-11-12)
- crt.sh certificate search — Sectigo (read 2026-11-12)
- urlscan.io search documentation — urlscan.io (read 2026-11-12)
- urlscan.io pricing — urlscan.io (read 2026-11-12)
- Phishing activity in TLDs, May 2025 to April 2026 — Cybercrime Information Center (Interisle data) (read 2026-11-12)
- Interisle Phishing Landscape 2025 press release — Interisle Consulting (read 2026-11-12)
- Crypto scams 2026: Chainalysis report — Chainalysis (read 2026-11-12)
- Front-end hijacking and the Web2 attack surface — Blockaid (read 2026-11-12)