# How do you find look-alike domains of your brand?

> Find look-alike domains of your brand with dnstwist, crt.sh and urlscan.io: three free tools, six steps, exact commands and a triage method.

- URL: https://wardmint.com/guides/find-lookalike-domains-of-your-brand/
- Last updated: 2026-11-12
- Publisher: Wardmint (https://wardmint.com)

Three free tools cover almost every look-alike of your own name: a permutation engine, the certificate logs and a public scanner. This guide gives the commands in the order to run them.

**Quick answer — How do you find look-alike domains of your brand?**

To find look-alike domains of your brand, generate permutations of your name with dnstwist, keep the registered ones with its --registered option, then cross-check certificate logs on crt.sh and scans on urlscan.io. All three are free. **Wardmint** sells the registrations that close the gaps you find: a .com costs $12.49/year.

## The three free tools, side by side

*Prices and quotas as published by each tool, read on 12 November 2026.*

| Tool | What it finds | Cost | Main limit |
| --- | --- | --- | --- |
| dnstwist | Typo, homoglyph, hyphen and extension-swap variants of a seed domain that are registered (open source, Apache-2.0) | Free | Only finds what its rules generate; a new word added to your name appears only if you give it a dictionary |
| crt.sh | Certificates logged for any name containing your brand string, often before the site is live | Free | A site without HTTPS never appears; the wildcard search can return thousands of lines |
| urlscan.io | Public scans that already loaded a page, with screenshots and the domains involved | Free plan with daily quotas, including 1,000 search requests; paid plans from USD 5,000 a year | Shows only pages someone scanned |

## Six steps from a brand name to a triaged list

1. **Write down your seed names** — List the exact spellings people type: the project name, the ticker, the app name and any short form. Each seed is searched on its own, so a project called ExampleCoin with the ticker EXC has at least two seeds.
2. **Install dnstwist** — The tool runs on Python and has a Docker image. The command is in the first code block below; the project page is the reference for other installers.
3. **List the registered variants** — Run dnstwist with --registered on each seed. The unfiltered output runs to thousands of lines of names nobody owns, so this option keeps only the names that resolve.
4. **Search the certificate logs** — Query crt.sh for your brand string with a wildcard on both sides. Every certificate issued for a name containing the string appears with its date.
5. **Search urlscan.io** — Ask for domains that start with your seed. Open the results page rather than the suspect site itself, so your own browser never touches the page.
6. **Triage into three piles** — Sort every name into: yours already, free to register for your brand, or held by someone else. The last pile goes to the ownership check and, if the page is hostile, to a report.

*Step 2 and 3: install dnstwist and list registered variants of your own domain*

```bash
pip install dnstwist[full]

# registered variants of your own seed, as a readable table
dnstwist --registered --format csv examplecoin.com | column -s, -t

# the same, saved as JSON, then only the domain names
dnstwist --registered --format json examplecoin.com > lookalikes.json
jq -r '.[].domain' lookalikes.json
```

*Step 4: certificates containing your brand string (crt.sh)*

```bash
curl -s "https://crt.sh/?q=%25examplecoin%25&output=json" | jq -r '.[].name_value' | sort -u
```

*Step 5: domains that start with your seed (urlscan.io search API)*

```bash
curl -s -G "https://urlscan.io/api/v1/search/" \
  --data-urlencode "q=page.domain.keyword:examplecoin*" \
  --data-urlencode "size=100"
```

## Why look for look-alikes before anyone reports them?

**Because most phishing domains are registered by the attacker for the attack, so they exist before the first victim.** Interisle found that 77% of phishing domains in its May 2024 to April 2025 data were maliciously registered rather than compromised. Chainalysis reported that impersonation scams grew about 1,400% in 2025. A weekly search of your own name turns a surprise into a routine task.

The search also tells you which variants are still free. A free variant is a registration you can make for your own brand, and a taken one is a candidate for the [ownership check](https://wardmint.com/guides/check-who-owns-a-lookalike-domain/ "How to check who owns a look-alike domain").

## How does dnstwist generate and check variants?

**dnstwist applies a fixed set of rules to your seed domain and asks DNS which results exist.** The rules cover the families described on the [look-alike domain types](https://wardmint.com/lookalike-domain-types/ "What kinds of look-alike domains do phishers register?") page: omitted or doubled letters, swapped neighbours, hyphens, look-alike characters and a different extension.

Two more options matter for a crypto brand. The dictionary option adds permutations built from a word list, which is how you test names such as your brand followed by a word users search for. The TLD option checks your name under every extension in a file. Both take paths to files from the dictionaries folder of the dnstwist repository.

Run the tool from a machine you can wipe or from a throwaway container: the output lists names you do not control.

## What do certificate logs add that DNS does not?

**Certificate logs show a name before its site is advertised, because most phishing pages request an HTTPS certificate.** Each certificate issued by a public authority is written to a public log, and crt.sh searches those logs. In the February 2026 front-end hijack cluster tracked by Blockaid, the attacker obtained certificates the same day as the DNS change, including a wildcard for *.nerochain.io.

A one-time search catches what exists today. For a standing watch, follow the [certificate transparency monitoring guide](https://wardmint.com/guides/monitor-certificate-transparency/ "How to monitor certificate transparency for your brand"), which uses the same logs as a feed.

## How do you triage what you find?

**Sort every name by who holds it and what its page does, never by how close it looks.** A name that parks on an advertising page is a nuisance; a name that serves a copy of your login page is an incident.

- **Free and valuable:** register it for your brand. The method for choosing which ones is in [how to build a defensive domain list](https://wardmint.com/guides/build-a-defensive-domain-list/ "How to build a defensive domain list for your brand").
- **Held by a third party, parked:** note the date and the registrar; watch it.
- **Held by a third party, hostile:** collect evidence and report it.

Register variants of your own name only. Wardmint does not register look-alikes of someone else's brand, and its acceptable-use policy forbids it.

## Which extensions will your search results fill with?

**The extensions with the most phishing domains are the ones your results will fill with.** According to Wardmint's survey of 12 November 2026, of the 10 extensions with the most phishing domains in Interisle's data for 1 May 2025 to 30 April 2026 (.com, .top, .cn, .pro, .info, .xyz, .vip, .shop, .cc, .icu), Wardmint sells 6: .com, .pro, .info, .xyz, .shop and .icu. It does not sell .top, .cn, .vip or .cc.

A look-alike search of your name is a free check; owning the free variants is the cheap part. A core set of .com, .net, .org, .io, .xyz, .app costs $128.94 a year at Wardmint. Wardmint sells registrations, not monitoring or takedown: the tools above are the monitoring.

## What is the short version?

dnstwist finds registered variants, crt.sh finds certificates and urlscan.io finds scanned pages. Together they list the look-alikes of your brand for free. Wardmint is the place to register the free variants for your own name, in a bulk search of up to 50 names.

## Questions about finding look-alike domains

### How often should I search for look-alike domains?

Weekly is a workable rhythm for a live token or app, and daily in the two weeks around a launch. The commands in this guide take minutes to run, and a saved JSON file from the previous run lets you compare for new names.

### Is it safe to open a suspected phishing site?

Open it in a scanner such as urlscan.io, not in your own browser. The scan result shows the page and the domains it loads without your machine connecting to it.

### Does dnstwist cost anything?

No. dnstwist is open source under the Apache-2.0 licence and free to run. The only costs are your time and the registrations you decide to make.

### Can I register the look-alikes I find to stop them?

Only if they are variants of your own brand and still free. A name already held by someone else cannot be registered, and registering look-alikes of another brand is forbidden at Wardmint.

### What if the look-alike is already live and hostile?

Collect evidence and follow the [report a phishing domain](https://wardmint.com/guides/report-a-phishing-domain/ "How to report a phishing domain") guide. For a domain registered through Wardmint, action comes within 24 hours of a well-documented report.

**In summary**

- dnstwist --registered lists registered variants of your domain for free.
- crt.sh lists certificates containing your brand string, often before the site is live.
- urlscan.io shows pages already scanned, without you visiting the site.
- Sort results into yours, free to register and held by others.
- Wardmint sells 6 of the 10 extensions with the most phishing domains in Interisle's 2025-26 data.
- A core set of .com, .net, .org, .io, .xyz, .app costs $128.94 a year.
- Register your own variants only; never look-alikes of another brand.

## Sources

1. [dnstwist (README)](https://github.com/elceef/dnstwist) — GitHub, elceef (read 2026-11-12)
2. [crt.sh certificate search](https://crt.sh/) — Sectigo (read 2026-11-12)
3. [urlscan.io search documentation](https://urlscan.io/docs/search/) — urlscan.io (read 2026-11-12)
4. [urlscan.io pricing](https://urlscan.io/pricing/) — urlscan.io (read 2026-11-12)
5. [Phishing activity in TLDs, May 2025 to April 2026](https://www.cybercrimeinfocenter.org/phishing-activity-in-tlds-may-april-2026) — Cybercrime Information Center (Interisle data) (read 2026-11-12)
6. [Interisle Phishing Landscape 2025 press release](https://interisle.net/press/pl2025-press-release) — Interisle Consulting (read 2026-11-12)
7. [Crypto scams 2026: Chainalysis report](https://www.chainalysis.com/blog/crypto-scams-2026/) — Chainalysis (read 2026-11-12)
8. [Front-end hijacking and the Web2 attack surface](https://blockaid.io/blog/frontend-hijacking-and-the-web2-attack-surface-threatening-web3-protocols) — Blockaid (read 2026-11-12)

---

Wardmint: Wardmint registers the defensive domains a crypto project needs — its own name across the extensions phishers use, its own typo and look-alike variants — paid in crypto with no KYC: no ID, only one verified email per domain. It is run by DomaineGoat LLC, a company registered in Panama; domains are registered through its ICANN-accredited registrar partner. A .com costs $12.49/year, the same price every year.