OpenBait Lookalike Domains

npx add-mcp 'https://openbait.com/api/mcp'

Typosquat domain checker

What is typosquatting?

Typosquatting is a form of brand abuse where attackers register lookalikes of a legitimate domain like example.com, such as examp1e.com, еxample.com (Cyrillic `е`), or example.co, and then use them for phishing, credential theft, or fake payment pages. Unlike a short-lived phishing page, a typosquat domain can last a long time. Once registered, it may sit idle with no DNS for weeks or months before the attacker switches it on.

How this check works

1. Candidate names — your brand plus common words, on your domain's ending (or on.com for endings like.co.jp). For most longer brand names we add the names clone stores register on.shop. It's a fixed list of guesses, not a search of every misspelling.
2. Front-page check — for each name that is set up in DNS, we open the front page and check whether its title carries the brand name. We read only the title at the top of the page; we don't take screenshots or store the page.
3. Grouping — results are split into sites with the brand name in the title, names that forward to your site, sites without the brand name, and names with no site. The grouping is mechanical; it isn't a verdict on whether a site is fake.
4. After this check — it runs once. A free account checks names like these every 3 days, looks through newly registered domains for names like yours every day, and emails you when AI finds a likely fake.

Frequently asked questions

Is this tool really free?

Yes. No sign-up and no credit card. A free account goes further: it looks through newly registered domains for names like yours every day, emails you when AI finds a likely fake, and reports up to 3 confirmed fakes a month to browser warning lists. The scan pauses if no one opens the dashboard for 14 days. Getting the site itself taken down is paid: $199 per site, paid once, or a monthly plan (Pro, up to 3 a month for $299; Business, up to 10 a month for $499).

Do you store the domains I enter?

Your input is used only to build the candidate names for this request. It isn't written to our database and isn't shared with advertising or third-party analytics. The result, including each site's page title, stays in a temporary cache for up to 6 hours so a repeat lookup is quicker. We don't store page content or take screenshots.

A site is tagged “Brand name in title.” Is it a fake site?

Not on its own. The tool opens each site's front page and checks whether its title (or og:site_name) carries the brand name. It doesn't look at the rest of the page or what's for sale, so the site may be yours, a reseller's, a partner's, or a business with a similar name. When you ask us to take one down, we check the site ourselves before we file anything.

Can I scan a subdomain, like id.example.com?

You can type one, but the check runs on the registered domain: id.example.com is checked as example.com, and we don't keep the subdomain in the names we try.

Found a fake copy of your site? Get it taken down.

Start for free

Going deeper

• Typosquat detection: 5 methods and their trade-offs — including what happened when we audited 100 of our own high-scoring candidates
• What registrars did with our phishing domain reports
• How a report becomes a takedown