For the complete site index, see llms.txt. Docs index: llms-docs.txt. Marketing corpus: llms-full.txt. Docs corpus: llms-full-docs.txt. Prefer markdown URLs where available (append .md).. Product skill: skill.md. Pricing: pricing.md. Docs MCP: /docs/mcp. Site MCP: /mcp.

Phishing Twin & Mail-Ready Scanner

Lookalike Domain Watch

Check whether someone has registered domains that look like yours (e.g. acme-login.com or acme.co) and whether those lookalikes have active mail servers configured to send email.

Try Presets:

We generate bounded candidate permutations (TLDs, typos, affixes, homoglyphs) and query public DNS. We never send test emails or scrape WHOIS.

The attack people actually hit in the real world.

Phishers rarely spoof exact domains once DMARC is locked. Instead, they register lookalikes that your staff and customers mistake for you.

Worked Example

From: support@acme-login.com

Recipient receives an urgent email with your logo asking to “Verify payroll credentials.” The user glances at the word “acme” and clicks. Even with p=reject on acme.com, this email lands in the inbox because acme-login.com is a completely separate registered domain.

✓ DMARC on acme.com: PASS
✗ Blocked by acme.com DMARC? NO
• Registered owner: Attacker
Hyphen / Service Affix

acme-login.com or support-acme.com

Attackers add trusted words ('login', 'verify', 'sso', 'support') with hyphens to trick users into trusting a completely separate domain.

Alternative TLD Swap

acme.co, acme.app, or acme.io

Registering your brand name under a different top-level domain. Users rarely inspect the suffix when receiving urgent messages.

Visual Typo / Omission

accme.com or ame.com

Fat-finger typos, dropped letters, or adjacent character swaps that look identical at a quick glance in mobile inboxes.

Homoglyphs & Character Tricks

acrne.com (rn looks like m) or IDN punycode

Replacing letters with visually indistinguishable latin or cyrillic characters (such as rn for m, or 1 for l).

Why checking for lookalike twins matters.

Mailboxes do not flag lookalike domains automatically unless they are reported. An active twin with MX or SPF records is an active attack risk.

Staff do not read full hostnames

Recipients scan names quickly on mobile screens. A message from support@acme-sso.com looks genuine enough to fool busy employees into sharing passwords.

DMARC enforcement shifts the attack

Once you publish p=reject on your real domain, attackers stop raw spoofing and switch directly to registering lookalike domains with active mail servers.

MX/SPF twins can send mail

A parked lookalike domain with no DNS records is benign. A lookalike with MX exchanges or SPF includes is configured to send convincing email.

How we know without attacking anyone.

We do not scrape private registrar databases, send test emails, or abuse third-party networks.

Bounded Permutation Engine

We generate a deterministic set of ~65 candidate variations across popular alternative TLDs, common typos, prefix hyphens, and IDN homoglyphs.

Read-Only Public DNS Queries

We query standard NS, A, MX, and TXT (SPF) records from authoritative root nameservers. No probing, hacking, or web crawling.

Mail-Capable Verification

A candidate is classified as mail-ready if it publishes valid MX mail exchangers or SPF authorization strings in public DNS.

What we are not claiming.

Honest security visibility. Understanding the boundaries of a public lookalike scan.

Not every possible phish on the internet

Permutations are infinite. A clean scan means no common variations were found, not that nobody can ever register a new one.

Registered does not mean they emailed your customers today

A registered lookalike might be held by a domain squatter or competitor. It indicates sending capability, not proof of active fraud.

Not a takedown or Google Safe Browsing report

This tool provides diagnostic visibility. Domain takedowns require filing registrar abuse complaints or ICANN UDRP disputes.

What you can actually do.

You cannot prevent the world from registering domain names. Here is the realistic, ordered playbook for brand protection.

1

Lock your authentic domain with DMARC p=reject

Check DMARC →

Ensure your legitimate domain cannot be spoofed. While DMARC on acme.com cannot stop acme-login.com, it ensures that your authentic emails are cryptographically verified and distinguishable.

2

Audit mail-capable twins as high priority

Lookalikes with active MX records or SPF configurations can send and receive email right now. These pose an active risk of CEO fraud, invoice scamming, and credential theft.

3

Register critical defensive variants

If budget permits, defensively purchase primary alternative TLDs (e.g. yourbrand.co) and common portal prefixes (e.g. yourbrand-login.com). Park them with null SPF ('v=spf1 -all').

4

Train staff & customers on full domain inspection

Educate employees to inspect the full root domain before clicking SSO or payment links. Remember: mail.acme.com is a valid subdomain, but acme-login.com is a separate entity.

5

Send only from Reloop on your verified domain

Get Started Free →

Authenticate all transactional and marketing emails via Reloop's developer infrastructure to maintain pristine domain reputation and brand trust.

Automate lookalike domain checks via API.

Integrate automated lookalike candidate scanning into your security monitoring dashboards or customer onboarding pipelines.

1

Install the Node.js package

npm install reloop-email
2

Scan lookalike permutations with Node.js

check_lookalikes.ts
1import Reloop from 'reloop-email';
2

3const reloop = new Reloop(process.env.RELOOP_API_KEY);
4

5const report = await reloop.tools.lookalikeWatch({
6  domain: 'stripe.com',
7});
8

9console.log(`Verdict: ${report.verdict}`);
10console.log(`Detected ${report.hits.length} active lookalike domains`);
11for (const hit of report.hits) {
12  console.log(`- ${hit.name} (Mail Capable: ${hit.mailCapable})`);
13}
3

Inspect JSON lookalike scan report (200 OK)

response.json
1{
2  "domain": "stripe.com",
3  "registrableDomain": "stripe.com",
4  "resolvedAt": "2026-09-01T12:00:00.000Z",
5  "responseTimeMs": 380,
6  "verdict": "mail_twins",
7  "headline": "Lookalikes can send mail that looks like you",
8  "summary": "3 lookalike domain(s) have active MX or SPF records configured and can send mail. DMARC on stripe.com cannot stop emails sent from these separate domains.",
9  "disclaimer": "This is a finite public-DNS scan of common permutations, not every possible lookalike on the internet or proof of an active attack.",
10  "scanned": 65,
11  "hits": [
12    {
13      "name": "stripe-login.com",
14      "unicodeName": null,
15      "trick": "affix",
16      "registered": true,
17      "mailCapable": true,
18      "mx": true,
19      "spf": true
20    },
21    {
22      "name": "stripe.co",
23      "unicodeName": null,
24      "trick": "tld",
25      "registered": true,
26      "mailCapable": true,
27      "mx": true,
28      "spf": false
29    },
30    {
31      "name": "stripe.io",
32      "unicodeName": null,
33      "trick": "tld",
34      "registered": true,
35      "mailCapable": false,
36      "mx": false,
37      "spf": false
38    }
39  ],
40  "nextStep": {
41    "title": "Enforce DMARC & monitor lookalikes",
42    "body": "Enforce p=reject on stripe.com in Reloop so authentic mail is recognizable, and consider defensive registrations for critical service prefixes.",
43    "href": "/dashboard/signup"
44  }
45}

Frequently asked questions.

Everything you need to know about lookalike domains, typosquatting, MX records, and email brand protection.

Ship your first email in minutes

Open-source, deliverability-focused, and yours to self-host or run on Reloop Cloud. No lock-in, no rewrite later.

Get started freeDocumentation
Reloop