Somebody may already own the misspellings of your domain. Finding out takes about ten minutes and needs nothing you do not already have.

Here is the procedure, and what it found when we ran it on our own domain.

What you are looking for

A lookalike domain is one a reader could mistake for yours: a doubled letter, a missing one, a neighbouring key, a zero where an O should be. The question is not whether such names could exist — they always could. It is which ones already have an owner.

DNS answers that, and it answers for free.

The procedure

  1. Generate the space by rule, not by imagination. Take your domain's label — the part before the dot — and at each character position, try five edits: substitute a visually similar character (0 for o, 1 for l, 3 for e), press a neighbouring key, delete the character, double it, or swap it with the one next to it. Guessing produces the variants you happen to think of; a rule produces the ones you would not.

  2. Ask DNS which of them are delegated. For each variant, request its NS record. A name with nameservers is registered and pointed somewhere. A name with none is, for practical purposes, still free. Our DNS lookup tool does one at a time, which is enough to spot-check a handful.

  3. Ask which of them actually answer. Request the A record too. Delegated but not resolving means somebody holds the name and is not using it yet. Delegated and resolving means there is something at the other end.

  4. Read the nameservers, because they say who is holding it. Nameservers belonging to a registrar or a domain marketplace usually mean the name is parked or for sale. Nameservers belonging to a hosting provider mean something is running there.

  5. Run the controls before you believe any of it. Look up a domain you know exists and one you know does not. If the first fails, your DNS is not working and every "free" result is an illusion of your own network.

What it returned for us

Our label generates 58 distinct variants under those rules. 6 of them are delegated and resolving — 10.3 per cent of the space around a site most people have never heard of.

They are ecatools.com, reatools.com, rectools.com, redatools.com, revatools.com and rexatools.com. Not one of them answers on our own addresses, so none is a defensive registration of ours.

Five of the six use nameservers from registrars or a domain marketplace, which usually indicates a parked or for-sale name. The DNS record shows occupancy, not intent.

A measurement of lookalike domain occupancy computed from DNS. The label recatools generates 58 variants under five edit rules, of which 6 are delegated and resolving — 10.3 per cent — and none resolve to our own addresses. Across ten well-known consumer brand labels, 286 of 366 generated variants are delegated, 78.1 per cent, with a spread from 40 per cent to 97.7 per cent and a median of 85.1. A control using invented labels nobody would squat shows that length matters too: at nine and eight characters none of the variants are taken, at seven characters 11.1 per cent are, and at five characters 33.3 per cent are. At matched length the real brands run far higher than the invented labels, so fame and not only brevity drives the occupancy.
Ours against ten well-known brands, with invented labels controlling for the fact that short names get taken anyway.

How much worse it gets with a name people know

We ran the same generator over ten widely known consumer brand labels. Across 366 generated variants, 286 are delegated — 78.1 per cent.

This is not one outlier dragging up the average; individual brand rates run from 40 per cent to 97.7 per cent, with a median of 85.1. For a name enough people type from memory, the confusable space is essentially fully occupied.

We are not publishing which brands, or which variants of them are live. The counts make the point; a list would just be a directory.

The check that nearly changed the answer

The obvious reading of 10.3 against 78.1 is that fame attracts squatters. Before writing that down we tested whether it was really about length, because our label is nine characters and several of the brands are four or five, and short domains are valuable to anybody.

So we ran the generator over invented labels nobody would squat. For the nine- and eight-character labels, 0 per cent of variants were taken. That rose to 11.1 per cent at seven characters and 33.3 per cent at five.

Brevity alone does attract registration, and a naive comparison would have credited fame with some of what is really just shortness. But the effect does not survive at matched length: at seven characters the invented labels sit at 11.1 per cent while real brands of the same length run between 68.9 and 97.7. Fame dominates. But it is not the whole story, and we would have said something slightly false without that control.

What this does not tell you

A registered lookalike is not evidence of anything being done to you. It may be a defensive registration by someone else, a speculator waiting for an offer, a marketplace listing, or a business that got there first with a name that happens to be near yours. DNS records occupancy. Intent is not in them and we are not inferring it.

The occupancy figures are also a floor rather than a measurement of the whole risk. Our check was limited to .com, to single-character edits, and to the specific substitutions this one generator produces. Every other suffix, every longer edit, and the mixed-script homoglyphs that render identically in some fonts are all outside the count.

And delegation stands in for registration here. A registered name with no nameservers reads as free to this method, so any error runs in one direction — undercounting.

What to do with the answer

If the space around your name is mostly empty, you have learned that cheaply and you can stop. If several are taken and resolving, the useful next step is to look at what they serve — a parked page is a different problem from a copy of your login form.

The defence is rarely to buy them all. For a nine-character label that is 58 registrations against an unbounded space, and for a well-known brand it is a permanent budget line. What is worthwhile is knowing which lookalikes exist and checking any that resolve. You should also make your real domain easy to verify. A published DMARC policy helps block forged senders, and an organisation-validated certificate proves who you are, which is what the padlock is supposed to do — and why a lookalike can get a basic one in minutes.

Those two do not stop a lookalike existing. They make it harder for one to be mistaken for you, which is the part you control.

Sources
  • Every figure is produced by a script committed alongside this guide: five deterministic edit rules per character, then a DNS NS and A lookup for each variant. Registration is inferred from delegation and reachability from an A record. The script re-runs in full, so these numbers can be checked rather than trusted.
  • ⚠️ NOTHING WAS ATTACKED AND NO PERSON WAS INVOLVED. These are ordinary DNS lookups, the same queries a browser makes. No mail was sent, no lookalike site was fetched, and no registrant was contacted.
  • ⚠️ A REGISTERED LOOKALIKE IS NOT A MALICIOUS ONE, and nothing here should be read as accusing anybody. A resolving variant may be defensive, parked, listed for sale, or an unrelated business. DNS proves occupancy; intent is not in the record and is not claimed.
  • ⚠️ THIRD-PARTY BRANDS ARE REPORTED IN AGGREGATE ONLY — counts, a spread and a median, never a per-brand result and never a live variant — so this guide cannot serve as a directory of lookalike domains.
  • ⚠️ THE LENGTH CONFOUND IS REAL AND WAS CONTROLLED FOR, and without the control this guide would have overstated its own headline. Invented labels of the same lengths show that short names attract registration regardless of fame: 0 per cent at nine and eight characters, 11.1 at seven, 33.3 at five. The brand effect survives at matched length, which is the only reason the comparison is made at all.
  • ⚠️ EVERY OCCUPANCY FIGURE IS A FLOOR. Only .com, only single-character edits, only this generator's substitutions. Other suffixes, longer edits and mixed-script homoglyphs are outside it, and delegation standing in for registration undercounts rather than over.
  • ⚠️ DNS IS LIVE DATA AND THESE COUNTS MOVE. A name lapses or is bought between one run and the next; the comparison total shifted by one variant between two runs while this guide was being written. The committed guard re-runs the measurement rather than reading a stored copy, so the guide goes red when the space has genuinely changed.

This describes a public DNS measurement of domain-name occupancy and how to repeat it. It is not a security assessment of any organisation, not an accusation against any registrant, and not legal advice about trademarks or domain disputes.