{"uid":"cap_fkteo4aWysLbIhNFUM6s_","slug":"sitecheck-typosquat-phishing-domain-radar-c08e79e4","name":"SiteCheck Typosquat & Phishing Domain Radar","description":"For a brand domain (e.g. paypal.com), builds up to 15 look-alike variants (omitted, doubled and swapped letters, 0/1 homoglyphs, hyphen and login additions, other TLDs) and checks which are registered, using the public RDAP directory. Registered means taken, not malicious: each one needs a content check. Unicode homoglyphs (IDN) are not generated.","url":"https://api.fadeandco.workers.dev/api/agent-intel/typosquat-phishing-domain-radar?utm_source=zero.xyz","method":"GET","headers":{},"bodySchema":{"type":"object","$schema":"https://json-schema.org/draft/2020-12/schema","required":["input"],"properties":{"input":{"type":"object","required":["type","method"],"properties":{"type":{"type":"string","const":"http"},"method":{"enum":["GET"],"type":"string"},"queryParams":{"type":"object","required":["brand"],"properties":{"brand":{"type":"string","description":"Brand domain such as paypal.com (a URL is reduced to its host)"}}}},"additionalProperties":false},"output":{"type":"object","required":["type"],"properties":{"type":{"type":"string"},"example":{"type":"object"}}}}},"responseSchema":{"type":"json","example":{"note":"Registered is not proof of phishing; many are defensive or parked. Unknown means the directory did not answer.","brand":"paypal.com","source":"https://rdap.org/domain/","checked":15,"results":[{"state":"registered","domain":"paypa1.com"},{"state":"registered","domain":"p4ypal.com"}],"checkedAt":"2026-10-23T09:35:22.654Z","registered":["paypa1.com","p4ypal.com"],"unknownCount":5,"registeredCount":10}},"example":null,"exampleRequest":null,"tags":["x402"],"displayCostAmount":"0.002","displayCostAsset":"USDC","priceDynamic":false,"priceHint":null,"priceStatus":"priced","priceSource":"probe","requiresHandshake":false,"reviewCount":0,"rating":{"score":"0.00","successRate":"0.00","reviews":0,"stars":null,"state":"unrated"},"availabilityStatus":"unknown","priceObserved":null,"sessionDeposit":null,"pricing":{"kind":"static","summary":"$0.002/call","primary":{"kind":"static","protocol":"x402","network":"base","amountUsd":"0.002","per":"call","confidence":"exact"},"accepted":[{"kind":"static","protocol":"x402","network":"base","amountUsd":"0.002","per":"call","confidence":"exact"}]},"paymentMethods":[{"uid":"pm_4M5NoaHsag67k8dh0yuEG","protocol":"x402","methodType":"crypto","chain":"base","mode":"charge","costAmount":"0.002","costPer":"request","priority":0,"asset":"0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913","unit":"request","depositMicros":null,"planRef":null}],"brandName":null,"brandSlug":null,"brandBaseUrl":null,"brandDocsUrl":null,"whatItDoes":"Generates up to 15 typosquat variants of a brand domain and checks each against the public RDAP directory to identify which are registered","exampleAgentPrompt":"Can you check if anyone has registered typosquat or look-alike domains for stripe.com — I want to know which fake variants are already taken that could be used to phish our customers?","exampleUseCases":[{"title":"Brand protection audit before launch","prompt":"We're about to launch our new brand under acmecorp.com — can you check how many typosquat variants of acmecorp.com are already registered? I want to know which look-alike domains we should defensively register or watch."},{"title":"Phishing threat assessment for security team","prompt":"Our security team suspects someone is setting up phishing sites against us. Can you scan for registered typosquat variants of robinhood.com so I can investigate which domains might be impersonating us?"},{"title":"Client domain monitoring for an MSP","prompt":"I manage cybersecurity for a client using the domain firstnationalbank.com — can you pull up all the registered look-alike variants of that domain so we can flag anything suspicious for their security report?"}],"resultDescription":"Returns a JSON object with the brand domain checked, the total number of variants checked (up to 15), an array of result objects each with a domain and its registration state ('registered', 'unregistered', or 'unknown'), a list of registered domains, counts of registered and unknown domains, the timestamp of the check, and a note clarifying that registered does not imply malicious intent.","failureModes":["RDAP directory may not respond for some TLDs, resulting in 'unknown' states rather than definitive answers","Only up to 15 variants are generated, so coverage is not exhaustive","Unicode/IDN homoglyph variants are not generated, leaving a gap in homoglyph detection","Registered domains are not content-checked, so malicious vs defensive registration is not determined","Brand domain parsing may strip a full URL to its host, which could cause unexpected behavior if input is malformed"],"whenToPreferThis":"Choose this endpoint when you need a fast, lightweight check of whether common typosquat variants of a brand domain are registered, using only the public RDAP directory with no authentication required. It is ideal for brand protection audits, pre-launch domain sweeps, or security triage workflows where you want a quick enumeration of at-risk domains. It does not perform content analysis or IDN homoglyph generation, so pair it with a content-checking tool for deeper phishing confirmation.","instructions":null,"reviewSummary":null,"reviewSummaryHighlights":null,"reviewSummaryConcerns":null,"reviewSummaryGeneratedAt":null,"activationCount":0,"lastUsedAt":null,"lastSuccessfullyRanAt":null,"lastHealthCheckAt":"2026-10-30T00:21:56.577Z","isFirstParty":false,"canonicalSlug":"sitecheck-typosquat-phishing-domain-radar-c08e79e4"}