{"uid":"cap_x4gfoiJdqbV78didKN5O5","slug":"sitecheck-domain-typosquat-checker-50533f2a","name":"SiteCheck Domain Typosquat Checker","description":"Generates lookalike domains of a brand (omission, transposition, repetition, bit-flip, homoglyph, vowel swap, hyphenation, TLD swap; technique list after dnstwist), checks up to 30 of them in DNS (A records), and reads MX records for up to 8 that resolve. Resolving in DNS is not proof of registration or abuse.","url":"https://api.sitecheck-api.workers.dev/api/domain/typosquat?utm_source=zero.xyz","method":"GET","headers":{},"bodySchema":{"type":"object","$schema":"https://json-schema.org/draft/2020-12/schema","required":["input"],"properties":{"input":{"type":"object","required":["type","method"],"properties":{"type":{"type":"string","const":"http"},"method":{"enum":["GET"],"type":"string"},"queryParams":{"type":"object","required":["domain"],"properties":{"limit":{"type":"string","description":"Variants to look up in DNS, 1-40 (default 40)"},"domain":{"type":"string","description":"Brand domain, e.g. example.com (a host name with a dot, no scheme or path)"}}}},"additionalProperties":false},"output":{"type":"object","required":["type"],"properties":{"type":{"type":"string"},"example":{"type":"object"}}}}},"responseSchema":{"type":"json","example":{"note":"DNS only: a name that resolves may be parked, not malicious; a name that does not resolve may still be registered. MX lookups limited to 9 domains per call.","domain":"example.com","looked":40,"source":"Variant techniques after dnstwist (github.com/elceef/dnstwist); DNS answers via Cloudflare DNS over HTTPS (cloudflare-dns.com)","checkedAt":"2026-10-15T19:15:18.095Z","resolving":25,"registered":[{"a":["104.20.21.8","172.66.175.59"],"mx":[],"domain":"example.net","nullMx":true,"technique":"tld-swap"},{"a":["172.66.157.237","104.20.26.136"],"mx":[],"domain":"example.org","nullMx":true,"technique":"tld-swap"},{"a":["172.67.143.199","104.21.39.76"],"mx":["route2.mx.cloudflare.net","route3.mx.cloudflare.net","route1.mx.cloudflare.net"],"domain":"example.co","nullMx":false,"technique":"tld-swap"}],"unresolved":0,"variantsGenerated":66}},"example":null,"exampleRequest":null,"tags":["x402"],"displayCostAmount":"0.002","displayCostAsset":"USDC","priceDynamic":false,"priceHint":null,"priceStatus":"priced","priceSource":"probe","requiresHandshake":false,"reviewCount":0,"rating":{"score":"0.00","successRate":"0.00","reviews":0,"stars":null,"state":"unrated"},"availabilityStatus":"unknown","priceObserved":null,"sessionDeposit":null,"pricing":{"kind":"static","summary":"$0.002/call","primary":{"kind":"static","protocol":"x402","network":"base","amountUsd":"0.002","per":"call","confidence":"exact"},"accepted":[{"kind":"static","protocol":"x402","network":"base","amountUsd":"0.002","per":"call","confidence":"exact"}]},"paymentMethods":[{"uid":"pm_nhEFc2B3xfmOplU7IAqxc","protocol":"x402","methodType":"crypto","chain":"base","mode":"charge","costAmount":"0.002","costPer":"request","priority":0,"asset":"0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913","unit":"request","depositMicros":null,"planRef":null}],"brandName":null,"brandSlug":null,"brandBaseUrl":null,"brandDocsUrl":null,"whatItDoes":"Generates typosquat variants of a brand domain and checks which ones resolve in DNS, revealing potentially malicious or squatted lookalike domains.","exampleAgentPrompt":"Check for typosquat domains impersonating acme-corp.com — scan up to 30 variants and show me which ones are resolving in DNS so I can identify potential phishing threats.","exampleUseCases":[{"title":"Brand phishing threat detection","prompt":"Can you scan for lookalike domains that could be impersonating our company brand at stripe.com? Show me all the variants that are actually resolving so our security team can investigate them."},{"title":"Pre-launch domain squatting audit","prompt":"We're about to launch our new product at newproduct.io — can you check if any typosquat or TLD-swap variants of that domain are already registered and resolving? I want to catch squatters before we go public."},{"title":"Competitive intelligence on domain threats","prompt":"Run a typosquat check on coinbase.com with up to 40 variants and tell me which ones have MX records set up — I want to know if any lookalike domains could be used for email phishing."}],"resultDescription":"Returns a JSON object with: the input domain, number of variants looked up and generated, timestamp, a list of registered/resolving domains (each with A records, MX records, nullMx flag, and the typosquat technique used such as tld-swap or homoglyph), count of resolving and unregistered variants, and attribution to the dnstwist technique library and Cloudflare DoH resolver.","failureModes":["Missing required 'domain' query parameter returns an error","Domain without a dot (no TLD) is invalid and may return an error or empty results","Limit parameter outside 1-40 range may be clamped or rejected","Domains with unusual TLDs may produce fewer variants","MX lookups are capped at 9 domains per call so large result sets have incomplete MX data","DNS resolution may show false negatives for domains registered but not yet propagated","Parked or sinkholed domains resolve but are not necessarily malicious — endpoint notes this explicitly"],"whenToPreferThis":"Use this endpoint when you need to enumerate and DNS-validate typosquat lookalike domains for a specific brand domain. It is purpose-built for brand protection, phishing detection, and domain threat intelligence. Prefer this over a generic WHOIS or RDAP lookup when you need bulk variant generation and live DNS resolution in one call. It uses dnstwist-style techniques (TLD swaps, homoglyphs, character insertions/deletions) which cover far more attack surface than manual checks.","instructions":null,"reviewSummary":null,"reviewSummaryHighlights":null,"reviewSummaryConcerns":null,"reviewSummaryGeneratedAt":null,"activationCount":0,"lastUsedAt":null,"lastSuccessfullyRanAt":null,"lastHealthCheckAt":"2026-10-20T12:44:08.197Z","isFirstParty":false,"canonicalSlug":"sitecheck-domain-typosquat-checker-50533f2a"}