Generate the typo and homoglyph variants attackers use to spoof a domain. Awareness, not impersonation.
Enter a domain you defend, not one you want to impersonate. Educational use only.
All calculations happen in your browser. We don’t store inputs.
A domain you defend (your company, a vendor, an executive’s personal domain).
Standard typo families generated in your browser: omission, insertion, substitution, transposition, "rn" vs "m" and "vv" vs "w" multi-char swaps, single-character Cyrillic homoglyph substitutions, and a TLD swap pass.
A defensible watchlist for your monitoring stack, an SOC playbook input, or a UDRP-readiness list.
You can filter the result by category to focus on what your monitoring tooling actually checks.
No request leaves your browser. The whole list is generated and filtered locally.
A list you can copy out and feed into a domain monitor (DomainTools, Whoxy, your registrar’s typo-watch).
Use this defensively. Do not register variants for impersonation.
A short list of registered variants you find in the wild is a strong UDRP filing input; an unregistered list is a defensive registration shopping list.
Better protection against the targeted spear-phishing patterns the FBI catalogs in BEC reports.
This is awareness, not detection. The generator produces the families of variants that show up in real spear-phishing campaigns, but the universe of possible lookalikes is larger than what fits in a 1,000-row table. We do not check whether each variant is registered, who owns it, or whether it is currently sending mail. For that, pair the output with whois lookups, passive DNS, and a paid monitoring service. The Cyrillic homoglyph pass shows the most common single-character swaps; an attacker can chain multiple swaps or use Greek, Armenian, or Latin Extended characters that this list does not enumerate. Use the result as a starting watchlist, not a finished defense.
Once you suspect a lookalike, paste the header and see what authentication says.
Check whether the lookalike domain has authentication set up; many do not.
Why a single TLD swap is one of the most successful spear-phishing patterns of the last decade.
The class of phishing that hides behind a domain you almost recognize.
Where a guest list plus a cover charge add structural friction to fresh-domain impersonations.
Rythm is the inbox protection that powers this estimate. $1.65 per month. Cancel anytime.
Annual on Lightning includes one bonus month. See full pricing.
