Lookalike scan → case starter
Two steps toward a result: (1) a free baseline of string-distance lookalikes for your brand domain, (2) triage a suspect URL into evidence-starter notes you can paste into an abuse pack. This is not a visual-clone monitoring shovel — unrelated hostnames that copy your login page will not show up in step 1.
Read why: DNSTwist is not enough · Cloudflare proxy cases: wrong door?
1. Baseline lookalikes
Client-side permutations only (omission, swap, affix, TLD swap, light homoglyph). No live DNS crawl. Treat hits as candidates to verify, not confirmed phishing.
2. Suspect URL → evidence starter
Answer a few questions. We generate paste-ready notes for your registrar pack — the artifact buyers actually need.
Open evidence pack builder Open full evidence pack guide Download .md template