How to Find Brand Lookalike Domains in Newly Registered Domains
Brand lookalike domains take two forms: misspellings of the brand's own domain, and new names that pair the brand with other words. A spelling-variant scan is built for the first form; the second turns up in a keyword search of newly registered domains. With Google as the example, this walkthrough runs both in DomainKits (the Typosquat Scanner, sorted by newest, and NRD Search), then checks what a new name points to and sets up alerts for the next ones.
Find new lookalike domains
Typosquat Scanner: new misspellings of the brand's domain
The Typosquat Scanner starts from a domain, here google.com. From that domain it generates spelling variants across the types in our guide to the 11 permutation types: a missing letter (gogle.com), swapped letters (googel.com), a look-alike character (g0ogle.com), an extra letter, a hyphen, another extension, and the rest. Beside each variant it lists whether the domain is registered, when it was registered, and how many extensions hold that same name.
The scan of google.com on 2 November 2026 checked 377 variants, of which 322 were registered. The familiar typos go back decades: gogle.com dates from 1998 and googel.com from 2001, and both use Google's own nameservers. Switching the sort to Newest brings recent registrations to the top. Twenty-one of the registered variants had 2026 creation dates, led by googlqe.com on 23 October, where the added q slips in beside the l.
Sorting by Newest turns the scanner into a quick check for fresh typos. Still, a lookalike such as verlfy-google.com, registered on 1 November, is not on the list: it spells "google" intact and alters the word next to it, "verify" with an l in place of the i. Names built around the intact brand are the job of a different feature, NRD Search, and the scanner results end with a link to it: "Search google in Newly Registered Domains".
NRD Search: new names built around the brand
NRD Search covers domains registered in the past 60 days and refreshes its index at about 15-minute intervals, so in most cases a new registration becomes searchable the same day. On 2 November 2026 the search for "google" returned 1,798 domains.
Reviewing a day's activity does not mean reading 1,798 rows. Setting Creation Date to 1 November narrowed the list to that day's 25 registrations. Among them were verlfy-google.com and googleplaystoreapps.com, while the 2 November registrations added web-meet-google.com, googleplaydeveloperpolicy.com and meet-google.top. Pairings like these are open-ended: the scanner's list includes some common ones, such as verifygoogle.com, but not verlfy-google.com or web-meet-google.com, while a keyword search surfaces them as soon as they enter the index.
When a day's list still holds batches or familiar terms, the remaining filters trim it down. In the 1 November results, several domains including kr-google.cyou and jp-google.cloud shared the same DNS provider; putting that host into the Nameserver filter groups the batch so you can review it at once. Exclude Keywords drops recurring terms you have already cleared, and Position and TLD focus the list when a pattern sits at the start or end of the domain or inside a single extension.
Automate both searches with Keyword Monitor
Each search has an automatic counterpart in DomainKits Keyword Monitor, which emails new matches as new registration data arrives.
For misspellings, the Typo registrations category does the work of the Typosquat Scanner. You enter a brand word of at least four characters, such as google, and the monitor generates its character-level variants and checks for exact-name matches across new registrations in gTLDs and ccTLDs. When matches turn up, the alert email reads, for example, "3 lookalikes of google were registered:" and lists up to 20 domains with direct links to their WHOIS records. A name such as googlqe.com arrives this way.
For names built around the brand, a keyword alert does the work of NRD Search: saving "google" as a keyword sends an email when new registrations containing it appear, such as verlfy-google.com. The two alerts cover different ground. The keyword alert misses googlqe.com, because the extra q breaks the word, and the typo alert matches whole names, not names with added words.
Check the lookalikes you find
Check what a new name points to
Once a name like verlfy-google.com stands out in the 1 November list, the next question is where it points. Each row in NRD Search and in the Typosquat Scanner has a Check button. Clicking it beside verlfy-google.com opens an inline panel with its WHOIS record (registrar, dates, status, nameservers) and DNS records (A, ASN, CNAME and MX), along with buttons for WHOIS Details, DNS Details, Same Nameservers and Add email alert. You can see whether a domain resolves or accepts mail without leaving the search results.
For threat lists and full record sets, the standalone tools go deeper. On 2 November the Safety Check reported no malware or phishing flags for verlfy-google.com and no pages in the search index. The DNS Check showed Cloudflare nameservers, IPv4 and IPv6 addresses, and no MX records: the domain resolved, but had no mail setup at that point.
Keep checking with Domain Monitor
A newly registered domain that has web resolution today can add mail records or content tomorrow. Phishing lookalikes in many cases follow that order, sitting idle while security filters still treat them as newly registered and adding MX records or a login page afterwards.
Instead of rechecking the name by hand, click Add email alert in the Check panel. That puts verlfy-google.com into Domain Monitor, which keeps watching it and sends an email when it changes in one of three ways (how Domain Monitor works):
- WHOIS: the registrar, nameservers or EPP status (for example clientHold or pendingDelete) change, or the domain comes within 30 days of expiry.
- Mail servers: MX hosts are added or removed.
- Certificates: new hostnames under the domain appear in newly issued certificates.
Summary
Each form of lookalike has its own place to look and its own alert:
| Lookalike form | Example | Find it in | Get alerted by |
|---|---|---|---|
| Misspelling of the brand's domain | googlqe.com | Typosquat Scanner, sorted by Newest | Typo registrations in Keyword Monitor |
| Brand next to other words | verlfy-google.com | NRD Search, filtered by Creation Date | Keyword email alert |
Once a name turns up, the Check panel, DNS Check and Safety Check show what it points to, and Domain Monitor emails later changes to its WHOIS, mail servers or certificates.
- Tool results: DomainKits Typosquat Scanner, NRD Search, Safety Check and DNS Check on 2 November 2026. Counts are as shown on that date and change as new registrations are indexed.
- Registration dates of the named domains checked against registry records.
Get new articles by email
No account needed. At most one email a day, only when there is something new.
We use your email only to send new articles. Every email has a one-click unsubscribe link. Privacy policy