Detect typosquatting and phishing domains as part of suspicious bulk registrations

Typosquatting Data Feed enables users to keep tabs on all suspiciously similar domain names possibly used in typosquatting/phishing campaigns and registered on a given day, week, or month. The Enriched database version also lets you access the groups of detected domains with their corresponding WHOIS data.

Request a Quote Download samples

Easily detect all typosquatting domain names as soon as they are registered each day

10,000+ Domains added daily

250,000+Newly registered domains monitored daily

60%+Cyber 150 in key categories trust us

52,000+Satisfied customers

Typosquatting Detection Feed Free Download

Explore a 5-day rolling sample of 1,000 recently observed look-alike domains to evaluate coverage and freshness. Contact us for full access to complete domain intelligence feeds.

Typosquatting Domain List	Sample count	Creation Date	Access
12 Nov, 2025 (Domains only, no WHOIS data)	1,000	12 Nov, 2025	Download
11 Nov, 2025 (Domains only, no WHOIS data)	1,000	11 Nov, 2025	Download
10 Nov, 2025 (Domains only, no WHOIS data)	1,000	10 Nov, 2025	Download
09 Nov, 2025 (Domains only, no WHOIS data)	1,000	09 Nov, 2025	Download
08 Nov, 2025 (Domains only, no WHOIS data)	1,000	08 Nov, 2025	Download

Benefits

Comprehensive in nature

Stay on top of all domains with telltale signs of typosquatting, phishing, and other forms of suspicious bulk registrations. Our feed gives a thorough daily, weekly, or monthly overview of all suspicious domain variants among all newly registered domains in our database.
Investigate without an initial clue

No user input or initial clue is required to return groups of new domain name registrations that may be involved in typosquatting attacks and other brand misrepresentations.
Meaningful analysis

With Typosquatting Data Feed, users can focus their attention directly on the most likely instances of domain typosquatting without having to spend time or effort screening all WHOIS registration data.
Early detection near-real time

Groups of possible typosquatted domains are identified on the very day they become technically operational in the Domain Name System.
Convenient and easy

Typosquatting Data Feed’s files are available in .csv format and categorized in sequential groups of similar-looking domain names with data fields that are easy to navigate and interpret.
Backed by incredible expertise

Typosquatting Data Feed builds on 10+ years of expertise and WHOIS registration intel covering various gTLDs, ccTLDs, and some of the important ngTLDs.
Advanced processing and categorization

Typosquatting Data Feed’s groups of similar domain names are detected and categorized using advanced mathematical techniques.

The Typosquatting Data Feed comes in various forms

Basic

The Basic Data Feed is a structured list of domain names containing typos. One domain per line.
Download Basic sample
Enriched

The Enriched database is an add-on to the Basic database and contains WHOIS records for each row.
Download Enriched sample
Community

Access the free community version for security, law enforcement, and data science professionals.
Download Community sample
Snowflake Community Access

Access typosquatting domain intelligence with the Snowflake platform.
Visit Snowflake Profile

Practical usage

Cybersecurity

Cybersecurity specialists can use the feed to monitor bulk domain name registrations indicative of typosquatting as part of URL phishing, spoofing, domain hijacking, and malware-supported attacks.

Get instant access to daily feeds of likely indicators of compromise (IOCs) in the domain space.

Inform customers, employees, and other relevant stakeholders about domain names that may be used to execute homograph, URL phishing, and malware-related attacks.

Use Typosquatting Data Feed along with different security solutions, including security information and event management (SIEM), security orchestration, automation and response (SOAR), and threat intelligence platforms (TIPs).

Correlate feeds with known malware and phishing blacklists and databases to further assess the likelihood and severity of malicious events and amplify detection efficiency.

Law enforcement

Identify the early symptoms of domain and company misrepresentations that may affect the public.
Investigate ongoing typosquatting and domain-related attacks on different sectors and types of organizations.

Registrars & Domainers

Spot dangerous domain parking activities interfering with legitimate registrations.
Stay away from suspicious domain name groups while building your domain name portfolio.

Brand protection

Identify groups of domain names used for brandjacking and that may negatively impact your brand reputation and confuse customers and other audiences.
Take action against cybersquatters and fraudsters who aim to benefit from new product and service launches, settlement initiatives, and other high-profile activities.
Speed up dispute resolutions regarding your trademarks and intellectual property.

Media & research

Researchers and media professionals can benefit from the feed to uncover emerging domain registration trends and newsworthy events.
Study bulk domain name registration patterns to uncover trends for future research.
Cover newsworthy domain activity every day.