Cybersecurity tool · 100% client-side · 8 attack techniques

Domain Typo-Squat Checker

Enter any domain and the tool generates plausible lookalikes attackers could register: character omission, transposition, keyboard-neighbor typos, Cyrillic homoglyphs, brand-prefix confusion (login-yourbrand, secure-yourbrand), and high-risk TLD swaps (.zip, .top, .xyz). Click any candidate to verify registration in WHOIS.

Free. No account. The domain you enter never leaves your browser.

100% client-side. The domain is never sent to a server. To verify which candidates are actually registered, click any candidate to look it up at WHOIS.

Summary for decipheru.com

high severity

31

medium severity

38

low severity

36

Total candidates

105

These are candidates, not confirmed registrations. To see which are already registered, click any row to look it up at whois.com or your preferred registrar.

Lookalike candidates · click to verify

SeverityCandidate domainTechniqueVerify
highaccount-decipheru.comBrand-prefix confusionWHOIS →
highbilling-decipheru.comBrand-prefix confusionWHOIS →
highdec1pheru.comLook-alike substitutionWHOIS →
highdecipheru-account.comBrand-prefix confusionWHOIS →
highdecipheru-billing.comBrand-prefix confusionWHOIS →
highdecipheru-login.comBrand-prefix confusionWHOIS →
highdecipheru-mail.comBrand-prefix confusionWHOIS →
highdecipheru-secure.comBrand-prefix confusionWHOIS →
highdecipheru-support.comBrand-prefix confusionWHOIS →
highdecipheru-update.comBrand-prefix confusionWHOIS →
highdecipheru-verify.comBrand-prefix confusionWHOIS →
highdecipheru.buzzTLD swap to .buzzWHOIS →
highdecipheru.topTLD swap to .topWHOIS →
highdecipheru.zipTLD swap to .zipWHOIS →
highdeciphɛru.comCyrillic / Greek homoglyphWHOIS →
highdeciphеru.comCyrillic / Greek homoglyphWHOIS →
highdeciρheru.comCyrillic / Greek homoglyphWHOIS →
highdeciрheru.comCyrillic / Greek homoglyphWHOIS →
highdecɩpheru.comCyrillic / Greek homoglyphWHOIS →
highdeclpheru.comLook-alike substitutionWHOIS →
highdecіpheru.comCyrillic / Greek homoglyphWHOIS →
highdeϲipheru.comCyrillic / Greek homoglyphWHOIS →
highdeсipheru.comCyrillic / Greek homoglyphWHOIS →
highdɛcipheru.comCyrillic / Greek homoglyphWHOIS →
highdеcipheru.comCyrillic / Greek homoglyphWHOIS →
highlogin-decipheru.comBrand-prefix confusionWHOIS →
highmail-decipheru.comBrand-prefix confusionWHOIS →
highsecure-decipheru.comBrand-prefix confusionWHOIS →
highsupport-decipheru.comBrand-prefix confusionWHOIS →
highupdate-decipheru.comBrand-prefix confusionWHOIS →
highverify-decipheru.comBrand-prefix confusionWHOIS →
mediumdceipheru.comAdjacent transpositionWHOIS →
mediumdcipheru.comCharacter omissionWHOIS →
mediumddecipheru.comLetter doublingWHOIS →
mediumdeccipheru.comLetter doublingWHOIS →
mediumdeciheru.comCharacter omissionWHOIS →
mediumdecihperu.comAdjacent transpositionWHOIS →
mediumdeciipheru.comLetter doublingWHOIS →
mediumdecipehru.comAdjacent transpositionWHOIS →
mediumdeciperu.comCharacter omissionWHOIS →
mediumdecipheeru.comLetter doublingWHOIS →
mediumdecipher.comCharacter omissionWHOIS →
mediumdecipherru.comLetter doublingWHOIS →
mediumdecipheru.clickTLD swap to .clickWHOIS →
mediumdecipheru.cmTLD swap to .cmWHOIS →
mediumdecipheru.coTLD swap to .coWHOIS →
mediumdecipheru.infoTLD swap to .infoWHOIS →
mediumdecipheru.movTLD swap to .movWHOIS →
mediumdecipheru.netTLD swap to .netWHOIS →
mediumdecipheru.onlineTLD swap to .onlineWHOIS →
mediumdecipheru.orgTLD swap to .orgWHOIS →
mediumdecipheru.shopTLD swap to .shopWHOIS →
mediumdecipheru.siteTLD swap to .siteWHOIS →
mediumdecipheru.storeTLD swap to .storeWHOIS →
mediumdecipheru.xyzTLD swap to .xyzWHOIS →
mediumdecipheruu.comLetter doublingWHOIS →
mediumdecipheu.comCharacter omissionWHOIS →
mediumdecipheur.comAdjacent transpositionWHOIS →
mediumdeciphheru.comLetter doublingWHOIS →
mediumdeciphreu.comAdjacent transpositionWHOIS →
mediumdeciphru.comCharacter omissionWHOIS →
mediumdecippheru.comLetter doublingWHOIS →
mediumdecpheru.comCharacter omissionWHOIS →
mediumdecpiheru.comAdjacent transpositionWHOIS →
mediumdeecipheru.comLetter doublingWHOIS →
mediumdeicpheru.comAdjacent transpositionWHOIS →
mediumdeipheru.comCharacter omissionWHOIS →
mediumecipheru.comCharacter omissionWHOIS →
mediumedcipheru.comAdjacent transpositionWHOIS →
lowcecipheru.comKeyboard-neighbor typoWHOIS →
lowd-ecipheru.comHyphen insertionWHOIS →
lowddcipheru.comKeyboard-neighbor typoWHOIS →
lowde-cipheru.comHyphen insertionWHOIS →
lowdec-ipheru.comHyphen insertionWHOIS →
lowdeci-pheru.comHyphen insertionWHOIS →
lowdecilheru.comKeyboard-neighbor typoWHOIS →
lowdecioheru.comKeyboard-neighbor typoWHOIS →
lowdecip-heru.comHyphen insertionWHOIS →
lowdecipgeru.comKeyboard-neighbor typoWHOIS →
lowdeciph-eru.comHyphen insertionWHOIS →
lowdeciphdru.comKeyboard-neighbor typoWHOIS →
lowdeciphe-ru.comHyphen insertionWHOIS →
lowdecipheeu.comKeyboard-neighbor typoWHOIS →
lowdeciphefu.comKeyboard-neighbor typoWHOIS →
lowdecipher-u.comHyphen insertionWHOIS →
lowdecipheri.comKeyboard-neighbor typoWHOIS →
lowdecipherj.comKeyboard-neighbor typoWHOIS →
lowdeciphery.comKeyboard-neighbor typoWHOIS →
lowdeciphetu.comKeyboard-neighbor typoWHOIS →
lowdeciphrru.comKeyboard-neighbor typoWHOIS →
lowdeciphwru.comKeyboard-neighbor typoWHOIS →
lowdecipjeru.comKeyboard-neighbor typoWHOIS →
lowdecipneru.comKeyboard-neighbor typoWHOIS →
lowdecipyeru.comKeyboard-neighbor typoWHOIS →
lowdeckpheru.comKeyboard-neighbor typoWHOIS →
lowdecopheru.comKeyboard-neighbor typoWHOIS →
lowdecupheru.comKeyboard-neighbor typoWHOIS →
lowdedipheru.comKeyboard-neighbor typoWHOIS →
lowdevipheru.comKeyboard-neighbor typoWHOIS →
lowdexipheru.comKeyboard-neighbor typoWHOIS →
lowdrcipheru.comKeyboard-neighbor typoWHOIS →
lowdwcipheru.comKeyboard-neighbor typoWHOIS →
loweecipheru.comKeyboard-neighbor typoWHOIS →
lowfecipheru.comKeyboard-neighbor typoWHOIS →
lowsecipheru.comKeyboard-neighbor typoWHOIS →

Common questions

How is this different from running dnstwist?

Same taxonomy, character omission, transposition, homoglyph, TLD swap, without needing Python installed. dnstwist also performs DNS resolution and similarity scoring on every variant; this tool generates the candidate list and links each one to WHOIS so you can verify registration. For batch defender workflows, dnstwist is still the right tool. For one-off curiosity or a board-prep look at your brand, this is faster.

Why are some candidates marked HIGH severity?

HIGH severity goes to (1) Cyrillic / Greek homoglyphs that visually mimic Latin characters in the URL bar, the strongest browser-deception vector, and (2) brand-prefix confusion patterns like login-yourbrand.com or yourbrand-secure.com that exploit the same anchor-text trust pattern phishing emails do. MEDIUM is structural typos. LOW is keyboard-neighbor mistypes that humans often catch on second look.

Can the tool tell me which candidates are already registered?

No, checking would require us to issue 50+ DNS queries on your behalf, which (a) puts us in the chain of custody for any data your security team might want isolated and (b) burns the lookup-service rate budget for everyone using DecipherU. We surface the candidate list and link each row to whois.com, where you can confirm registration for any candidate that worries you in one click.

Where does the candidate list come from?

Pure deterministic rewrites of your input, no API call, no database, no LLM. The technique list matches the public dnstwist taxonomy and the CISA defender guidance on brand-impersonation domain monitoring.

Is the input domain stored or logged?

No. The whole calculation runs in your browser. The domain you enter is never sent to a DecipherU server, never logged, never stored.

Last verified: May 2026?Report an inaccuracy