Domain Typosquatting API - Find Look-Alike Domains Targeting Your Brand
The APIFreaks Domain Typosquatting API searches for registered domains that read like typo variants of a brand keyword, or that match a wildcard pattern you define, across the full TLD set it tracks. These are the domains squatters register on a deliberate misspelling, character swap, or lookalike of a known brand, hoping to catch mistyped traffic, host a phishing page, or resell the name back to the brand it imitates. Every match comes back with its registration history, when it expires, when it was last confirmed live, and whether it has since dropped out of the registry, paginated so a heavily squatted brand doesn't blow past a single response.
It's built for teams that need to know who's registering domains that look like theirs: brand protection and security teams running one-off checks or scheduled sweeps for a trademark being squatted on, anti-fraud teams checking whether a link or sender domain is a lookalike before it reaches a user, and teams tracking a squatted name until it drops so they can reclaim it.
Features
Keyword Fuzzy Matching
Pass a single brand label through keyword and get every close misspelling: swapped letters, dropped letters, doubled letters, and other near-misses on that exact label.
Use it as the default starting point for a brand sweep, it's the tightest search and the cheapest place to look before widening the net.
Wildcard Pattern Search
Combine fuzzy matching with up to three * wildcards in a pattern, for example *paypal*, to catch prefix, suffix, and compound typosquats a plain keyword search would miss.
Use it once you already know an attacker is registering compound variants, like paypal-support.com or login-paypal.net, that a single-label search can't reach. Pattern searches expand and fuzzy-match multiple segments, so expect them to take noticeably longer to process than an equivalent keyword search.
1,529+ TLDs in One Call
Every search runs across the full TLD set at once.
Use it to skip looping a request per extension the way a manual WHOIS sweep would require.
Registration Lifecycle Per Match
Each result can carry createDate, expiryDate, and lastSeen, so you can tell a fresh registration from one that's been sitting parked for years.
Not every record is complete. Older or less-actively-tracked entries can be missing createDate or expiryDate, so lastSeen and isDropped are the two fields worth treating as reliably present across a full result set.
Drop Status Tracking
The isDropped flag tells you when a squatted domain has fully left the registry and become available again. Across a real brand sweep, a meaningful share of older matches typically show isDropped: true, squatters routinely let cheap, low-traffic domains lapse.
Use it for reclaim and re-registration workflows, watch a squatted name until it drops, then move on it.
Token-Based Pagination
Results page at 100 domains per page; pass the returned token back to walk through large result sets for widely-squatted brand names.
Use it when a well-known brand turns up thousands of matches, budget for more than one page rather than assuming everything fits in the first response.
Built for These Use Cases
Brand and trademark protection
Run a keyword sweep for your brand name, and a pattern sweep for common prefix and suffix abuse, to find lookalike domains before they're weaponized against your customers. Anything that looks concerning is worth a follow-up call to the Domain Reputation API for an actual risk read.Phishing campaign discovery
Feed a suspected campaign's naming pattern intopattern to surface every domain the same actor registered under it.Scheduled monitoring
Re-run the same keyword or pattern on a schedule and diff the results against your last pull to catch newly registered lookalikes as they appear.Domain reclaim and acquisition
TrackisDropped and expiryDate on domains you want, so you know exactly when a squatted domain becomes available to register.API Endpoint
All Endpoints
| Endpoint | Description | Base Credits Cost | Reference | Playground |
|---|---|---|---|---|
| Domain Typosquatting | Find registered domains that are typo or wildcard-pattern variants of a brand keyword. | 90 | Reference | Playground |
How-To-Guides
Search Typosquats by Brand Keyword
Start a brand-protection sweep with a single label, the exact name you're trying to protect. It's the tightest search and the cheapest place to begin before you widen the net with a pattern search.
curl -X GET "https://api.apifreaks.com/v1.0/domain/typosquatting?keyword=paypal&apiKey=API-KEY"
# Response
{
"status": true,
"totalRecords": 1284,
"currentPage": 1,
"totalPages": 13,
"hasNextPage": true,
"nextPageToken": "<opaque_token>",
"domains": [
{
"domainName": "p-aypal.com",
"createDate": "2025-04-17",
"expiryDate": "2026-04-17",
"lastSeen": "2026-05-29",
"isDropped": true
},
{
"domainName": "p-aypal.de",
"lastSeen": "2024-07-11",
"isDropped": true
},
{
"domainName": "p0aypal.com",
"createDate": "2017-12-29",
"expiryDate": "2026-12-29",
"lastSeen": "2026-08-18",
"isDropped": false
},
{
"domainName": "p7ypal.com",
"isDropped": true
},
{
"domainName": "pa-pal.club",
"createDate": "2019-10-25",
"expiryDate": "2020-10-25",
"isDropped": false
}
]
}
A single global brand can turn up a surprising amount of squatting: paypal alone returned 1,284 registered lookalikes spread across 13 pages when we ran this. The trimmed sample above already makes the case for leaning on lastSeen and isDropped over the date fields, p-aypal.de has no createDate/expiryDate at all, and p7ypal.com has neither, just a name and a drop status. Sort or filter on isDropped first if reclaiming lapsed names is the goal, and on lastSeen first if you're chasing freshness instead. See the API Reference for the full field list.
Search Typosquats by Wildcard Pattern
Reach for this once a plain keyword search feels too narrow, or once you already know an attacker is registering compound variants like paypal-support.com or login-paypal.net. The response has the same shape as above, just a wider, slower-to-compute result set, since a pattern expands and fuzzy-matches every literal segment instead of one label.
curl -X GET "https://api.apifreaks.com/v1.0/domain/typosquatting?pattern=*paypal*&apiKey=API-KEY"Keep the non-wildcard part of your pattern to at least 5 characters, the whole thing capped at 63, and no more than three asterisks. A short pattern like a*b*c*d comes back as a 400 before any search runs, even with only 3 asterisks, since it has just 4 real characters (a, b, c, d) once you strip the wildcards out. If you're building patterns programmatically, validate the non-wildcard character count on your end first and save yourself the round trip.
Paginate Through a Large Result Set
Feed each response's nextPageToken back in until hasNextPage reads false. A brand like paypal, 1,284 matches across 13 pages, is exactly the case this exists for; don't assume the first page is the whole picture.
curl -X GET "https://api.apifreaks.com/v1.0/domain/typosquatting?keyword=paypal&pageToken=NEXT_PAGE_TOKEN&apiKey=API-KEY"Frequently Asked Questions
keyword if you just want typo variants of one exact label. Move to pattern once you want prefix, suffix, or compound coverage too, it always returns at least as much as the equivalent keyword search, at the cost of a larger result set and a slower response.lastSeen and isDropped are the two fields you can rely on being meaningful across the full result set, use them for freshness and reclaim tracking even when the registration dates are missing.keyword or pattern on your own schedule, a daily or weekly cron job is common, and diff the results against your last pull to catch newly registered lookalikes as they show up.200 response: totalRecords: 0, hasNextPage: false, and an empty domains array, not an error. A clean result means nothing registered looks like your brand yet, not that the search failed.Pricing
To use the Domain Typosquatting API, you will need API credits. We only charge for successful queries, defined by a 2xx status code. If your request results in a 4xx or 5xx status code, no credits will be charged, and any deducted credits will be returned.
For each successful request, 90 credits are charged.
Utilize the Credits Usage API to efficiently monitor your recent consumption of both one-off and subscription credits. This API provides a streamlined way to track and manage your credit usage, ensuring you stay informed about your remaining balance and can optimize your resource allocation effectively.