# Domain Phishing Lookalike Scanner

> Domain Phishing Lookalike Scanner is a paid API for AI agents from atq6wtkp6k.execute-api.us-east-1.amazonaws.com, paid per call via x402, $0.5/call, status unknown (last checked 2026-09-15).

Scans a domain for typosquats, homoglyphs, and phishing lookalike registrations that may be impersonating a brand.

## Facts

- Endpoint: POST https://atq6wtkp6k.execute-api.us-east-1.amazonaws.com/prod/v1/payg/domain
- Price: $0.5/call
- Payment: x402
- Status: unknown
- Last checked: 2026-09-15
- Activations on Zero: 0
- Tags: x402
- Canonical page: https://www.zero.xyz/c/domain-phishing-lookalike-scanner-596bb5c3
- Structured record (JSON): https://api.zero.xyz/v1/capabilities/cap_qvrzAHYHIjfy6YTy1gwCf

Status and success rate cover calls made through Zero and Zero's own probes. Third-party monitors may report differently.

## How to call it through Zero

Zero handles the 402 payment challenge and records the run. With the Zero CLI installed (`npm i -g @zeroxyz/cli`):

```sh
zero fetch --capability domain-phishing-lookalike-scanner-596bb5c3 -d '<json body>'
```

Example prompt: Can you scan acme.com for any phishing lookalike domains — typosquats, homoglyphs, or suspicious registration patterns — that might be impersonating us?

## When to prefer this

Use this endpoint when you need proactive brand-impersonation detection and want to find phishing lookalike domains before incidents are reported. Prefer this over manual DNS lookups or generic WHOIS searches when you need automated typosquat and homoglyph pattern matching at scale for a specific domain.

## Known failure modes

- Invalid or malformed domain input returns an error
- Domain not resolvable or non-existent domain may return no results or an error
- Rate limiting or payment failure (x402) may block the request
- Timeout if the scan takes too long for complex domains
- No lookalikes found returns an empty list with lookalikes_found of 0

## How this service works

Scan a domain for phishing lookalikes — typosquats, homoglyphs, and common phishing registration patterns. Returns matched lookalike domains found in the wild. Call to detect brand-impersonation phishing campaigns targeting a company before they're reported elsewhere.

## Output

Returns a JSON object with the scanned domain, timestamp, a list of discovered lookalike domains (each with their domain name), the total count of lookalikes found, and the number of candidate domains checked during the scan.

## Request schema (JSON Schema)

```json
{
 "type": "object",
 "properties": {
  "domain": {
   "type": "string",
   "description": "Root domain to scan for lookalikes"
  }
 }
}
```

## More

- Live health (JSON, refreshed every minute): https://www.zero.xyz/c/domain-phishing-lookalike-scanner-596bb5c3/health.json
- [Zero catalog index](https://www.zero.xyz/llms.txt)
- [Other services from atq6wtkp6k.execute-api.us-east-1.amazonaws.com](https://www.zero.xyz/host/atq6wtkp6k.execute-api.us-east-1.amazonaws.com/llms.txt)