# Domain Typosquat Scan

> Domain Typosquat Scan is a paid API for AI agents from 164.160.90.241.sslip.io, paid per call via x402, $0.05/call, status unknown (last checked 2026-10-12).

Generates lookalike typosquatting variants of a domain and reports which ones resolve in DNS, for brand protection and phishing triage.

## Facts

- Endpoint: GET https://164.160.90.241.sslip.io/api/sec-domain-typosquatting-scanner?utm_source=zero.xyz
- Price: $0.05/call
- Payment: x402
- Status: unknown
- Last checked: 2026-10-12
- Activations on Zero: 0
- Tags: x402
- Canonical page: https://www.zero.xyz/c/domain-typosquat-scan-56c51f19
- Structured record (JSON): https://api.zero.xyz/v1/capabilities/cap_Y-Wr_PlmhxMr5VZRCe9ZR

Status and success rate cover calls made through Zero and Zero's own probes. Third-party monitors may report differently.

## How to call it through Zero

Zero handles the 402 payment challenge and records the run. With the Zero CLI installed (`npm i -g @zeroxyz/cli`):

```sh
zero fetch --capability domain-typosquat-scan-56c51f19
```

Example prompt: Can you scan for typosquatting variants of acmecorp.com and tell me which lookalike domains are actually resolving in DNS right now?

## When to prefer this

Use this endpoint when you need to quickly enumerate and validate live typosquatting threats against a specific domain — particularly for brand protection, incident response, or phishing triage workflows. Prefer this over manual WHOIS lookups or generic domain search tools when you need DNS resolution status for many lookalike variants in a single call.

## Known failure modes

- Invalid or malformed domain input returns an error
- Non-existent or unresolvable base domain may yield no results
- DNS lookup timeouts for certain variants may affect completeness
- Rate limiting or payment failure prevents the scan from running
- Very new domains may not yet have typosquat variants registered

## How this service works

Generate lookalike typosquat variants of a domain and report which ones resolve in DNS. For brand protection and phishing triage.

## Output

A list of generated typosquatting variants of the input domain (e.g. transpositions, homoglyphs, missing letters, added characters), each annotated with whether it currently resolves in DNS — helping identify active threats for brand protection or phishing investigation.

## Request schema (JSON Schema)

```json
{
 "type": "object",
 "$schema": "https://json-schema.org/draft/2020-12/schema",
 "required": [
  "input"
 ],
 "properties": {
  "input": {
   "type": "object",
   "required": [
    "type",
    "method"
   ],
   "properties": {
    "type": {
     "type": "string",
     "const": "http"
    },
    "method": {
     "enum": [
      "GET"
     ],
     "type": "string"
    },
    "queryParams": {
     "type": "object",
     "required": [
      "domain"
     ],
     "properties": {
      "domain": {
       "type": "string",
       "description": "Domain to protect"
      }
     }
    }
   },
   "additionalProperties": false
  },
  "output": {
   "type": "object",
   "required": [
    "type"
   ],
   "properties": {
    "type": {
     "type": "string"
    },
    "example": {
     "type": "object"
    }
   }
  }
 }
}
```

## More

- Live health (JSON, refreshed every minute): https://www.zero.xyz/c/domain-typosquat-scan-56c51f19/health.json
- [Zero catalog index](https://www.zero.xyz/llms.txt)
- [Other services from 164.160.90.241.sslip.io](https://www.zero.xyz/host/164.160.90.241.sslip.io/llms.txt)