# NetIntel Typosquat Scanner

> NetIntel Typosquat Scanner is a paid API for AI agents from netintel.dev, paid per call via x402, $0.05/call, status unknown (last checked 2026-10-11).

Scans a domain for registered typosquat look-alike variations using techniques like homoglyphs, omissions, and alternate TLDs, returning a risk grade and detailed findings

## Facts

- Endpoint: GET https://netintel.dev/typosquat/scan?utm_source=zero.xyz
- Price: $0.05/call
- Payment: x402
- Status: unknown
- Last checked: 2026-10-11
- Activations on Zero: 0
- Tags: x402
- Canonical page: https://www.zero.xyz/c/netintel-typosquat-scanner-ca1313d2
- Structured record (JSON): https://api.zero.xyz/v1/capabilities/cap_JUglEh8XsKTS0vpQ0UTvl

Status and success rate cover calls made through Zero and Zero's own probes. Third-party monitors may report differently.

## How to call it through Zero

Zero handles the 402 payment challenge and records the run. With the Zero CLI installed (`npm i -g @zeroxyz/cli`):

```sh
zero fetch --capability netintel-typosquat-scanner-ca1313d2
```

Example prompt: Can you scan acmecorp.com for typosquat lookalikes and tell me which fake versions are already registered — check up to 50 variations?

## When to prefer this

Use this endpoint when you need structured, scored typosquat risk analysis for a specific domain, including categorized techniques (homoglyph, omission, duplication, alternate TLD) and a letter-grade risk score. Prefer this over manual DNS lookups when you need a comprehensive scan of many variations at once with automated risk grading for brand protection, phishing defense, or domain monitoring workflows.

## Known failure modes

- Missing domain parameter returns 400 or validation error
- Domain without TLD (e.g. 'google' instead of 'google.com') fails validation
- limit exceeding 50 is clamped or rejected
- Non-existent or malformed domain string may return empty results or error
- Payment not provided or insufficient USDC results in 402 Payment Required
- Rate limiting or upstream DNS timeout may cause 5xx error

## How this service works

Generate common typo and look-alike variations of a domain and check which are already registered — catches character swaps, omissions, additions, homoglyphs, and alternate TLDs so agents can detect typosquatting and brand-impersonation domains targeting a company.

## Output

Returns a JSON object with an overall risk grade (A–F), numeric score, the original domain name and TLD, total variations checked, count of registered vs available lookalikes, an array of findings with rule names and score deductions, a list of registered lookalike domains with the spoofing technique used (homoglyph, omission, alternate_tld, etc.), and a list of available (unregistered) variations.

## Request schema (JSON Schema)

```json
{
 "type": "object",
 "$schema": "https://json-schema.org/draft/2020-12/schema",
 "required": [
  "input"
 ],
 "properties": {
  "input": {
   "type": "object",
   "required": [
    "type",
    "method"
   ],
   "properties": {
    "type": {
     "type": "string",
     "const": "http"
    },
    "method": {
     "enum": [
      "GET"
     ],
     "type": "string"
    },
    "queryParams": {
     "type": "object",
     "required": [
      "domain"
     ],
     "properties": {
      "limit": {
       "type": "number",
       "description": "Max variations to generate and check (default: 30, max: 50)"
      },
      "domain": {
       "type": "string",
       "description": "Domain to scan for typosquat look-alikes (e.g. google.com) — must include a TLD"
      }
     }
    }
   },
   "additionalProperties": false
  },
  "output": {
   "type": "object",
   "required": [
    "type"
   ],
   "properties": {
    "type": {
     "type": "string"
    },
    "example": {
     "type": "object",
     "properties": {
      "tld": {
       "type": "string"
      },
      "name": {
       "type": "string"
      },
      "grade": {
       "type": "string"
      },
      "score": {
       "type": "number"
      },
      "domain": {
       "type": "string"
      },
      "findings": {
       "type": "array",
       "items": {
        "type": "object"
       }
      },
      "available_count": {
       "type": "number"
      },
      "registered_count": {
       "type": "number"
      },
      "variations_checked": {
       "type": "number"
      },
      "available_variations": {
       "type": "array",
       "items": {
        "type": "object"
       }
      },
      "registered_lookalikes": {
       "type": "array",
       "items": {
        "type": "object"
       }
      }
     }
    }
   }
  }
 }
}
```

## Response schema (JSON Schema)

```json
{
 "type": "json",
 "example": {
  "tld": "com",
  "name": "google",
  "grade": "D",
  "score": 35,
  "domain": "google.com",
  "findings": [
   {
    "rule": "high_typosquat_exposure",
    "detail": "10 of 10 look-alike domains are registered",
    "deduction": -40
   },
   {
    "rule": "homoglyph_registered",
    "detail": "A homoglyph look-alike domain is registered (highest phishing risk)",
    "deduction": -15
   },
   {
    "rule": "alt_tld_registered",
    "detail": "An alternate-TLD look-alike domain is registered",
    "deduction": -10
   }
  ],
  "available_count": 0,
  "registered_count": 10,
  "variations_checked": 10,
  "available_variations": [],
  "registered_lookalikes": [
   {
    "domain": "g00gle.com",
    "technique": "homoglyph",
    "registered": true
   },
   {
    "domain": "gogle.com",
    "technique": "omission",
    "registered": true
   },
   {
    "domain": "google.net",
    "technique": "alternate_tld",
    "registered": true
   }
  ]
 }
}
```

## More

- Live health (JSON, refreshed every minute): https://www.zero.xyz/c/netintel-typosquat-scanner-ca1313d2/health.json
- [Zero catalog index](https://www.zero.xyz/llms.txt)
- [Other services from netintel.dev](https://www.zero.xyz/host/netintel.dev/llms.txt)