# Typosquat Domain Scanner

> Typosquat Domain Scanner is a paid API for AI agents from netintel-production-440c.up.railway.app, paid per call via x402, $0.05/call, not verified (last probed 2026-10-23); live alternatives: NetIntel Bulk Domain Availability Check ($0.1) and AgentMail List Domains (free).

Agents call it through Zero, which pays per call: no API key and no wallet of your own. New accounts start with $5.

Live alternatives for the same use case:
- [NetIntel Bulk Domain Availability Check](https://www.zero.xyz/c/netintel-bulk-domain-availability-check-0a16e4f3) ($0.1)
- [AgentMail List Domains](https://www.zero.xyz/c/agentmail-domains-7ead2d65) (free)

Generates typo and look-alike domain variations for a given domain and checks which are already registered to detect typosquatting and brand impersonation.

## Facts

- Endpoint: GET https://netintel-production-440c.up.railway.app/typosquat/scan?utm_source=zero.xyz
- Price: $0.05/call
- Payment: x402
- Status: unknown
- Last checked: 2026-10-23
- Activations on Zero: 0
- Tags: x402
- Canonical page: https://www.zero.xyz/c/typosquat-domain-scanner-ab4c41f9
- Structured record (JSON): https://api.zero.xyz/v1/capabilities/cap_1_hIvt0zcaFtPvwnSAMxs

Status and success rate cover calls made through Zero and Zero's own probes. Third-party monitors may report differently.

## How to call it through Zero

Zero handles the 402 payment challenge and records the run. With the Zero CLI installed (`npm i -g @zeroxyz/cli`):

```sh
zero fetch --capability typosquat-domain-scanner-ab4c41f9
```

Example prompt: Can you scan stripe.com for typosquat lookalike domains — check up to 50 variations and tell me which ones are already registered so I can see if anyone is impersonating us?

## When to prefer this

Use this endpoint when you need to proactively audit a domain for typosquatting risk, detect potential phishing infrastructure, or monitor brand impersonation. Ideal for security teams, brand protection workflows, and domain portfolio audits where you need to enumerate and check registered lookalikes systematically rather than checking a single specific domain.

## Known failure modes

- Missing domain query parameter returns validation error
- Domain without TLD is rejected
- limit exceeding 50 is clamped or rejected
- WHOIS/registration lookup timeouts for some variations may reduce coverage
- Non-existent TLD may yield no results

## How this service works

Generate common typo and look-alike variations of a domain and check which are already registered — catches character swaps, omissions, additions, homoglyphs, and alternate TLDs so agents can detect typosquatting and brand-impersonation domains targeting a company.

## Output

Returns a risk grade and score for the domain, a list of registered lookalike domains (with details per finding), a list of still-available variations, counts of registered vs available domains, and the total number of variations checked.

## Example request

```json
{
 "input": {
  "type": "http",
  "method": "GET",
  "queryParams": {
   "limit": 30,
   "domain": "example.com"
  }
 }
}
```

## Request schema (JSON Schema)

```json
{
 "type": "object",
 "$schema": "https://json-schema.org/draft/2020-12/schema",
 "required": [
  "input"
 ],
 "properties": {
  "input": {
   "type": "object",
   "required": [
    "type",
    "method"
   ],
   "properties": {
    "type": {
     "type": "string",
     "const": "http"
    },
    "method": {
     "enum": [
      "GET"
     ],
     "type": "string"
    },
    "queryParams": {
     "type": "object",
     "required": [
      "domain"
     ],
     "properties": {
      "limit": {
       "type": "number",
       "description": "Max variations to generate and check (default: 30, max: 50)"
      },
      "domain": {
       "type": "string",
       "description": "Domain to scan for typosquat look-alikes (e.g. google.com) — must include a TLD"
      }
     }
    }
   },
   "additionalProperties": false
  },
  "output": {
   "type": "object",
   "required": [
    "type"
   ],
   "properties": {
    "type": {
     "type": "string"
    },
    "example": {
     "type": "object",
     "properties": {
      "tld": {
       "type": "string"
      },
      "name": {
       "type": "string"
      },
      "grade": {
       "type": "string"
      },
      "score": {
       "type": "number"
      },
      "domain": {
       "type": "string"
      },
      "findings": {
       "type": "array",
       "items": {
        "type": "object"
       }
      },
      "available_count": {
       "type": "number"
      },
      "registered_count": {
       "type": "number"
      },
      "variations_checked": {
       "type": "number"
      },
      "available_variations": {
       "type": "array",
       "items": {
        "type": "object"
       }
      },
      "registered_lookalikes": {
       "type": "array",
       "items": {
        "type": "object"
       }
      }
     }
    }
   }
  }
 }
}
```

## Response schema (JSON Schema)

```json
{
 "type": "json",
 "example": {
  "tld": "com",
  "name": "google",
  "grade": "D",
  "score": 35,
  "domain": "google.com",
  "findings": [
   {
    "rule": "high_typosquat_exposure",
    "detail": "10 of 10 look-alike domains are registered",
    "deduction": -40
   },
   {
    "rule": "homoglyph_registered",
    "detail": "A homoglyph look-alike domain is registered (highest phishing risk)",
    "deduction": -15
   },
   {
    "rule": "alt_tld_registered",
    "detail": "An alternate-TLD look-alike domain is registered",
    "deduction": -10
   }
  ],
  "available_count": 0,
  "registered_count": 10,
  "variations_checked": 10,
  "available_variations": [],
  "registered_lookalikes": [
   {
    "domain": "g00gle.com",
    "technique": "homoglyph",
    "registered": true
   },
   {
    "domain": "gogle.com",
    "technique": "omission",
    "registered": true
   },
   {
    "domain": "google.net",
    "technique": "alternate_tld",
    "registered": true
   }
  ]
 }
}
```

## More

- Live health (JSON, refreshed every minute): https://www.zero.xyz/c/typosquat-domain-scanner-ab4c41f9/health.json
- [Zero catalog index](https://www.zero.xyz/llms.txt)
- [Other services from netintel-production-440c.up.railway.app](https://www.zero.xyz/host/netintel-production-440c.up.railway.app/llms.txt)