Free tool · Spot fraud
Lookalike domain finder
Enter a supplier's domain and see which typo and lookalike versions of it are registered — the kind of domain a fraudster would email you from while pretending to be them.
To see which lookalikes exist, your browser asks Cloudflare's public DNS resolver (or Google's, if Cloudflare doesn't answer) about each candidate domain name. The domains are never sent to Paylist.
Why lookalike domains matter
Most invoice fraud starts with an email that looks like it came from a supplier you already pay. One of the easiest ways to pull that off is to register a domain that's almost the same as theirs — one letter different, a hyphen added, .com instead of .co.uk — and send an email saying their bank details have changed. In a busy inbox, on a phone screen, almost nobody reads a domain letter by letter.
Registering a lookalike costs a few pounds and takes minutes. Setting it up to send email takes a few minutes more. That's why it's worth knowing which lookalikes of your key suppliers' domains already exist.
What this tool checks
We generate up to 150 of the most likely variations of the domain you enter, using the same tricks fraudsters use:
- Lookalike characters — rn for m, 1 or i for l, 0 for o, vv for w, cl for d.
- A different ending — .com, .net, .org, .uk or .ltd.uk instead of .co.uk, and so on.
- An extra word — supplier-invoices, supplier-accounts, supplier-payments, supplier-uk.
- A missing, doubled or swapped letter, or a letter next to it on the keyboard.
- A hyphen added or taken away.
For each one, your browser asks a public DNS resolver whether the domain exists. If it does, we also check for a mail server (an MX record), because a lookalike that can send and receive email is the dangerous kind, and for a website address (an A record). Results are sorted with the mail-capable ones first.
Registered doesn't mean malicious
Finding registered lookalikes is normal, especially for well-known names. Many are defensive registrations: businesses often buy the obvious typos and other endings of their own domain so nobody else can. Others belong to unrelated organisations that happen to have a similar name. Only the domain owner and the registrar know who's behind each one, so treat the list as a watch-list, not an accusation.
What to do with the results
- Share the list with whoever manages your email, and ask them to block or flag messages from lookalikes your supplier doesn't own.
- Ask the supplier whether the domains are theirs. If they're not, they may want to report them to the registrar.
- Treat any email from one of these domains as suspect, particularly anything about bank details, invoices or payments.
- Whatever domain an email comes from, confirm any change of bank details by phoning the supplier on a number you already hold.
What this tool can't catch
We check the most common variations, not every possible one — there are thousands, including international characters that look identical to Latin letters. A clean result means none of the likeliest lookalikes exist today, not that none ever will. And the most convincing fraud emails don't need a lookalike at all: they come from a supplier's real mailbox after it has been hacked.
That's the gap Paylist closes. Instead of trusting whichever email arrived, you look up a supplier's verified bank details in the Paylist directory and check them before you pay.
Your privacy
The lookups run from your browser. The candidate domain names are sent to Cloudflare's public DNS-over-HTTPS resolver (falling back to Google's if Cloudflare doesn't answer). The domain you search for, and the lookalikes found, are never sent to Paylist.
Frequently asked questions
What is a lookalike domain?
A domain registered to look almost identical to a real one — a letter missing or swapped, rn in place of m, an extra word like -invoices, or a different ending like .com instead of .co.uk. Fraudsters use them to send emails that appear to come from a business you trust.
How do I check if someone has registered a domain similar to my supplier's?
Enter the supplier's domain or one of their email addresses above. We generate the most common typo and lookalike variations and check which ones exist in DNS, then show which of those are set up to send and receive email.
Does a registered lookalike mean my supplier is being targeted?
Not necessarily. Many businesses register typos and other endings of their own domain defensively, and some lookalikes belong to unrelated firms with similar names. Ask the supplier whether they own them, and treat email from the rest as suspect.
Why does it matter whether a lookalike has a mail server?
A domain needs mail (MX) records to receive email, and fraudsters usually set them up so they can hold a conversation with you. A lookalike with a mail server is ready to be used in an invoice fraud email; one without is less of an immediate risk, though that can change at any time.
How do I spot a fake supplier email address?
Read the domain after the @ letter by letter, check the Reply-To address matches, and be wary of any email that changes bank details, adds urgency or discourages you from phoning. If in doubt, call the supplier on a number you already hold.
Is my search sent to Paylist?
No. The lookups run in your browser and go to Cloudflare's public DNS resolver (or Google's as a fallback). Neither the domain you search for nor the lookalikes found are sent to us.
Can I block lookalike domains?
Yes. Most business email services, including Microsoft 365 and Google Workspace, let an administrator block or quarantine mail from specific domains. Add the lookalikes your supplier doesn't own, and keep checking — new ones can be registered at any time.
Check before you pay — every time
Paylist is a verified directory of UK business bank details. Your suppliers list theirs once, and you look them up instead of trusting an email.