Lookalike Domains
Business email compromise doesn’t spoof your domain — it registers one that reads like it. We generate the plausible variants and check which already exist.
Registered
103
With a mail server
39
Variants checked
150
Time taken
6.3s
Needs attention
- 39 lookalikes can send and receive mailThese have MX records: aypal.com, laypal.com, mail-paypal.com, online-paypal.com, paaypal.com, paipal.com, papyal.com, pay-paypal.com, payal.com, payments-paypal.com, payp-al.com, paypa1.com, paypad.com, paypak.com, paypal-corp.com, paypal-inc.com, paypal-info.com, paypal-secure.com, paypal-support.com, paypal.cn, paypal.co, paypal.de, paypal.eu, paypal.me, paypal.net, paypal.org, paypal.us, paypam.com, paypcl.com, paypla.com, payppal.com, paypsl.com, payypal.com, ppaypal.com, pyapal.com, pypal.com, pzypal.com, qaypal.com, secure-paypal.com. A registered lookalike with a mail server is set up to be used, whether or not it has been yet. Nothing you publish on your own domain will stop mail from these — they authenticate as themselves.
Worth watching
- 2 registered homoglyph domainsThese substitute a non-Latin character that renders identically: xn--pypal-0jc.com, xn--pypal-4ve.com. They are effectively unreadable as fakes. Most mail clients display the decoded form, not the xn-- one.
- 64 other lookalikes registeredNo mail server on these yet. Some will be defensive registrations by you or a competitor, some parking, some waiting. They are worth watching: adding an MX record takes a minute.
Worth knowing
- What to do with thisRegister the handful closest to your real name yourself — it is cheaper than the incident. For the rest, monitoring beats blocking: a lookalike that appears with an MX record is an early warning worth acting on.
Registered lookalikes
Sorted by risk. A domain with MX records can both send and receive mail as that name — and its own SPF, DKIM and DMARC will pass, because the mail really is from it.
| Domain | Risk | Technique | Mail servers | Addresses |
|---|---|---|---|---|
| aypal.com | has mail | omission | 10 park-mx.above.com | 103.224.182.253 |
| laypal.com | has mail | adjacent key | 10 mail.laypal.com | 170.9.240.198 |
| mail-paypal.com | has mail | added word | 0 mailpaypal-com01b.mail.protection.outlook.com | none |
| online-paypal.com | has mail | added word | 1 bh.markmonitor.com | 3.33.139.32 |
| paaypal.com | has mail | repetition | 1 bh.markmonitor.com | 3.33.139.32 |
| paipal.com | has mail | bitsquat | 1 bh.markmonitor.com | 3.33.139.32 |
| papyal.com | has mail | transposition | 1 mail.h-email.net | 212.92.104.8 |
| pay-paypal.com | has mail | added word | 10 mxdm-ap-southeast-1.aliyun.com | none |
| payal.com | has mail | omission | 0 smtp.secureserver.net, 10 mailstore1.secureserver.net, 10 mx02.mail.icloud.com | 15.197.148.33, 3.33.130.190 |
| payments-paypal.com | has mail | added word | 0 smtp.secureserver.net, 10 mailstore1.secureserver.net | 13.248.243.5, 76.223.105.230 |
| payp-al.com | has mail | hyphenation | 10 park-mx.above.com | 103.224.212.105 |
| paypa1.com | has mail | lookalike character | 1 bh.markmonitor.com | 3.33.139.32 |
| paypad.com | has mail | bitsquat | 10 mx2.daemonmail.net, 10 mx1.daemonmail.net | 72.1.32.104 |
| paypak.com | has mail | adjacent key | 10 park-mx.above.com | 103.224.182.241 |
| paypal-corp.com | has mail | added word | 10 reply.paypal-corp.com, 20 mail4170.paypal-corp.com | none |
| paypal-inc.com | has mail | added word | 10 mx1.paypalcorp.com, 10 mx2.paypalcorp.com | none |
| paypal-info.com | has mail | added word | 1 bh.markmonitor.com | 3.33.139.32 |
| paypal-secure.com | has mail | added word | 10 mxb.eu.mailgun.org, 10 mxa.eu.mailgun.org | 16.170.217.199 |
| paypal-support.com | has mail | added word | 10 mx1.paypalcorp.com, 10 mx2.paypalcorp.com | 162.159.141.96, 151.101.67.1 |
| paypal.cn | has mail | other TLD | 5 mx1.paypal.cn, 5 mx3.paypal.cn, 5 mx2.paypal.cn | 110.75.170.189 |
| paypal.co | has mail | other TLD | 10 mx1.paypalcorp.com, 10 mx2.paypalcorp.com | 151.101.3.1, 162.159.141.96 |
| paypal.de | has mail | other TLD | 10 mx2.paypalcorp.com, 10 mx1.paypalcorp.com | 151.101.67.1, 151.101.3.1 |
| paypal.eu | has mail | other TLD | 10 mx1.paypalcorp.com, 10 mx2.paypalcorp.com | 151.101.67.1, 151.101.3.1 |
| paypal.me | has mail | other TLD | 1 aspmx.l.google.com, 10 alt4.aspmx.l.google.com, 5 alt2.aspmx.l.google.com | 162.159.141.96, 151.101.129.21 |
| paypal.net | has mail | other TLD | 1 bh.markmonitor.com | 3.33.139.32 |
| paypal.org | has mail | other TLD | 1 bh.markmonitor.com | 3.33.139.32 |
| paypal.us | has mail | other TLD | 1 bh.markmonitor.com | 3.33.139.32 |
| paypam.com | has mail | bitsquat | 10 mailstore1.secureserver.net, 0 smtp.secureserver.net | 3.33.251.168, 15.197.225.128 |
| paypcl.com | has mail | bitsquat | 50 route3.mx.cloudflare.net, 76 route1.mx.cloudflare.net, 64 route2.mx.cloudflare.net | 104.21.21.182, 172.67.199.201 |
| paypla.com | has mail | transposition | 10 aspmx.l.google.com, 30 alt2.aspmx.l.google.com, 40 alt3.aspmx.l.google.com | 172.67.217.141, 104.21.83.78 |
| payppal.com | has mail | repetition | 1 bh.markmonitor.com | 3.33.139.32 |
| paypsl.com | has mail | adjacent key | 0 localhost | 64.190.63.111 |
| payypal.com | has mail | repetition | 1 bh.markmonitor.com | 3.33.139.32 |
| ppaypal.com | has mail | repetition | 1 bh.markmonitor.com | 3.33.139.32 |
| pyapal.com | has mail | transposition | 0 localhost | 64.190.63.111 |
| pypal.com | has mail | omission | 300 ~ | 199.191.50.130 |
| pzypal.com | has mail | adjacent key | 0 localhost | 64.190.63.111 |
| qaypal.com | has mail | bitsquat | 0 localhost.qaypal.com | 104.21.71.112, 172.67.144.126 |
| secure-paypal.com | has mail | added word | 300 ~ | 208.91.196.152 |
| 0aypal.com | live site | bitsquat | none | 45.82.67.143 |
| apypal.com | live site | transposition | none | 212.7.194.67 |
| login-paypal.com | live site | added word | none | 99.83.176.46 |
| oaypal.com | live site | adjacent key | none | 212.92.105.234 |
| pa9pal.com | live site | bitsquat | none | 99.83.176.46 |
| pagpal.com | live site | adjacent key | none | 76.223.54.146, 13.248.169.48 |
| pahpal.com | live site | adjacent key | none | 99.83.176.46 |
| papal.com | live site | omission | none | 54.149.51.183, 34.210.149.95 |
| patpal.com | live site | adjacent key | none | 212.92.105.231 |
| paupal.com | live site | adjacent key | none | 85.17.5.66 |
| paxpal.com | live site | bitsquat | none | 13.248.169.48, 76.223.54.146 |
| pay-pal.com | live site | hyphenation | none | 216.21.239.197 |
| pay0al.com | live site | bitsquat | none | 45.82.67.195 |
| payapl.com | live site | transposition | none | 212.92.105.217 |
| paylal.com | live site | adjacent key | none | 85.17.5.76 |
| payoal.com | live site | adjacent key | none | 78.41.207.39 |
| paypa.com | live site | omission | none | 54.215.31.113 |
| paypaal.com | live site | repetition | none | 99.83.176.46 |
| paypah.com | live site | bitsquat | none | 52.200.66.12, 44.195.229.203 |
| paypal-account.com | live site | added word | none | 13.248.169.48, 76.223.54.146 |
| paypal-accounts.com | live site | added word | none | 84.201.25.112 |
| paypal-billing.com | live site | added word | none | 99.83.176.46 |
| paypal-email.com | live site | added word | none | 99.83.176.46 |
| paypal-group.com | live site | added word | none | 99.83.176.46 |
| paypal-hr.com | live site | added word | none | 99.83.176.46 |
| paypal-login.com | live site | added word | none | 99.83.176.46 |
| paypal-payments.com | live site | added word | none | 99.83.176.46 |
| paypal-portal.com | live site | added word | none | 3.33.139.32 |
| paypal-services.com | live site | added word | none | 66.45.246.141 |
| paypal.biz | live site | other TLD | none | 162.159.141.96, 151.101.3.1 |
| paypal.cc | live site | other TLD | none | 205.178.189.131 |
| paypal.cloud | live site | other TLD | none | 99.83.176.46 |
| paypal.dev | live site | other TLD | none | 3.71.139.153, 18.185.24.46 |
| paypal.link | live site | other TLD | none | 52.20.84.62 |
| paypal.online | live site | other TLD | none | 99.83.176.46 |
| paypal.ru | live site | other TLD | none | 3.33.139.32 |
| paypal.site | live site | other TLD | none | 99.83.176.46 |
| paypal.top | live site | other TLD | none | 118.193.11.34 |
| paypal.uk | live site | other TLD | none | 3.33.139.32 |
| paypal.xyz | live site | other TLD | none | 99.83.176.46 |
| paypall.com | live site | repetition | none | 3.33.139.32 |
| paypan.com | live site | bitsquat | none | 76.223.54.146, 13.248.169.48 |
| paypao.com | live site | adjacent key | none | 78.41.207.18 |
| paypap.com | live site | adjacent key | none | 104.247.81.99 |
| paypel.com | live site | bitsquat | none | 78.41.207.27 |
| paypil.com | live site | bitsquat | none | 13.248.169.48, 76.223.54.146 |
| paypl.com | live site | omission | none | 107.161.23.204, 198.251.81.30 |
| paypql.com | live site | adjacent key | none | 85.17.5.66 |
| paypwl.com | live site | adjacent key | none | 212.92.104.8 |
| paypzl.com | live site | adjacent key | none | 85.17.5.65 |
| paytal.com | live site | bitsquat | none | 212.32.254.36 |
| payxal.com | live site | bitsquat | none | 52.20.84.62 |
| pcypal.com | live site | bitsquat | none | 181.41.201.210 |
| peypal.com | live site | bitsquat | none | 212.7.194.68 |
| piypal.com | live site | bitsquat | none | 13.248.169.48, 76.223.54.146 |
| pqypal.com | live site | adjacent key | none | 45.77.200.164, 64.176.195.8 |
| psypal.com | live site | adjacent key | none | 75.126.101.239 |
| pwypal.com | live site | adjacent key | none | 85.17.5.76 |
| raypal.com | live site | bitsquat | none | 76.223.54.146, 13.248.169.48 |
| taypal.com | live site | bitsquat | none | 3.33.130.190, 15.197.148.33 |
| pɑypal.com encoded as xn--pypal-0jc.com | live site unicode | unicode homoglyph | none | 99.83.176.46 |
| pаypal.com encoded as xn--pypal-4ve.com | live site unicode | unicode homoglyph | none | 99.83.176.46 |
| payqal.com | registered | bitsquat | none | none |
| services-paypal.com | registered | added word | none | none |
How they were found
| Technique | Registered |
|---|---|
| added word | 22 |
| bitsquat | 21 |
| adjacent key | 19 |
| other TLD | 19 |
| omission | 6 |
| repetition | 6 |
| transposition | 5 |
| hyphenation | 2 |
| unicode homoglyph | 2 |
| lookalike character | 1 |
A lookalike is not something DMARC can block, but strong authentication on your own domain forces attackers to use one — which makes this list the place to look. Check your DMARC policy is at enforcement.