pricing background

Domain Typosquats API Documentation

Typosquatting API documentation

The Typosquatting API returns the registered domains that look like typo variants of a brand keyword or wildcard pattern. Each result includes the domain name, registration date, expiry date, last-seen date, and a drop status flag. Results are paginated 100 domains per page. Authentication is by API key passed as a query parameter.

The endpoint accepts one search input at a time: either a brand 'keyword' or a wildcard 'pattern' and returns matching registered domains discovered across 1,528+ TLDs.

Authorization

Authenticate every request by passing your API key as the apiKey query parameter. Generate or rotate the key from the billing dashboard. If your key is exposed, reset it from the dashboard or follow the API key rotation guide.

Query Parameters

Required
  • apiKey
    API key from the billing dashboard.
  • keyword
    Brand or label to find typo variants for. 3–63 characters, letters / digits / hyphen, single label (no dots). Case-insensitive. Use either 'keyword' or 'pattern', never both.
  • pattern
    Wildcard search string combining fuzzy matching with '*' wildcards. 3–63 characters total, asterisk is the only supported wildcard, each '*' matches zero or more characters, maximum 3 asterisks per request. Use either 'keyword' or 'pattern', never both.
Optional
  • pageToken
    Token from 'nextPageToken' in the previous response. Required to retrieve page 2 and onward. The original 'keyword' or 'pattern' must be passed alongside the token on every page request.

When to use keyword vs pattern

The two inputs serve different search strategies. Both apply fuzzy matching, but only pattern adds wildcard expansion.

Input Behavior Use when
keyword=google Fuzzy matches typo variants of google (character substitution, transposition, omission, repetition). You have a single brand label and want every misspelling that targets it.
pattern=*google* Wildcard-expands the literal segments and then fuzzy-matches each expansion. You want a wider sweep that catches prefix, suffix, and compound typosquats such as mygoogle.io, googlepay.net, and goog1e-login.com.

A pattern request that wraps a keyword in asterisks returns a superset of the keyword results for the same label.

For example, pattern=*google* returns every domain that keyword=google would return, plus additional matches the keyword call would not surface.

Wildcard rules

  • Only the asterisk (*) is supported. No question marks, character classes, anchors, or alternation.
  • Each * matches zero or more characters.
  • Maximum three asterisks per pattern.
  • Position is free: *google*, google*, *google, and goo*gle are all valid.
  • Total pattern length must fall between 3 and 63 characters.
Patterns that exceed 3 asterisks or include unsupported regex characters return 400 Bad Request.

Request

shellnodejsjavapythonphprubyjscsharpgocswiftjquery
SHELL
Loading request...

Response

Loading response...

Fields Description

Fields
Details
Example
status
Indicates if the request was successful
true
totalRecords
Total number of domains found
3
currentPage
Page number of the current response. Starts at 1.
1
hasNextPage
'true' if at least one additional page is available.
true
totalPages
Total number of pages available
1
nextPageToken
Opaque token to pass as 'pageToken' on the next request. Present only when 'hasNextPage' is 'true'.
domains
List of domains returned in the response
domainName
Domain name
whoisfreaks.com
createDate
Domain creation date
2019-03-19
expiryDate
Domain expiration date
2026-03-19
lastSeen
Last time the domain was observed
2026-01-18
isDropped
Indicates whether the domain is dropped
false

Pagination

The response returns up to 100 domains per page. To retrieve subsequent pages:

  1. Read nextPageToken from the previous response.
  2. Send a new request to the same endpoint with the same keyword (or pattern) and apiKey, plus the pageToken set to the value of nextPageToken.
  3. Repeat until hasNextPage returns false.

Page size is fixed at 100 and cannot be changed.

The keyword or pattern parameter must be present on every paginated request. Requests that pass only pageToken return 400 Bad Request.

Rate limits and credits

FAQs

Explore frequently asked questions to better understand our features, functionality, and usage.

What does the Typosquatting API return?

The Typosquatting API returns a paginated list of registered domains that look like typo variants of the supplied keyword or that match the supplied wildcard pattern.

Each domain includes its registration date, expiry date, the date WhoisFreaks last confirmed it was registered, and a flag indicating whether the domain has fully dropped from the registry.

Should I use the keyword parameter or the pattern parameter?

Use keyword when you have a single brand label and want fuzzy variants of that exact label.

Use pattern when you want to combine fuzzy matching with wildcards to catch prefix, suffix, and compound typosquats.

A pattern request wrapping a keyword in asterisks (such as pattern=*google*) returns a superset of the matching keyword=google results.

Pass only one of the two parameters per request.

How does pattern wildcard matching work?

The asterisk character (*) is the only supported wildcard. Each asterisk matches zero or more characters.

Asterisks can appear anywhere in the pattern, including the middle (for example goo*gle).

A maximum of three asterisks is allowed per pattern. Total pattern length must be between 3 and 63 characters.

No other regex character is supported.

How many asterisks can a pattern contain?

A pattern value can contain at most three asterisks.

Patterns that include four or more asterisks return 400 Bad Request.

Patterns that contain regex characters other than the asterisk (for example ?, [, ], ^, $) also return 400.

How do I retrieve the next page of results?

The response includes nextPageToken whenever hasNextPage is true.

To get the next page, send a new request to the same endpoint with the same keyword or pattern and your apiKey, and set pageToken to the value of nextPageToken.

Repeat until hasNextPage is false. Page size is fixed at 100.

When is isDropped set to true?

isDropped is true only after the domain has fully dropped from the registry and is available for re-registration.

Domains currently in redemption grace period or pending-delete state still report isDropped: false even though they may soon become available.

To detect imminent drops rather than completed drops, monitor expiry and last-seen dates instead.

What is the difference between this API and Brand Monitoring?

The Typosquatting API is a pull-based search: you call it and receive a list of matching registered domains at that moment.

Brand Monitoring is a push-based service that watches newly registered domains across 1,528+ TLDs and emails alerts when a typosquat for a tracked brand appears.

Use the API for ad-hoc and scheduled scans; use Brand Monitoring for continuous coverage with delivered alerts.

Is there a free way to try the API before integrating?

Yes. The free typosquatting lookup tool accepts one keyword at a time and returns matching domains directly in the browser without requiring an account.

Use it to validate match quality for your brand keywords before integrating the API.

Can I get continuous alerts when new typosquatting domains are registered?

Yes, through Brand Monitoring .

Brand Monitoring scans newly registered domains across all supported TLDs twice daily and delivers email alerts when a domain matching your tracked keywords appears.

The Typosquatting API is the on-demand counterpart for scheduled or ad-hoc lookups.