---
title: "How to Check Typosquat Domains of Your Brand"
slug: "/resources/tutorial/how-to-check-typosquat-domains-of-your-brand"
description: "Find typosquat domains already registered against your brand in one API call. Covers keyword and pattern search, paging, and how to triage the hits."
---

# How to Check Typosquat Domains of Your Brand

Written By [Qasim](https://pk.linkedin.com/in/qasimleoo), WhoisFreaks Team Published: September 10, 2026, Last Updated: September 10, 2026

Finding the typosquat domains already registered against your brand takes one call to the WhoisFreaks Domain Typosquats API. This tutorial covers the request, every field in the response, and how to sort thousands of matched rows down to the handful worth acting on.

_You'll need an API key. If you don't have one yet,_ [_sign up and grab your key first_](https://whoisfreaks.com/resources/tutorial/getting-started-with-whoisfreaks-how-to-sign-up-and-get-your-api-key)_; new accounts include 500 free credits, no card required._

## Why One Request Replaces a Permutation Script

The instinct is to generate every plausible misspelling of your brand and resolve each one. That is what permutation tools such as dnstwist do, and two things break the approach at scale: you only ever find variants your generator produced, and every candidate costs a DNS query from your own infrastructure.

The Typosquats API inverts the direction. It searches domains that are already registered and returns the ones that fuzzy-match your brand label, covering substitutions, transpositions, omissions and repetitions, with the registration metadata attached. That inversion is why the rest of this tutorial is two requests rather than a script.

## Prerequisites

Before you start you need three things:

*   A WhoisFreaks account with an active API key
*   Credits on the account; each successful page of results costs **5 credits**
*   Your brand label as a bare word, without a TLD: google, not google.com

If you just want to eyeball match quality before writing any code, the free [Domain Typosquatting tool](https://whoisfreaks.com/tools/domain/typos) takes one keyword at a time and returns matches in the browser without an account.

## Step 1: Copy Your API Key

Sign in to the [WhoisFreaks dashboard](https://billing.whoisfreaks.com/login) and open **API Keys**. Copy your primary key. It's the only credential this API needs, and it travels as the apiKey query parameter; no headers, no token exchange.

## Step 2: Run Your First Keyword Scan

Send a GET request to the typos endpoint with your brand label in keyword:

```
curl --location 'https://api.whoisfreaks.com/v3.0/domain/typos?keyword=whoisfreaks&page=1&apiKey=API_KEY'
```

Replace whoisfreaks with your own brand label and API_KEY with your key. That single request is the whole scan, because the API does the fuzzy matching server side.

#### The parameters you'll actually use:

| Parameter | Required | Value |
| --- | --- | --- |
| `apiKey` | Yes | Your key from the dashboard |
| `keyword` | Yes* | A single brand label. Case-insensitive, no TLD |
| `pattern` | Yes* | A wildcard pattern instead of a keyword (see Step 4) |
| `page` | No  | Page number for the first request |
| `pageToken` | No  | The `nextPageToken` from the previous response (see Step 5) |

> Pass **either** keyword **or** pattern, never in the same request.

## Step 3: Read the Response

The response is a paginated envelope wrapping a domains array:

```
{
  "status": true,
  "totalRecords": 2094,
  "currentPage": 1,
  "totalPages": 21,
  "hasNextPage": true,
  "nextPageToken": "TOKEN",
  "domains": [
    {
      "domainName": "g-ogle.com",
      "createDate": "2018-04-13",
      "expiryDate": "2027-04-13",
      "lastSeen": "2026-05-12",
      "isDropped": false
    },
    {
      "domainName": "g-oogle.ca",
      "createDate": "2024-04-18",
      "expiryDate": "2027-04-18",
      "lastSeen": "2026-08-20",
      "isDropped": false
    },
    {
      "domainName": "g-oogle.cloud",
      "createDate": "2023-11-27",
      "expiryDate": "2024-11-27",
      "lastSeen": "2025-01-10",
      "isDropped": true
    },
    {
      "domainName": "g-oogle.cn",
      "createDate": "2024-07-27",
      "expiryDate": "2026-07-27",
      "lastSeen": "2026-08-07",
      "isDropped": false
    }
  ]
}
```

#### What each field tells you:

| Field | What to do with it |
| --- | --- |
| `domainName` | The registered lookalike. Diff this against your last run to spot new registrations. |
| `createDate` | First registration date. Inside 30 days on a brand-shaped domain is the strongest signal in the whole response. Sort on this field first. |
| `expiryDate` | When the registration lapses. This is your window for a defensive pickup, so treat a near date as a calendar item rather than an alert. |
| `lastSeen` | Last date WhoisFreaks confirmed the domain was registered. Pair with `expiryDate` to anticipate a drop. |
| `isDropped` | True only after a full drop. Read the caveat below before you build logic on it. |

#### And inside each domain object:

| Field | Meaning |
| --- | --- |
| `domainName` | The registered lookalike. |
| `createDate` | When it was first registered. A date within the last few weeks on a brand-shaped domain is the strongest single signal you get. |
| `expiryDate` | When the current registration lapses. Useful for planning a defensive pickup. |
| `lastSeen` | The date WhoisFreaks last confirmed the domain was registered. |
| `isDropped` | `true` only once the domain has **fully dropped** from the registry and is available again. |

One caveat before you build logic on `isDropped`. A domain sitting in redemption grace period or pending delete still reports `false`, even though it may free up within days. The flag tells you about completed drops, not imminent ones. If you are waiting to catch a squat as it drops, watch `expiryDate` and `lastSeen` instead. The [domain lifecycle explainer](https://whoisfreaks.com/blog/domain-lifecycle) covers the states in between.

## Step 4: Widen the Net with a Wildcard Pattern

Keyword matching finds variants of the label itself. It will not find yourbrand-login.com or mygoogle.io, because those are not misspellings. They are your brand plus something else. That is what `pattern` is for:

```
curl --location 'https://api.whoisfreaks.com/v3.0/domain/typos?pattern=*google*&apiKey=API_KEY'
```

The asterisk is the only supported wildcard, and each one matches zero or more characters. Three rules, all enforced server side:

*   Up to three asterisks per pattern, placed anywhere in the string, including the middle as in `goo*gle`.
*   Total pattern length between 3 and 63 characters.
*   No other regex character is supported. `?`, `[`, `]`, `^` and `$` all return 400 Bad Request, and so does a fourth asterisk.

A pattern that wraps your keyword in asterisks returns a superset of the matching keyword= results, so `pattern=*google*` is the broader sweep and keyword=google is the tighter one. Start with the keyword to see the core typo set, then run the pattern to catch the compounds.

#### Patterns worth running for any brand:

| Pattern | Catches | Run it when |
| --- | --- | --- |
| `*brand*` | Everything containing the label, the widest sweep | You want one pass over the full footprint |
| `brand-*` | Suffixed variants such as `brand-login`, `brand-support` | You are hunting credential phishing setups |
| `*-brand` | Prefixed variants such as `secure-brand`, `my-brand` | You are hunting support and account impersonation |
| `br*nd` | Single-character substitutions in the middle | Your brand has a commonly mistyped interior letter |

## Step 5: Page Through the Whole Result Set

totalRecords in the example above is 2,094 across 21 pages, and page size is fixed at 100. To collect everything, send the same keyword or pattern again with pageToken set to the nextPageToken you just received, and repeat until hasNextPage is false:

```
curl --location 'https://api.whoisfreaks.com/v3.0/domain/typos?keyword=google&pageToken=TOKEN&apiKey=API_KEY'
```

Two things to build into that loop. First, every successful page costs 5 credits, so a 21-page sweep is 105 credits. Multiply `totalPages` by 5 before you start, and budget properly if you are sweeping a portfolio of brands rather than one label. Credit allowances per plan are on the [Domain Typosquats API](https://whoisfreaks.com/products/domain-typosquats-api.html) page. Second, drive the loop off `hasNextPage` rather than a page counter you maintain yourself. The token is the API's own bookmark, so it stays correct even if the underlying result set shifts between pages.

## Step 6: Triage the Hits

A wide pattern on a well-known brand returns thousands of rows, most of them parked junk. You need an ordering, and the response already carries enough to build one without a single extra API call:

*   **Recently created and still registered:** A createDate inside the last 30 days with isDropped: false is the top of the queue. Phishing infrastructure is usually registered days before it's used.
*   **Registered, aged, never dropped:** Long-lived lookalikes are typically domainers or a competitor's defensive portfolio. Log them; don't escalate them.
*   **Dropped:** `isDropped` true means the name is free. These are your defensive-registration candidates, not threats.
*   **Expiring soon:** An expiryDate in the next few weeks on a squat you care about is your window to pick it up when it drops.

For the rows that survive triage, enrich before you act. A [WHOIS lookup](https://whoisfreaks.com/resources/tutorial/how-to-use-the-whoisfreaks-api-for-domain-lookups) tells you who registered it and what registrar to complain to, and a **DNS lookup** tells you whether it's live and whether it has MX records - a lookalike with mail configured is being prepared to send, which raises the priority sharply.

Two quirks to expect when you parse those WHOIS responses: domain_registered comes back as the **string** "yes" or "no" rather than a boolean, and domain_status values arrive lowercased instead of in EPP camelCase, so compare against "clienttransferprohibited", not "clientTransferProhibited".

## Step 7: Handle the Failures Before They Bite

#### Four responses to code for:

*   **400 Bad Request:** a malformed pattern. Four or more asterisks, an unsupported regex character, or a pattern shorter than 3 or longer than 63 characters. Validate the pattern locally before you send it.
*   **429 Too Many Requests:** "Please slow down. Your maximum request limit per minute is reached." Read x-ratelimit-remaining-time from the response headers, divide by 1,000,000,000 to get seconds, and sleep that long. Every response carries x-ratelimit-allowed-requests and x-ratelimit-remaining-requests too, so you never need your own counter.
*   **413:** "The requested list size is [GREATER_THAN_100] which exceeds the maximum list size of 100." You'll meet this on the bulk endpoints rather than here, but it's the same 100-item ceiling that governs this API's page size.
*   **Empty domains array with status (true):** a legitimate answer. Short or unusual brand labels genuinely have no registered lookalikes. Treat it as a result, not an error.

Helpfully, **4xx responses do not consume credits**, and neither do throttled requests, so a scan that fails validation costs you nothing but time. Rate limits are enforced per endpoint category rather than globally, and on the free tier live lookups are capped at 10 requests per minute against a 500-credit balance. Read the headers rather than hard-coding an interval - see the [rate limiting](https://whoisfreaks.com/documentation/api-rate-limiting) and [credit usage](https://whoisfreaks.com/documentation/credit-usage) docs.

## Step 8: Turn the One-Off Scan into a Routine

A scan is a snapshot of the registered set at one moment. Newly registered typo variants land in the index within roughly 24 to 48 hours, which means a daily or weekly re-scan catches new squats in the same week they appear - and that a scan you ran last quarter is already stale.

You have two ways to keep it current. Schedule the same request on a cron job and diff domainName values against your last run. Or hand the watching over to [Brand Monitoring](https://whoisfreaks.com/products/brand-monitoring), which sweeps newly registered domains twice daily and emails you when a tracked keyword appears; see [How to Set Up Brand Monitoring on WhoisFreaks](https://whoisfreaks.com/resources/tutorial/how-to-set-up-brand-monitoring-on-whoisfreaks). The API is the pull, Brand Monitoring is the push, and plenty of teams run both.

## Summary

| Step | Action |
| --- | --- |
| 1   | Copy your API key from the dashboard |
| 2   | `GET /v3.0/domain/typos` with `keyword=<brand>` |
| 3   | Check `status`, then read `createDate`, `lastSeen` and `isDropped` per domain |
| 4   | Re-run with `pattern=*brand*` to catch compound squats - max 3 asterisks |
| 5   | Loop on `hasNextPage`, passing `pageToken`, at 5 credits per page |
| 6   | Triage by creation recency, then enrich the survivors with WHOIS and DNS |
| 7   | Branch on 400 and 429, and treat an empty array as a valid answer |
| 8   | Re-scan on a schedule, or switch to Brand Monitoring for pushed alerts |

Two requests, one keyword and one pattern, give you the registered lookalike footprint of your brand along with the dates you need to sort threats from noise.

*   Every parameter, field and error code is listed in the [Domain Typosquats API documentation](https://whoisfreaks.com/documentation/domain-typosquats-api).
*   For endpoint coverage, credit allowances and plan limits, see the [Domain Typosquats API](https://whoisfreaks.com/products/domain-typosquats-api.html).

## Frequently Asked Questions

### How do I find typosquat domains of my own brand?

Send a GET request to https://api.whoisfreaks.com/v3.0/domain/typos with your apiKey and your brand label in the keyword parameter. The API searches registered domains for fuzzy matches of that label and returns them with registration date, expiry date, last-seen date and drop status. Run a second request with pattern=*brand* to also catch compound squats such as brand-login.com.

### Should I use the keyword parameter or the pattern parameter?

Use keyword when you have a single brand label and want fuzzy typo variants of it: substitutions, transpositions, omissions and repetitions. Use pattern when you also want prefix, suffix and compound squats, since a pattern wrapping the keyword in asterisks returns a superset of the keyword results. Pass only one per request.

### How many wildcards can a pattern contain?

At most three asterisks, placed anywhere in the pattern including the middle, and the total pattern length must be between 3 and 63 characters. The asterisk is the only wildcard the API supports; a fourth asterisk or any other regex character such as ?, [, ], ^ or $ returns 400 Bad Request. Validating the pattern in your own code first saves a round trip.

### How do I get all the results instead of the first 100?

Page size is fixed at 100 domains, and the response tells you whether more remain. When hasNextPage is true, send the same keyword or pattern again with pageToken set to the nextPageToken value from the response you just received, and keep going until hasNextPage is false. Each successful page costs 5 credits, so check totalPages before you start a sweep.

### What does isDropped mean?

isDropped is true only after the domain has fully dropped from the registry and is available for re-registration again. Domains sitting in redemption grace period or pending-delete status still report false, even though they may become available within days, so the flag tells you about completed drops rather than imminent ones. To anticipate a drop, monitor the expiryDate and lastSeen fields instead.

### How quickly do newly registered typo domains show up?

Newly registered variants typically appear in the index within 24 to 48 hours of registration, so a daily or weekly scan catches new squats in the same week they are created. If you would rather be told than have to ask, Brand Monitoring sweeps newly registered domains twice daily and emails an alert when a domain matching your tracked keywords appears.

### Can I try typosquatting tool without an account?

Yes. The free [Domain Typosquatting tool](https://whoisfreaks.com/tools/domain/typos) accepts one keyword at a time and returns matching registered domains in the browser without a signup, which is enough to judge match quality for your brand before you write any code. When you are ready to integrate, a new account comes with 500 free API credits and no credit card requirement - enough for 100 pages of results.