check_domain_lookalikes
Detect lookalike domains impersonating a brand by generating typos, homoglyphs, and TLD swaps, then checking DNS and Certificate Transparency data for registered domains.
Instructions
Detect typosquat and lookalike domains impersonating a brand. Generates hundreds of permutations (TLD swaps, character typos, homoglyphs, phishing prefixes/suffixes), resolves them in parallel via DNS, and enriches live results with Certificate Transparency data (cert count, recent issuance). Returns all lookalike domains that are currently registered and resolving. Use to find domains impersonating your brand, or before an employee clicks a link that resembles a company domain. Pay-as-you-go: $0.50 USDC per scan (x402 on Base). Subscription: rapidapi.com/relayshield
Input Schema
TableJSON Schema
| Name | Required | Description | Default |
|---|---|---|---|
| domain | Yes | Root domain to scan (e.g. acme.com — no scheme or path needed) |
Implementation Reference
- Tool schema definition for check_domain_lookalikes — declares name, description, and inputSchema requiring 'domain'.
types.Tool( name="check_domain_lookalikes", description=( "Detect typosquat and lookalike domains impersonating a brand. " "Generates hundreds of permutations (TLD swaps, character typos, homoglyphs, " "phishing prefixes/suffixes), resolves them in parallel via DNS, and enriches " "live results with Certificate Transparency data (cert count, recent issuance). " "Returns all lookalike domains that are currently registered and resolving. " "Use to find domains impersonating your brand, or before an employee clicks a " "link that resembles a company domain. " "Pay-as-you-go: $0.50 USDC per scan (x402 on Base). " "Subscription: rapidapi.com/relayshield" ), inputSchema={ "type": "object", "required": ["domain"], "properties": { "domain": { "type": "string", "description": "Root domain to scan (e.g. acme.com — no scheme or path needed)", } }, }, ), - src/relayshield_mcp/server.py:112-135 (registration)Registered as a tool via the @app.list_tools() handler returning this types.Tool object.
types.Tool( name="check_domain_lookalikes", description=( "Detect typosquat and lookalike domains impersonating a brand. " "Generates hundreds of permutations (TLD swaps, character typos, homoglyphs, " "phishing prefixes/suffixes), resolves them in parallel via DNS, and enriches " "live results with Certificate Transparency data (cert count, recent issuance). " "Returns all lookalike domains that are currently registered and resolving. " "Use to find domains impersonating your brand, or before an employee clicks a " "link that resembles a company domain. " "Pay-as-you-go: $0.50 USDC per scan (x402 on Base). " "Subscription: rapidapi.com/relayshield" ), inputSchema={ "type": "object", "required": ["domain"], "properties": { "domain": { "type": "string", "description": "Root domain to scan (e.g. acme.com — no scheme or path needed)", } }, }, ), - src/relayshield_mcp/server.py:310-315 (handler)Handler dispatch for check_domain_lookalikes — posts to the /domain API endpoint with the supplied domain argument.
if name == "check_domain_lookalikes": return await client.post( f"{base}/domain", headers=headers, json={"domain": arguments["domain"]}, ) - src/relayshield_mcp/server.py:45-53 (helper)Pricing helper mapping the tool name to its pay-as-you-go cost of $0.50 USDC.
PAYG_PRICING: dict[str, str] = { "check_breach": "$0.10 USDC", "check_sim_swap": "$0.25 USDC", "check_domain_lookalikes": "$0.50 USDC", "check_oauth_watchlist": "$0.15 USDC", "check_scan_result": "$0.00 USDC (free — poll result of a paid scan)", "scan_url": "coming soon", "scan_file": "coming soon", }