Observed arrival · 2026-08-25
Evil Twin, the lookalike-domain scanner
A browser-based security tool that generates plausible brand-imitating domains and checks which are registered, live, or configured to receive email.
Field notes
The scanner generates several families of lookalikes, including adjacent-key typos, TLD substitutions, hyphen variants, and internationalized domains encoded as punycode. It then checks registration, live-site status, and MX configuration, treating mail capability as a more consequential signal than a parked or merely registered domain. DNS queries run client-side through Cloudflare or Google encrypted DNS-over-HTTPS, while screenshots come from urlscan.io's public archive.
Observed signals
Read the marks
Editorial observations of this landing page, not a rating.
One card from the complete issue