Find every domain a registrant owns
A normal WHOIS lookup tells you who owns one domain. This goes the other way: give it a registrant email, name, phone, organization, or address, and it returns every domain we have collected under it. Pivot from one known lookalike to an actor's whole portfolio, including domains they have registered but not yet weaponized. Self-collected from public WHOIS, no third-party data.
Pivot on the registrant email from a domain's WHOIS record to find every other domain that email registered.
Why reverse WHOIS matters for brand protection
Phishing and typosquat campaigns are rarely one domain. An operator registers a batch of lookalikes at once (often through the same registrar, in the same window, sometimes under the same unmasked registrant), then parks them until they are ready to weaponize one for a phishing page or a business-email-compromise lure. If you only react to the domain that finally goes live, you are always one step behind. Pivoting on the registrant lets you enumerate the rest of the batch before it is used.
Four ways to pivot
Registrant email is the strongest signal when it is present. Pull the registrant email from a known malicious domain's WHOIS record and search it here to surface everything else that email registered. Registrant name and company / org work the same way for records where the registrant used a real, unmasked identity. Domain keyword is a prefix sweep: enter your brand term (for example, your company name) to list domains that begin with it, which is the most reliable way to hunt lookalikes when registrant contact data is redacted.
The GDPR redaction caveat
Since 2018, most registrars redact registrant contact details in public WHOIS, so email and name pivots are most effective on older records or on registrants who chose not to use privacy protection. When contact data is masked, lean on the domain-keyword sweep. Registration dates are almost always public, which is why we highlight domains registered in the last 90 days: a cluster of fresh lookalikes is the clearest early warning you will get.
Turn a one-time pivot into continuous coverage
This is a point-in-time lookup. SecurityAlert.ai's Brand monitor watches your brand continuously, generating lookalike and typosquat permutations, watching new domain registrations, and alerting via email, Slack, Teams, or Webhook the moment a new impostor appears, with an evidence pack and a human-approved takedown draft ready to file. See plans.
Related free tools
Phishing & reputation scan · SSL security grader · Credential exposure check · Universal IOC lookup