---
title: "Retrieve typosquat details for a domain."
method: GET
path: "/typosquat/details"
tags: ["typosquat"]
---

# Retrieve typosquat details for a domain.

`GET /typosquat/details`

## Request

- Base URL: `https://cyber-risk.upguard.com/api/public`
- URL: `https://cyber-risk.upguard.com/api/public/typosquat/details`
- Auth: API key in header `Authorization`
- TypeScript: <https://skmtc.dev/upguard/apis/upguard-cyberrisk-api/docs/typosquat/details/get.ts> (a function with typed inputs; its response is checked against the schema)

If the requested domain is not enabled a 404 will be returned.
Use the /typosquat to retrieve the list of enabled domains first.

Required API key permissions: `BreachRisk` (select when creating API key in Account Settings)

## Query parameters

- `domain` string, required

## Response `200`

A list of typosquat domains

- GetTyposquatDetailsResponsePayloadBody
  - `ignored` TyposquatPermutationDetail[]: The list of ignored permutations
    - `a_records` string[]: The list of A records associated with the permutation. If no A records are associated with the permutation this field will be omitted.
    - `country` string: The country where the permutation is registered. If missing the field will be omitted.
    - `date_detected` string, date-time: The date the registered permutation was detected in RFC3339 format. If missing this field will be omitted.
    - `hostname` string: The hostname of the permutation
    - `hostname_dns_blocklists` TyposquatHostnameDNSBlocklists[]: The list of associated hostnames found on DNS blocklists and the blocklists they were found on. If no DNS blocklists are associated with the permutation this field will be omitted.
      - `dns_blocklists` TyposquatDNSBlocklist[]: The list of DNS blocklists the hostname was found on
        - `activity` string: The suspected malicious activity associated with the DNS blocklist
        - `name` string: The name of the DNS blocklist
      - `hostname` string: The hostname associated with the permutation
    - `mx_records` string[]: The list of MX records associated with the permutation. If no MX records are associated with the permutation this field will be omitted.
    - `ns_records` string[]: The list of NS records associated with the permutation. If no NS records are associated with the permutation this field will be omitted.
    - `permutation_type` string
  - `registered` TyposquatPermutationDetail[]: The list of registered permutations
    - `a_records` string[]: The list of A records associated with the permutation. If no A records are associated with the permutation this field will be omitted.
    - `country` string: The country where the permutation is registered. If missing the field will be omitted.
    - `date_detected` string, date-time: The date the registered permutation was detected in RFC3339 format. If missing this field will be omitted.
    - `hostname` string: The hostname of the permutation
    - `hostname_dns_blocklists` TyposquatHostnameDNSBlocklists[]: The list of associated hostnames found on DNS blocklists and the blocklists they were found on. If no DNS blocklists are associated with the permutation this field will be omitted.
      - `dns_blocklists` TyposquatDNSBlocklist[]: The list of DNS blocklists the hostname was found on
        - `activity` string: The suspected malicious activity associated with the DNS blocklist
        - `name` string: The name of the DNS blocklist
      - `hostname` string: The hostname associated with the permutation
    - `mx_records` string[]: The list of MX records associated with the permutation. If no MX records are associated with the permutation this field will be omitted.
    - `ns_records` string[]: The list of NS records associated with the permutation. If no NS records are associated with the permutation this field will be omitted.
    - `permutation_type` string
  - `unregistered` TyposquatPermutationDetail[]: The list of unregistered permutations
    - `a_records` string[]: The list of A records associated with the permutation. If no A records are associated with the permutation this field will be omitted.
    - `country` string: The country where the permutation is registered. If missing the field will be omitted.
    - `date_detected` string, date-time: The date the registered permutation was detected in RFC3339 format. If missing this field will be omitted.
    - `hostname` string: The hostname of the permutation
    - `hostname_dns_blocklists` TyposquatHostnameDNSBlocklists[]: The list of associated hostnames found on DNS blocklists and the blocklists they were found on. If no DNS blocklists are associated with the permutation this field will be omitted.
      - `dns_blocklists` TyposquatDNSBlocklist[]: The list of DNS blocklists the hostname was found on
        - `activity` string: The suspected malicious activity associated with the DNS blocklist
        - `name` string: The name of the DNS blocklist
      - `hostname` string: The hostname associated with the permutation
    - `mx_records` string[]: The list of MX records associated with the permutation. If no MX records are associated with the permutation this field will be omitted.
    - `ns_records` string[]: The list of NS records associated with the permutation. If no NS records are associated with the permutation this field will be omitted.
    - `permutation_type` string

## Other responses

- `404`: The requested domain is not enabled.
- `422`: An invalid parameter was supplied or a mandatory parameter was missing
- `429`: Too many requests have been made to this endpoint.
- `500`: An internal system error occurred

---

[API](https://skmtc.dev/upguard/apis/upguard-cyberrisk-api.md) - [All operations](https://skmtc.dev/upguard/apis/upguard-cyberrisk-api/llms.txt) - [OpenAPI document](https://skmtc.dev/upguard/apis/upguard-cyberrisk-api/revisions/d044bf6dc61e?raw)