Domain Label Search (searchlabels)

Overview

The datapulse_dns_searchlabels tool is the primary tool for finding typosquatting, brand impersonation, and lookalike domains. It searches the DataPulse database for domain labels matching a search term, and returns each label along with the TLDs where it is listed in the corpus.

The label searched is the PSL+1 label — the registrable label sitting one level below a public suffix (google in google.com, example in example.co.uk). Hostnames and subdomains are not indexed and cannot be searched: DataPulse’s unit of analysis is the registrable domain, so a name like a.b.c.foo.com is represented in the corpus only as foo.com. See datapulse_help(topic="methodology").

This gives a complete picture of a string’s presence across the domain namespace — one label match may span dozens of TLDs.

Parameters

Response Format

The response is CSV with a header row followed by data rows, ordered by increasing score (nearest matches first). Up to two lines can come before the header: error: <text> when the API reported an error alongside its rows, and complete: false (...) when the label limit was reached or the API cut its answer short. Read past them to the label,type,score,tlds line before parsing:

label,type,score,tlds
g00gle,fuzzy,2,com|net|org|info
googl3,fuzzy,3,com|net
google-login,substring,6,com|net|org|info|co.uk

The tlds column is a pipe-delimited list of every TLD where the label is listed — the complete set, with no cap or truncation. Listed is not registered: the corpus holds only active, functioning names (see datapulse_help(topic="methodology")), so a TLD missing from the list may still be registered — parked without DNS, not resolving, or too new to be listed. In a defensive-registration audit, confirm a gap with datapulse_live_rdap before calling the name available.

The list of labels is capped, though (100 in production; the tool description states the deployment’s cap): a line complete: false (the N-label result limit was reached; more labels likely exist) above the header means the search returned as many labels as the limit allows and more matching labels exist beyond it.

Do not fabricate beyond what is returned. The tlds list is authoritative and complete; treat it as the full set. Do not add TLDs, domains, or ownership/market/“defensive” annotations that are not present in the tool output. Registration of a label in a TLD does not establish who owns that domain — registrant identity is GDPR-redacted and this tool does not return it (see datapulse_help(topic="registrant_lookup")). If asked which of these a specific company owns, say that ownership cannot be confirmed from label data.

Match Types

Score

The score field is an edit distance — lower values mean a closer match. A score of 0 is an exact match; a score of 1 means one edit (a substitution, insertion or deletion) from the query. Typical fuzzy results range from 1-8.

Fuzzy Matching

Fuzzy matching is built for lookalikes:

• Homoglyphs: Visually similar characters (0/O, 1/l/I, rn/m): paypa1, paypai
• IDN abuse: Unicode characters that look like ASCII (а Cyrillic vs a Latin), returned as xn-- labels

It does not systematically find plain typos — an omitted, transposed or adjacent-key letter. A fuzzy search for paypal (2026-10-06) filled the 100-label limit with IDN variants at distance 1 and left out paypl, which an exact search finds under 18 TLDs. A fuzzy search for a rarer term can return nothing at all. An empty or typo-free fuzzy result is therefore not evidence that typo domains do not exist.

To cover typos, generate the variants yourself (omissions, duplications, transpositions, adjacent keys, hyphen changes) and search each one with filter=["exact"]:

datapulse_dns_searchlabels(search_term="paypl", filter=["exact"])
datapulse_dns_searchlabels(search_term="papyal", filter=["exact"])

Use Cases

1. Typosquatting Detection

Find labels targeting a brand:

datapulse_dns_searchlabels(search_term="microsoft")

Then investigate low-score fuzzy matches (closest to the brand) with:

• datapulse_live_rdap — Check registration details
• datapulse_dns_dptechsim — Find related infrastructure
• datapulse_dns_dphistory — Check historical patterns

2. Brand Monitoring

Find all labels containing a brand name:

datapulse_dns_searchlabels(search_term="acme")

The TLDs column immediately shows how widespread each variant is — a fuzzy match listed in 15+ TLDs is more concerning than one in a single TLD.

3. IDN Abuse Detection

Search for a brand to find IDN homograph attacks:

datapulse_dns_searchlabels(search_term="paypal")

4. Defensive Registration Audit

Check whether your brand’s defensive registrations cover common typo variants:

datapulse_dns_searchlabels(search_term="yourbrand")

Compare the TLD spread of fuzzy matches against your known defensive portfolio.

Workflow Examples

Typosquatting Investigation

searchlabels("brand") → filter fuzzy matches → dptechsim(top_hit.tld) → dphistory(matches) → live_rdap(suspicious)

1. Search for brand name
2. Filter results to fuzzy matches with low scores (closest matches)
3. Note TLD spread — high TLD count on a fuzzy match is a red flag
4. Check infrastructure similarity for top hits
5. RDAP on suspicious domains

Brand Protection Audit

searchlabels("company") → group by match_type → live_rdap(label+tld combos) → identify unowned

1. Search for company name
2. Categorize by exact/substring/fuzzy
3. Check registration details (registrar, dates, status) via datapulse_live_rdap for concerning label+TLD combinations — registrant identity is GDPR-redacted
4. Flag domains whose registrar/infrastructure doesn’t match the company’s known portfolio

Domain Dispute Analysis

searchlabels("brandname") → find lookalike labels + TLD spread
→ live_rdap(suspect_domain) → registration details
→ disputedb_search("confusing similarity <trademark> <domain>") → case precedents

Relationship to Other Tools

If you are investigating hostnames that place a trusted brand in the leftmost label while hiding attacker control in the registered domain, see datapulse_help(topic="subdomain_cloaking").

Error Handling