NatWest Group plc

Generated spellings we track

Spellings generated from this organization's official domains and brand tokens (typos, keyboard slips, lure words, look-alike characters, other top-level domains). Each one is checked against phishing feeds, certificate logs and DNS. A spelling that exists is not a finding and not a verdict: it may be unrelated, legitimate or registered defensively.

Last feed and certificate-log check 2026-10-19 05:45 UTC. “Not observed” means none of our checks has seen the spelling; it is not proof the name is unregistered. “Newly registered” means the spelling appeared in a newly-registered-domain list or as a new name in a zone file on that day (sources and terms on the Sources page); it is not a registration date. An observed spelling is not a finding: reported abuse appears only under Reported matches, from independent source evidence. Feed presence counts hosts from approved sources only; certificate presence comes from the public logs described on the Certificates tab; DNS checks cover the apex name and are refreshed on a schedule. Under each address: network (AS) and country come from the public iptoasn.com routing dataset; a reverse-DNS name is what the address's owner published. Neither shows who controls the hostname: shared hosting, CDNs and cloud providers put unrelated names behind one address. Mail (MX, SPF, DMARC) is checked only for spellings observed somewhere; mail records show the domain can send or receive mail; they do not show who operates it. The provider named under the chips is read from the first MX host (a curated list of mailbox, hosting, parking, forwarding and registrar services; otherwise the host itself); “sends via” lists the services the SPF record authorises; the DMARC policy is the published p= tag. A red MX or SPF chip names the IP list an address behind the record is on (the MX host's address, or an SPF ip4 range of the record or of the services it includes), checked at page view against the lists approved for display. Mail providers and sending services are shared, so a listing says nothing about who operates the domain. The last bulk DNS check of every tracked spelling finished 2026-10-19 11:34 UTC (784,714 names).