Solution / Domain spoofing detection

Domain spoofing detection before the first phishing email

We generate tens of thousands of lookalikes of your domain, find the ones that get registered, watch them around the clock and take down those that turn hostile, with the evidence to prove it.

Start free trial See how it works
  • Lookalikes found: 612, Live sites: 438, Taken down: 14.
  • northwind-login.example: Combosquat, Live phishing, then taken down, risk 97.
  • northwind-support.example: Combosquat, Registered, then live phishing, risk 58.
  • northwind.invalid: TLD swap, Parked, risk 28.
  • northwind-shop.example: Combosquat, Live phishing, risk 88.
  • northwlnd.example: Homoglyph, Live phishing, then taken down, risk 94.
  • northvvind.example: Homoglyph, Registered, risk 41.
  • nortwind.example: Typo, Parked, risk 34.
  • northwind.test: TLD swap, Taken down, risk 12.
  • Each phishing site is shown with a screenshot, its logo similarity, its hosting and the takedown progress: Draft, Sent, Blocked, Taken down.
45+permutation algorithms
30k–70kvariations per domain
14monitors per lookalike
Livefor certain sources, 30 min for threats

The detection engine comes from SpoofGuard, our sister company for domain threat intelligence.

Why it matters

One letter off, and nobody notices.

A lookalike domain costs a few dollars and a few minutes. To your customers, staff and suppliers it looks like you.

The risk

  • PhishingLogin pages that copy your sign-in and collect passwords.
  • Invoice fraudEmails from a domain one letter off, asking to change bank details.
  • Fake shops and supportSites that sell, charge or “help” in your name.
  • MalwareDownloads and updates offered from a domain that looks like yours.

The value

  • Early warningSee lookalikes when they are registered, long before the first campaign.
  • EvidenceScreenshots, logo match, DNS and mail records show what each domain does.
  • ActionBlock them in your mail gateway, warn your people, and take them down.
  • TrustFewer customers and partners fooled in your name.
In the dashboard

From one domain to a takedown, step by step.

Scan your own domain
Dashboard tour

Step 1 of 8: Brand library. Set up once, every scan reuses it

Fictional brand and data. All domains and IPs are reserved for documentation.

Find

45+ ways to fake your domain. We try them all.

We generate every variation an attacker would register, then check which ones exist. On top, we watch the places where new lookalikes show up first.

  • TyposMissing, swapped, doubled or neighbouring letters.
  • HomoglyphsCharacters that look alike, including Unicode and punycode.
  • TLDsOther endings, appended endings and subdomains.
  • BitsquatsOne flipped bit, as caused by faulty memory and devices.
  • CombinationsYour name plus words, plurals, hyphens and dynamic DNS.
northwind.example
41,870variations generated for northwind.example

Missing, swapped, doubled or neighbouring letters.

  • nortwind.exampleletter missing
  • northwnid.exampleletters swapped
  • northwinnd.exampleletter doubled
  • nprthwind.exampleneighbouring key
Plus outside sources
New domain registrationsCertificate transparency logsSearch and social adsPhishing and malware listsWeb directories
northwind-login.example
  • Domain ageRegistered 3 days ago
  • StructureBrand name plus “login”
  • Mail serverMX record set: can send email
  • CertificateCertificate issued yesterday
  • Redirects2 redirects before the page
  • Web formsAsks for email and password
  • Logo matchYour logo found on the page
  • Brand keywords3 of 3 keywords on the page
  • ObfuscationHidden script loads a form
  • BlocklistsNot listed yet
URL score0
Threat: request a takedown
Judge

Every registered lookalike, checked automatically.

Each domain gets a screenshot, a logo and brand match against your brand library, its DNS and mail records, and a URL score that explains itself.

Blocklists and malware databases
20
Website history and popularity
85
Website content and behaviour
92

Each check comes with a plain-language reason, so you can see why a score is high.

Watch

Parked today, phishing next week.

Most lookalikes start harmless. We keep watching each one, and check it more often the closer it gets to an attack: from once a month for dormant domains to every 30 minutes for active threats. Certain sources are live: new data is in our database the moment it comes in.

A lookalike’s life

Illustration with a fictional lookalike: northwlnd.example imitates northwind.example

State 1 of 8: UnregisteredGenerated from northwind.example. Nobody owns it yet. Checked monthly (example schedule; 7 tiers, from monthly to every 30 minutes).

14 monitors in 5 groups

  • A record
  • MX record
  • NS record
  • Open ports
  • HTTP(S) status
  • Content change
  • Content spoofing
  • TLS & CT log
  • SPF/DMARC/DKIM
  • WHOIS changesnot registered (fired now)
  • Phishing score
  • Risk score
  • Ads abuse
  • Visual similarity

Event log relative times

  1. StartVariant generated: i → l
  2. WHOIS: not registered yet
Act

From detection to takedown.

One click turns a lookalike into a takedown request. We find the abuse contacts, attach the evidence and your signed power of attorney, and track every recipient. Takedowns are fully included in your plan.

  • EvidenceYour site and the lookalike side by side, with screenshots, DNS and WHOIS.
  • RecipientsHosting provider and registrar, found automatically, plus browser and anti-phishing blocklists.
  • AuthorityA signed power of attorney lets the request act on your behalf.
  • TrackingEvery recipient’s status and every reply, in one place, with email updates.
northwind-login.example
  • Hosting providerabuse contact found
  • Domain registrarabuse contact found
  • Browser blocklistselected
  • Anti-phishing listselected
Signed power of attorney attached
  1. Draft
  2. Sent
  3. Blocked
  4. Taken down

Blocklists matter when a provider reacts slowly or not at all.

Takedown activitynorthwind-login.example
  1. nowAutomatedRequest sent to hosting provider and registrar
  2. 2 min laterAutomatedBrowser and anti-phishing blocklists notified
  3. 20 min laterAnalystEvidence reviewed and complete
  4. next dayWatchNo reply from the hosting provider
  5. next dayAnalystEscalated to the provider’s abuse team
  6. 2 days laterProviderSite suspended by the hosting provider
  7. 2 days laterAnalystVerified offline, monitoring continues

Visible to you in real time. Fictional example.

Analyst driven

Every takedown has oversight. Escalated when it matters.

Automation sends the requests. Our takedown team follows up every single one by hand, escalates when a provider does not act, and keeps you informed at every step.

  • OversightAn analyst follows each takedown from the first request to the confirmed removal.
  • EscalationNo reply or no action? The team escalates through further contacts and channels until the request is resolved.
  • TransparencyYou see every step in the dashboard: who was contacted, every reply, every escalation and the current status.
  • QualityA dedicated team that does this every day, to a high standard of care.
Details

Everything in the module, in short.

Start with one domain

See who is pretending to be you.

Start a free trial and scan your domain for lookalikes, or book a demo to see monitoring and takedowns for your brand.

Start free trial Book a demo