Find the domains pretending to be you
We watch around 500 web addresses made to look like each of yours, such as yourcompany-invoices.com. We re-check them every hour and alert you when one looks set up to attack you.
The free scan checks 150+ lookalikes of your domain in a couple of minutes and emails you the report. No account, no card.
- ~500 lookalikes watched per domain, each re-checked every hour
- 240+ domain endings covered, from .com to country endings
- 100+ public certificate logs watched as new entries appear
- 8 alert channels to choose from
How fast these attacks move
In one case we handled, a replacement fake domain was registered and sending fraud emails 28 minutes later.
That is why every lookalike we watch for you is re-checked every hour, and why we also watch public certificate logs as new entries appear.
A fake domain has to exist before the first fake invoice can be sent, and we watch for that moment.
28 min
Fake domain taken down
Replacement registered and sending fraud emails
Four checks along an attacker's path
An attacker registers a lookalike, sets it up to send email, gets a certificate and copies your website. Each check watches for one of those steps, so a lookalike missed by one can still be caught by the next.
Layer 1 Lookalike monitoring
We watch the names an attacker is most likely to register
We work out around 500 lookalikes of each domain you protect: typos, letters that look the same, your name plus a word like -invoices, and other endings like .co. Every one is re-checked every hour. When one is registered or gets a website, it goes on your watch list. If it looks set up to attack you (for example, its website copies yours), you get an alert.
How lookalike monitoring worksLayer 1 Mail-armed detection
We spot when a lookalike domain is set up to send email
Many attacks never build a website. A lookalike that can send email is enough to send your customers new bank details. When one gets a mail server, permission to send or a signing key, it goes on your watch list, and you can choose to be told. If a blocklist that spam filters use lists it as malicious, you get an alert.
Why email-only lookalikes matterLayer 4 Certificate monitoring
We watch public certificate logs for your name
Every security certificate (the padlock) is recorded in a public log when it is issued. We watch 100+ of those logs as entries appear and look for your brand name anywhere in the address: on endings you never use, with hyphens added, with letters that look the same, or on a fake login subdomain of someone else's domain. This can show a site being set up before it goes live.
How certificate monitoring worksLayers 2 and 3 Clone detection
We find copies of your website
Two layers work together. With embedded markers, the website marker (an optional small script or 1×1 image on pages you choose) tells us when a copy of the page loads somewhere else. Content fingerprinting searches the web for your site's wording, which finds copies rebuilt without your code.
How clone detection works
What this cannot catch
We watch around 500 names per domain that an attacker is most likely to use. A name nobody would predict can slip past that list. The certificate watch and the website marker are there to catch more of those.
What lands in your inbox
Every lookalike is sorted automatically: threats are alerted, doubtful ones go on a watch list, and the rest are marked safe. On Pro, someone on your side reads each alert. On Enterprise, our analysts check every alert first.
Evidence collected for you
Screenshots, who registered it and when, where it is hosted, its email set-up and its certificate.
A reason for every alert
What we found, why it matters and what to do next, with each signal behind the rating listed.
Sent where your team works
Email, Slack, Microsoft Teams, SMS, webhook, Splunk, Microsoft Sentinel or Wazuh.
If a lookalike is yours, mark it as yours and it leaves the threat list. If an alert is wrong, dismiss it. No report goes to anyone outside your company until you confirm a takedown.
Evidence pack
yourcompany-login.com- Screenshots
- Your page and the copy
- Who registered it
- Registrar and registration date
- Hosting
- Provider and abuse contact
- Email set-up
- Receives and sends
- Certificate
- Issued today
- Audit trail
- Every step timestamped
- Sent to
- Email and Microsoft Teams
If it's already live, start the takedown from the alert
The evidence is already attached. Once you confirm it is a live attack, one click sends it to up to 12 places that can act on it, all at once.
Browser warnings and blocklists
The blocklists that spam filters use get the report. When there is a website, so do the browser warning lists behind the red warning screens.
The companies that can switch it off
The registrar, the host and the email provider it uses get the evidence pack. When there is a website, search engines are asked to drop it from their results.
Automatic follow-up
If they have not acted, we chase the host and registrar at 48 and 96 hours, then go to the registry at 120 and 168 hours.
What you need to do to start
Step 1
Add your domains
Lookalike monitoring, certificate watching and the daily check of your own domains need nothing else.
Step 2
Choose where alerts go
Email, Slack, Microsoft Teams, SMS, webhook or your security tools.
Optional
Add the website marker
A small script or a 1×1 image on the pages you choose. You can leave it out.
Free scan. No account, no card details.
See which lookalikes of your domain already exist
The free scan checks 150+ lookalikes of your domain and shows which are registered and which can send email as you. Monitoring then watches around 500 per domain, every hour.
- Typos, other endings and added words, such as yourcompany-invoices.com
- Which ones are registered, and which are set up to send email as you
- The report in your inbox, usually in a couple of minutes. No account, no card details, no sales call.
Prefer a conversation? Book a demo or see pricing.