Typosquatting and lookalike monitoring
We work out the web addresses an attacker would register to pretend to be you, around 500 for every domain you protect, and re-check every one of them every hour.
The free scan checks 150+ lookalikes of your domain in a couple of minutes and emails you the report. No account, no card.
- 16+ ways of generating lookalikes, from typos to letters that look the same
- 240+ domain endings covered, including country endings
- ~500 lookalikes watched per domain, each re-checked every hour
- 6m+ lookalike domains checked every month, across all customers
What gets generated
For each domain you protect, 16+ methods run across 240+ domain endings and produce around 500 names an attacker would realistically choose, rather than every string that is technically possible. When one is registered, gets a website or is set up to send email, it goes on your watch list. If it looks set up to attack you, you get an alert.
yourcompnay.comTypos (typosquatting)- The mistakes a real person makes typing quickly: swapped, dropped, doubled or transposed letters, and keys that sit next to each other.
yourcornpany.comLetters that look the same (homoglyphs)- An r next to an n reads as an m at a glance. Some alphabets also have letters that look identical to ours, like a Russian а in place of a.
yourcompany-invoices.comYour name plus a word (combosquatting)- The added word usually shows what the attack is: invoice, payment, billing, login, support. Words used in your industry are added too, from the industries you choose for each domain.
yourcompany.coA different ending (domain ending swaps)- Your exact name on a different ending, such as .co instead of .com. There are 240+ domain endings, including country endings, and registering them all yourself is not realistic.
yourcompanyholdings.comYour registered company name- Your legal company name rather than your trading brand. On an invoice these often look more official than your real domain, which is why they work.
- Learned from real attacks
- Patterns taken from real attacks we have handled. An AI model uses them to suggest further names the fixed methods would not produce, and shapes that keep turning up in real cases count for more.
What this cannot catch
A name nobody would predict can slip past a list like this. Our certificate watch and the website marker are there to catch more of those.
The lookalike domain that never builds a website
A lookalike registered to send your customers new bank details usually has no website, just a convincing address and a working mailbox. There is no page for a host to remove, so tools that only look for fake websites never notice it.
We check what each registered lookalike's email set-up can do, and record each change when we see it:
- 1It gets a mail server (MX record), so it can receive replies. This is often the first step.
- 2A sender is given permission to send email for it (SPF record).
- 3A signing key is published (DKIM record), usually the last step before a campaign.
- 4It is listed as malicious on a domain blocklist.
The first three are steps towards sending email. Each one shows on your watch list when we see it, which can be before any email has been sent. A listing as malicious on a domain blocklist raises an alert.
Five signals, each shown on the alert
Most lookalikes never go anywhere. To find the ones being set up for an attack, each is scored on five signals, and the signals add up. When we raise a threat, the alert shows the score and every signal behind it.
- Infrastructure
- Whether the domain uses the same registrar, name servers or email set-up as an attack on you that has already been confirmed. For a new customer this starts empty and builds up with each confirmed attack.
- Name similarity
- Measured against both your domain and your registered company name, because attackers use both.
- Email set-up
- Whether it can receive email, whether a sender has permission to send for it, and whether its emails would be signed.
- Recency
- Dated from when it was set up to send email, not from when it was registered. An old domain set up for email last week is treated as new.
- Website similarityshown, not scored
- A copied site is easy to take down and just as easy to rebuild elsewhere, so it is shown to you but never adds to the score.
Impersonating yourcompany.com
Set up to send email as you, with no website.
Threat signals
- Name built to deceive
- your name + "-invoices"
- Can send email as you
- mail server + permission to send
- Registered today
- set up for email the same day
- Listed as malicious
- on a domain blocklist
Evidence ready: who registered it, its email set-up and an audit trail.
What cannot raise an alert on its own
Anything the domain publishes about itself, such as its email records. An attacker controls those, and so does any ordinary business, so they add to the score but never raise an alert on their own. The domain goes on your watch list, and you can choose to be told when it does.
What is enough on its own
Evidence the attacker does not control: a fake email you have forwarded to us, or the domain being listed as malicious on a domain blocklist.
Attack infrastructure matching
Using the last attack to find the next domain
Attackers reuse their set-up: the same registrar, name servers and email account (for example, the same Microsoft 365 account), because building a new one each time is work.
When you confirm an attack, we record that set-up and re-check every other lookalike of yours against it. The next domain is often already on your list.
How it works
- Confirming an attack re-checks your whole lookalike list, not just new names
- Rarer set-ups count for more: a shared host does not implicate everyone on it
- Brand-protection registrars and parked domains are set aside
- Dismissing a threat removes its set-up from the comparison
What you need to do to start
Step 1
Add your domains
We generate the lookalikes and start checking them. There is nothing to install and no DNS change to make.
Step 2
Choose where alerts go
Email, Slack, Microsoft Teams, SMS, webhook, Splunk, Microsoft Sentinel or Wazuh.
Step 3
Mark the ones that are yours
Lookalikes you registered yourself are recognised and left out once you mark them as yours.
Forward an email you have already received
Forward the original message, because a screenshot is not enough. We find the domain that sent it, record it as a confirmed threat and add the message to the takedown evidence.
Free scan. No account, no card details.
See which lookalikes of your domain already exist
The free scan checks 150+ lookalikes of your domain and shows which are registered and which can send email as you. Monitoring then watches around 500 per domain, every hour.
- Typos, other endings and added words, such as yourcompany-invoices.com
- Which ones are registered, and which are set up to send email as you
- The report in your inbox, usually in a couple of minutes. No account, no card details, no sales call.
Prefer a conversation? Book a demo or see all of monitoring.