Solutions / Lookalike & misspelled domains

The domains that look like yours, caught before they are a real problem.

Misspellings, character swaps, and hyphenated versions get registered against recognisable brands every day. We pick them up at registration and watch for the moment one is pointed at something, whether that is a login page, a payload, or a mail server.

New domain watch● WATCHING
new certificate · acme-invoices.net
new domain · аcme.com · swapped letter
new certificate · acmegroup.io · sitting empty
new domain · acrne.com · typo
acme-uk.co · moved to a new hosting company
new certificate · acme-invoices.net
new domain · аcme.com · swapped letter
new certificate · acmegroup.io · sitting empty
new domain · acrne.com · typo
acme-uk.co · moved to a new hosting company
SUSPECT DOMAIN · LETTER BY LETTER
acme.comYOURS
аcme.comLOOKALIKE LETTER
CHECKING…REPORTED
should be caught before an email is sentNO MAIL RECORDS
142 CLEARED · 3 WATCHED · 1 REPORTED · LAST 24H

Most impersonation starts with a domain, and almost none of it starts the day that domain is bought. A near-copy of your name gets registered, sits empty while it ages, then one day it is a login page collecting passwords, a file handing out malware, or a mail server sending invoices. Everything worth doing happens in that gap, which is why the watch starts at registration and not at the first complaint.

How it works

How a lookalike gets caught before it is used.

01

Watch

New registrations, changes to where a name points, and the public log of new website certificates (certificate transparency), checked against your brand and domain patterns.

02

Score

Each name is sorted. Empty and unrelated ones stay on the quiet watch list, where the signal that counts is a name with nothing on it suddenly gaining a page, a certificate, or mail records.

03

Report

The moment a watched name is pointed at a page, a payload, or a mail server, it goes to the domain seller (registrar), the hosting company, and the content delivery network (CDN), through integrations we already have in place.

04

Track

Evidence, timings, and how it ended are recorded for every case, exportable for audit.

In scope

The indicators we watch for.

This runs on Website monitoring and Takedowns, to watch the public domain records for names built to look like yours, then get them removed once they start hosting or sending.

Your own brands and domains, with what is covered confirmed in writing before you sign.

Typos, swapped letters & lookalike characters
Names using lookalike foreign letters
Added words, hyphens & endings
Old names of yours picked up by others
Empty names that gain a page, mail or malware
New security certificates using your name
FAQ

See where your brand is exposed right now.