Service
Lookalike domain monitoring and cybersquatting detection
Lookalike domain monitoring is the continuous detection of newly registered domains that imitate your brand - through misspellings, alternative extensions, added words, or character substitutions - and the tracking of which ones become live and dangerous. It is the earliest possible warning in the fake-website and phishing chain, because domains are almost always registered well before they are used.
Last reviewed: August 2026
TL;DR
- Attackers register the domain first and weaponise it later - often weeks later. That gap is the opportunity.
- Most lookalike domains sit dormant. The signal that matters is activation: DNS changes, mail records, an SSL certificate, live content.
- Mail records going live on a lookalike domain usually means phishing your staff, customers, or suppliers is next.
- Detection at registration produces evidence and options; detection after launch produces incident response.
The Business Impact
Phishing against your own people
→A lookalike domain with working mail lets an attacker email your staff and suppliers from an address that reads as internal.
Invoice and payment fraud
→One substituted character in a domain is enough for a supplier to pay an attacker's account and believe they paid you.
Clone storefronts
→Registered lookalikes are the raw material for the fake sites that take your customers' orders and card details.
Permanent brand squatting
→Domains parked on your brand name get monetised with ads, resold back to you at a markup, or held indefinitely.
Why It Matters
Every fake website and brand phishing campaign begins with a domain registration, and that registration is public the day it happens. Businesses almost always discover the domain at the end of the chain - when a customer is defrauded or an employee is phished - even though the warning was available weeks earlier. Monitoring converts that public record into lead time, which is the only point in this sequence where prevention is still cheaper than response.
How It Works
- 1Build the permutation setYour brand strings, product names, and executive names are expanded across typo patterns, character substitutions, homoglyphs, hyphenation, added words such as 'login', 'support', 'pay', or 'careers', and the extensions your market actually uses.
- 2Sweep newly registered domains dailyNew registrations across .in, .co.in, .com, .net, .shop, .store, .online, and .app are checked against the permutation set, so a match is caught at registration rather than at launch.
- 3Watch certificate transparency logsCertificate issuance is public and frequently precedes a site going live. A certificate on a lookalike domain is an intent signal that arrives before any content does.
- 4Triage by risk, not by volumeMost matches are harmless - defensive registrations, unrelated businesses, parked inventory. Reporting everything wastes the credibility you need for the ones that matter, so each match is scored on realistic confusion and observed intent.
- 5Monitor activation signalsDNS records resolving, MX records enabling mail, a certificate being issued, or content appearing all move a dormant domain into an active threat. Mail activation is the strongest single escalation trigger.
- 6Act at activationOnce a domain is live and deceptive, it moves into the fake website takedown workflow - hosting and registrar reports, blocklist submissions, and where warranted, a documented evidence pack for INDRP or UDRP.
Where We Work
Registry and registration data
Activation signals
Permutation classes
What To Expect
What this service does
- Detect lookalike registrations close to the day they happen, rather than after they are weaponised.
- Distinguish dormant registrations from activating ones, so alerts reflect real change rather than raw volume.
- Flag mail-record activation, the strongest early indicator of an imminent phishing campaign.
- Hand you a documented registration and activation history, which is exactly what INDRP and UDRP filings are built on.
- Move an activated domain straight into takedown rather than starting the investigation from zero.
What it does not do
- Prevent anyone from registering a domain. Registration is open, and no monitoring service can block it.
- Take action against a dormant lookalike. Registrars require evidence of abusive use, and a domain that resolves to nothing is not yet abusive - premature reports weaken later ones.
- Recover or transfer a squatted domain. That runs through INDRP, UDRP, or a court, which we prepare evidence for but do not represent you in.
- Guarantee complete coverage of every extension. Some registries do not publish usable registration data, and honest coverage has edges.
- Tell you who is behind a registration. Registrant details are redacted by privacy services on most modern registrations.
The Outcome
You learn about domains impersonating your brand while they are still empty placeholders, you see the moment one turns live, and enforcement starts with a documented history instead of a screenshot taken after the damage.
Related
FAQs
Lookalike Domain Monitoring questions
Why monitor domains that are not being used for anything?
- Because dormant is a stage, not a verdict. Lookalike domains are typically registered well before they are used, and that gap is the only period where you have options rather than an incident.
- Continuous monitoring also produces a registration and activation timeline. When a domain does go live, you already hold the documented history that enforcement and INDRP or UDRP filings depend on.
Can you stop someone from registering a domain like ours?
- No, and no provider can. Domain registration is open, and prevention is not a capability that exists at the registry level for ordinary brand names.
- What can be controlled is lead time. Defensive registration of the highest-risk variants is a reasonable complement, but it cannot cover the permutation space, which is effectively unbounded.
What actually triggers an alert?
- Registration of a domain matching the permutation set is logged. Alerts escalate on change: a certificate being issued, DNS beginning to resolve, MX records enabling mail, or content appearing.
- Mail activation is treated as the highest-priority signal, because a lookalike domain that can send email is usually about to be used against your staff, customers, or suppliers.
We already own the .com and the .in. Isn't that enough?
- It covers the two extensions your customers type, which is worth having, but it does not address the attack.
- Impersonation rarely uses your exact name on another extension. It uses a near-miss - an added word, a swapped character, a hyphen - which remains available regardless of how many exact-match domains you hold.
How is this different from the fake website takedown service?
- Domain monitoring is detection and early warning: it watches registrations and tells you when one activates. Fake website takedown is enforcement against a site that is already live and deceiving people.
- They are the two ends of the same chain. Monitoring feeds takedown, and takedown starts from a documented history rather than a cold start.
Already dealing with this? Start with your exposure.
Get Your Free Digital Risk Assessment - a focused review of what is already live against your brand and what to act on first.