Lookalike domain monitoring
Catch the domain that's pretending to be you.
Phishing campaigns and invoice fraud start the same way: someone registers a domain one character away from yours and emails your customers or suppliers from it. The losses land on your counterparties, and the damage lands on your reputation. Attack Surface Scan works out the plausible imitations of your domain, watches public records for them, and alerts you when one is registered or goes live, while it's still parked and before it's in anyone's inbox. For a one-off look, run the free lookalike domain checker.
No card required to start. Plans from $25/month, flat; first report in minutes.
Why lookalikes work
One character is enough
examp1e.com, exarnple.com, example-billing.com. Under time pressure, in an email client's font, they all read as you. That's the entire trick, and it keeps working.
The target is your counterparties
Lookalikes are used against your customers and suppliers more than against you: a fake invoice with changed bank details, sent from a domain that passes a glance.
Registration is the tell
A campaign needs the domain first, then usually a certificate or email set up. Those steps are visible in public records days or weeks before the first email lands, if anyone is watching.
Nobody owns the watching
Checking registrations by hand is nobody's job, so it never happens. The first signal most companies get is a confused customer forwarding the phish.
What changes with Attack Surface Scan
Imitations worked out, then watched
Typos, look-alike characters, swapped endings and added words, generated from your verified domains and checked continuously against public records. The suspect domains are observed only, never contacted.
Alerted at registration, not at impact
A newly registered lookalike, a certificate issued for one, or one set up to send email or serve a website each raise an alert: the earliest points at which you can act.
Evidence ready for a takedown request
The finding carries what was observed and when, which is the packet a registrar's abuse desk or your legal team needs to start a complaint.
Part of the same feed
Lookalike events land in the same change feed and alert channels as everything else: one place to watch, not another portal.
Lookalike monitoring is included on the Growth plan and above; see pricing. How variants are generated and judged is in the documentation.
What you can show
An answer to the impersonation question
Insurers and customer questionnaires ask what you do about phishing and brand impersonation. A dated record of lookalikes detected, and what you did about each, is a concrete answer.
A warning your customers can act on
When a lookalike goes live you know its exact name, so you can warn customers and suppliers before the first fake invoice arrives rather than after.
Common questions
Can Attack Surface Scan take a phishing domain down?
No. Takedowns go through the registrar or hosting provider's abuse process. Attack Surface Scan's job is to hand you the early warning and the evidence so that process starts on day one instead of after the campaign.
Will I be flooded with alerts for parked domains?
No. Most variant registrations are unremarkable, and the watch distinguishes states: registered, given a certificate, set up for email or a website. You hear when something changes state, and like every finding, ones you've assessed can be accepted or muted.
Is monitoring someone else's domain legal?
The watching is reading public records: the same lookups any mail server performs, and the public logs of issued certificates. Attack Surface Scan never probes or interacts with the lookalike's systems.
Which plans include lookalike monitoring?
Growth and above, including the MSP plan. The free lookalike domain checker runs the same logic once, with no signup. See pricing.
Know the day the lookalike appears.
Verify your domain and the lookalike watch starts with your first check.
Start your 7-day trialNo card required to start. Cancel any time.