Lookalike domain monitoring
Greyphish checks every new TLS certificate and domain registration for typosquats, homoglyphs and brand-plus-word combinations of your domain, and shows you what each one is doing.
Free for 1 domain, no card needed. Pro is $19 a month.
The problem
Three real lookalikes of well-known brands, first seen in the last 7 days and picked automatically from public data. Resembling a brand is not proof of intent: many lookalikes are parked, defensive or someone else’s legitimate name, which is why every finding comes with evidence.
Registered and resembles Crypto.com, built from “crypto” + “wallet”.
Displays as marriøtt[.]com
Registered and resembles marriott.com, with a letter swapped for a look-alike character.
Registered and resembles microsoft.com, with one character a bit-flip away.
Domains are defanged: [.] stands for a dot. Read more on combosquatting and homoglyph domains.
How it works
Greyphish generates the names an impersonator would pick: typos, look-alike characters, your name plus words like login, support or my, and the same name on other TLDs. On day one it lists the ones that are already registered.
Certificate Transparency logs are read as certificates are issued. ICANN zone files add newly registered domains once a day, including the ones that never get a certificate.
Each match appears on your dashboard with what we found out about it, and in a daily email digest. On Pro, a webhook fires for every match as it is found.
Each finding
A registered lookalike on its own tells you little. Greyphish checks what it is doing and keeps checking, so the few that matter stand out from the many that never do anything.
Whether it answers on the web, the page title, and whether the page asks for a password.
Published MX records mean the domain can receive email, the setup behind invoice and supplier fraud.
Who it was registered through and when. A lookalike registered the day it was seen is a different story from one held for ten years.
Whether Google’s blocklist already flags it, and when it was listed.
The JARM fingerprint of its server, grouped with other lookalikes answering the same way, and flagged when it matches a known C2 framework.
The other names on the same certificate, which are often the rest of the campaign.
IP, network and country, flagged when the address sits on a known-bad netblock such as Spamhaus DROP.
When it went live, when it was blocklisted, when it went down, the registrar’s abuse contact, and a Netcraft report you approve before it is sent (Pro).
Plans
Every lookalike finding is on both plans. Pro is for more domains and for sending findings to your own tools.
| Feature | Free$0 | Pro$19/month |
|---|---|---|
| Watched domains | 1 | Unlimited |
| Lookalike findings | All | All |
| New hosts on your domain | First 3 per domain | All |
| Email alerts | Daily digest | Daily digest |
| Webhook alerts | — | Every match |
| WHOIS on findings | — | Included |
| Infrastructure map | Cluster sizes | Domains, hosts, nameservers |
| Breach reports | — | Included |
| Findings export | — | TXT, hosts file, CSV |
| API access | — | 10,000 credits |
In the open
The public feed runs the same detection on 1,250 widely impersonated brands, and the numbers are published every week.
Greyphish is built and run by Sima Technologies LLC. About · Contact · API
Questions
dnstwist generates the permutations of a domain and checks them when you run it. crt.sh shows certificates that were already issued, if you search for the right names. Greyphish does both continuously: it checks every new certificate as it is logged and every new registration in the daily zone files against your lookalikes, and attaches evidence to each match so a parked domain does not look like one serving a login page.
At first, possibly: a domain you registered defensively looks exactly like a lookalike. Mark it Mine once and it leaves your dashboard, your exports, your digest and your webhook. A finding that shares your nameservers or registrant organisation, or redirects to your domain, is labelled as probably yours.
No. Greyphish tracks each lookalike from first sighting to takedown and shows the registrar’s abuse contact. On Pro you can send a finding to Netcraft, which asks the host and registrar to remove it if it confirms the site is malicious. Nothing is reported until you have seen and approved exactly what will be sent.
Your email address, a hashed password, the domains you watch and the findings for them. Watched domains are never shown in the public feed, the weekly report or our social posts. Account data is deleted within 90 days of closing your account, and site analytics store no IP addresses and set no cookies.
Yes. The free plan covers 1 watched domain, every lookalike finding for it and the daily email digest, with no card required. Pro is $19 a month and adds unlimited domains, webhooks, WHOIS, exports and API access.
A certificate is checked as soon as it is logged and a match appears on your dashboard straight away. Domains that never get a certificate surface from the next daily zone file. Email is a daily digest; on Pro a webhook fires for each match as it is found.
Typos (dropped, doubled, swapped or replaced characters), homoglyphs including Unicode look-alikes that travel as punycode, your name combined with words such as login, support, secure or my, and your name on other TLDs.
Add your domain and Greyphish lists the registered lookalikes it finds today, then watches every new certificate and registration for more.