Greyphish watches newly issued certificates and newly registered domains for lookalikes of the domains you care about. Add your domain and it generates the variations an impersonator would register, checks every new domain against them, and puts each match on your dashboard with a daily email digest of what was found.
Organisations whose customers could be sent to a convincing copy of their login page, and the security teams and consultants who watch domains on their behalf. A lookalike usually needs a certificate before it can host a believable page, which is often the first public sign that one exists.
You watch registrable domains such as yourcompany.com. The free plan watches one domain; Pro watches as many as you own, adds WHOIS on each finding, sends each match to a webhook and exports your findings for blocklists and SIEM ingestion. See pricing.
For each watched domain, Greyphish generates permutations with the techniques attackers use: character swaps, omissions and repetitions, homoglyphs (letters replaced by visually identical characters, including Cyrillic), hyphenation, added words, and the same name under another TLD. A new domain that matches one of those permutations becomes a finding.
Each finding carries a confidence score: how much of your name the lookalike had to change, measured after replacing look-alike characters with the letters they imitate. A homoglyph a person cannot see scores as a near-certain copy; one visible edit to a long name scores high, while the same edit to a short acronym scores lower because it often lands on another organisation's real name. You mark findings as Not a threat or Mine, and those are left out of your view and your exports.
The public live feed runs the same matching against a list of widely impersonated brands, so you can see the detection working before you sign up.
Greyphish is built and operated by Sima Technologies LLC. Questions, corrections and security reports go to the address on the contact page.