Lookalike domain guides
How impersonation domains are built, how to find the ones aimed at you, and what to do about them. The figures come from what Greyphish sees in Certificate Transparency logs and ICANN zone files every day.
How to find lookalike domains of your company
Generate the names an impersonator would pick, find out which already exist, and sort the handful that matter from the thousands that do not.
What is combosquatting? Examples from 5,600 domains
A combosquat keeps the brand spelled correctly and adds a word around it. They are the newest lookalikes we see when they appear, often only days old.
Homoglyph and punycode domains, explained
A homoglyph domain swaps a letter for one that looks the same. Some swaps stay in plain ASCII; others need Unicode and travel as punycode.
Monitoring Certificate Transparency logs for phishing domains
Every publicly trusted certificate is logged before browsers accept it. That makes the logs one of the earliest public signs that a lookalike is being set up.
Someone registered a domain like yours: what to do
Most lookalikes never do anything. The ones that do need evidence, the right abuse contact and a little patience. Here is the order that works.
Lookalike domains with MX records: the email risk
A lookalike with mail records can sit inside a supplier thread for weeks. More than a quarter of the registered lookalikes we checked could receive email.
- Data
Lookalike domain report
Weekly lookalike volume by type, the registrars they come through, how old they are when first seen, and how long the live ones stay up. Updated hourly.