Nearly every invoice fraud and executive impersonation we investigate used a domain that looked like the victim's or a message that spoofed it. This module watches the domains that imitate yours from the moment they are registered, alerts when they are weaponised and closes the gaps that let attackers send mail in your name.
| Domain | Similarity | Signals | Status |
|---|---|---|---|
| yourbrand-secure.example | 92 | MXTLSWEB | Live phishing |
| y0urbrand.example | 88 | MXTLSWEB | Weaponising |
| yourbrand-login.example | 84 | MXTLSWEB | Certificate issued |
| yourbrand.example-co | 61 | MXTLSWEB | Parked, watching |
| yourbrnad.example | 79 | MXTLSWEB | Removed |
Typosquats, homoglyphs, added words, alternative extensions and subdomain tricks: criminals register lookalike domains days or weeks before using them, and most of them are harmless until the day a mail server appears behind them. The difference between a parked domain and a live fraud is visible in DNS, certificates and mail records, if someone is watching.
We monitor new registrations and changes continuously, score each lookalike by similarity and intent, alert on activation and act with registrars and providers. At the same time we harden the domains you own, so that spoofing fails and your legitimate mail is recognisable in the inbox.
A lookalike domain is harmless on the day it is registered and dangerous on the day it gets a mail server. Watching the stages in between is what turns a parked domain into an early warning rather than a fraud investigation.
Continuous detection of typosquats, homoglyphs, keyword variants and alternative extensions across all your brands, with similarity and intent scoring.
Immediate alerts when a lookalike gains mail records, a certificate, a web page or a login form, the moments when a parked domain becomes an attack.
Design and rollout of SPF, DKIM and DMARC to enforcement across every domain you own, including the dormant ones attackers prefer.
Implementation of verified brand indicators so that your logo appears next to authenticated mail in supporting mail clients, which makes impersonations easier to spot.
Inventory of all your domains, expiry and ownership risks, dangling records, unused subdomains and services that can be taken over.
Which variants are worth registering, which to monitor and which to dispute, with the cost kept proportionate to the risk.
Takedown notices for active impersonations and preparation of domain disputes with registrars and dispute resolution providers.
When a lookalike has already been used, reconstruction of the campaign, affected counterparties and funds flow, in coordination with our incident response team.
Inventory of your domains and brands, existing lookalikes and the state of your email authentication.
Authentication brought to enforcement and brand indicators enabled, dormant domains locked down.
Continuous discovery of new lookalikes and alerts on any sign of activation.
Takedowns, disputes, defensive registrations and counterparty warnings, recorded as evidence.
Clear, usable outputs for executives, technical teams, insurers and regulators.
No. The number of variants is unlimited and most are never used. We register the few that matter, monitor the rest and act on the day one of them is activated.
It can if it is rushed. We inventory every sender, including marketing, invoicing and SaaS platforms, move to enforcement in stages and monitor reports so that nothing legitimate is rejected.
We prepare the evidence and the filing for registrar and dispute resolution procedures and coordinate with your counsel where a formal proceeding is needed.
Yes. Dangling records pointing at services you no longer control are a frequent route to credible phishing. The portfolio review identifies them and the monitoring alerts on new ones.
Attackers bought search ads for the word chatgpt, published fake Custom GPTs on the real ChatGPT domain and sent users to a counterfeit Cloudflare check that ends with a PowerShell command. The domain is no longer the signal. The instruction is.
Read article
Sophos links a campaign it tracks as STAC4924 to the group behind Vice Society and Rhysida. The chain hides shellcode as English words, fetches its servers from a forum profile and leaves a Python tunnel on the host. No encryption has been seen yet, which is exactly the point.
Read article
In September 2025 a single supplier's passenger handling system went down and three of Europe's busiest airports fell back to pen and paper. A year on, September 2026 brought a state government leak, a hypervisor exploit in ransomware hands and a transport group knocked offline. The pattern holds.
Read articleWant to know how many domains already imitate yours, and which ones are live? Ask for a domain exposure review.