Find potential brand impersonation with the context to act.

Generating lookalikes is trivial; deciding about them is not

Any permutation engine will produce thousands of domains that resemble a brand — character swaps, homoglyphs, added words, alternative top-level domains. Registering a fraction of those is common, and most of what gets registered is not an attack. It is domain parking, speculative resale, a defensive registration by the brand itself, or a legitimate business whose name happens to be similar.

So the volume of candidates says nothing about risk, and a product that reports the volume has moved the work rather than done it. What matters is the small number where someone has built something intended to deceive, and the effort belongs in separating those out.

A domain that resembles yours may already be yours

Organisations routinely own dozens of variants of their own name, and their partners, resellers, and regional entities own more. Flagging those as impersonation is worse than useless: it fills the queue with findings the customer already knows about, and it makes every other finding look less trustworthy.

Two mechanisms keep that under control. An explicit allowlist of domains the organisation acknowledges owning, maintained per account. And infrastructure comparison — when a candidate resolves to the same nameservers and the same addresses as the real domain, that is a strong indication it belongs to the same owner rather than to an attacker.

Registration is not the threat; what is served is

A newly registered lookalike that resolves to nothing is a possibility, not an incident. The same domain three weeks later, serving a copy of your login page behind a valid certificate, is an incident. These are the same record at different points in time, and monitoring has to represent both.

That means candidates are re-examined rather than judged once at discovery. What the domain resolves to, whether it answers over HTTPS, whether a certificate was issued for it, and whether the page that appears contains a credential form are all states that change — and the change is the signal.

Capture the page when you see it

Phishing infrastructure is deliberately short-lived, and often deliberately selective: it may answer differently depending on where the request comes from, and it may be taken down within hours of doing its work. An analyst who opens a candidate a day later frequently finds nothing, which does not mean nothing was there.

Recording what the page actually looked like at the time it was seen turns that from a dead end into evidence — enough to support a takedown request, warn customers, or explain afterwards why an action was taken.

Confirmation should lead somewhere

A confirmed impersonation has a handful of realistic outcomes: a takedown request to the registrar or host, submission to browser and mail blocklists, a warning to customers or staff, and a detection added to controls that see the domain. None of them happen automatically, and the platform's contribution is that the person doing them has the evidence and the decision history in one place.

The same applies to what was dismissed. A candidate ruled harmless should stay ruled harmless, per organisation, rather than reappearing next month for someone else to investigate again.