Skip to main content

Lookalike domain monitoring and typosquat detection

Catch lookalike domains before your customers do. PhishFence finds them, scores the live ones and writes the takedown.

Free on 1 domain paid from $49/mo

Start free Scan a domain free

No credit card. Sold separately from Email Security.

Lookalikes · example.com Example data
Risk Lookalike domain Status
Critical example-login.test New
High examp1e.test New
Medium example-billing.test Watching
Low exampel.test Resolved
lookalike variants checked on every scan cycle, across every monitored domain
51,276

From a new registration to a takedown, in one workflow

Four jobs, in the order you do them.

Every way your name can be twisted

For example.com the generator produces 1,935 candidates across 11 techniques, with the highest-risk patterns first. Every scan checks all of them.

  • TLD swaps, prefixes and suffixes like example-login.test
  • Typos, dropped or doubled letters, homoglyphs and IDN lookalikes
Lookalike scan · example.com Example data

Variants generated

1,935
TechniqueCount
TLD swap 31
Prefix spoof 800
Suffix spoof 768
Keyboard typo 26
Dropped letter 7
Swapped letters 6
Doubled letter 7

Hear about it the day it goes live

Registered variants are scored on four signals: DNS, SSL certificate, mail (MX) and live web content. Free plans scan daily, paid plans hourly, and a weekly digest sums it up.

  • Certificate Transparency alerts when a lookalike gets a certificate, on Starter and up
  • Email alerts on every plan; Slack, Microsoft Teams, Discord and webhooks on paid plans
Weekly digest email · example.com Example data

What happened across your monitored domains in the last 7 days.

New alerts
12
Critical or high
3
Awaiting review
5

Top threats this week

  • example-login.testCritical
  • example-verify.testCritical
  • examp1e.testHigh

Prove it is a phishing site

Each alert collects the evidence a registrar asks for: active signals and registration and certificate facts. Paid plans add threat-feed matches; Pro scores screenshots against your real login and checkout pages.

  • Threat feeds on paid plans: URLhaus, Google Safe Browsing, PhishTank and VirusTotal
  • Visual change detection on Pro when a parked domain goes live
Lookalike · example-login.test Example data

Signal breakdown

  • DNS resolutionResolves to 203.0.113.24 Active
  • SSL certificateLet's Encrypt, issued yesterday Active
  • MX recordsCan receive and send mail Active
  • Live HTTPServing a sign-in page Active

Domain intelligence

IP address
203.0.113.24
Registered
2 days ago
Registrar
Example Registrar
Visual match
92% to example.com/login

Take it down

PhishFence looks up the registrar abuse contact, writes the report with the evidence attached, and links to the abuse form. You track every blocklist report per alert.

  • One-click submission to Netcraft
  • Pre-filled reports for Google Safe Browsing, Microsoft SmartScreen, PhishTank and Cloudflare
Take down · example-login.test Example data
To
abuse@registrar.example
Subject
Phishing site impersonating example.com on example-login.test
example-login.test resolves to 203.0.113.24 and serves a copy of the example.com sign-in page (screenshot attached, 92% visual match). The domain was registered 2 days ago, holds a TLS certificate and MX records. Please suspend it under your abuse policy.
Copy report Open registrar abuse form

Use cases

Plans sized by how many domains you protect

  • Free

    $0/mo

    1 domain

    Try it on one domain. No credit card.

  • Starter

    $49/mo

    5 domains

    Hourly scans, more domains, REST API.

  • Pro

    $99/mo

    20 domains

    Site screenshots, visual change detection.

  • Business

    $499/mo

    100 domains

    Team access, audit log, compliance-ready.

Annual billing gives 2 months free. Compare every plan feature on the pricing page →

Need DMARC, SPF and DKIM monitoring too? See Email Security →

Frequently asked questions

What is brand protection in the context of domain monitoring?
Brand protection here means continuously scanning the global DNS and Certificate Transparency log corpus for domains that impersonate your brand: typosquats (exarnple.test), TLD swaps (example.net), homoglyphs (Cyrillic-a in exаmple.test), prefix/suffix spoofs (example-login.test), and combosquats (example-secure-pay.test). Each detection is risk-scored on DNS resolution, SSL cert issuance, MX records, live HTTP content, and threat-intel feeds so you triage real threats first.
How is PhishFence Brand Protection different from DNSTwist or other free tools?
DNSTwist and dnstwister.it are excellent one-shot scanners but ship no continuous monitoring, no alerting, no risk scoring beyond domain similarity, and no takedown workflow. PhishFence runs hourly scans on paid tiers, scores each variant on DNS + SSL + MX + HTTP signals plus threat-intel feeds, captures screenshots on Pro+, surfaces alerts in email + Slack + Discord + Teams + webhooks, and includes pre-filled abuse reports with the registrar's contact RDAP-harvested. Free on 1 domain so you can compare directly.
How many variants do you check per domain?
About 1,600 to 2,000 lookalike variants per domain, checked on every scan. The generator covers TLD swaps, prefix and suffix spoofs, keyboard typos, dropped, swapped and doubled letters, hyphen insertion, ASCII and IDN homoglyphs, and inserted characters. It emits the highest-signal variants first, so when a domain reaches the 2,000 cap only the lowest-signal inserted-character variants are trimmed.
Does Brand Protection include Email Security?
No. Brand Protection (lookalike + typosquat monitoring) and Email Security (DMARC, SPF, DKIM, MTA-STS, TLS-RPT) are separate product lines, sold separately at every tier. Buy either on its own or both together. Email Security has its own free tier on 1 domain plus paid tiers at $20/$69/$399 per month. See /email-security for the full Email Security breakdown.
What can I do when PhishFence finds a real phishing site?
Each alert opens a takedown workflow: PhishFence does the RDAP lookup to find the registrar's abuse contact and pre-fills the abuse-report email body using a template that survives most registrar triage filters. One-click submission to Netcraft, plus pre-filled reports and deep links for Google Safe Browsing, Microsoft SmartScreen, PhishTank, and Cloudflare's abuse forms. The phishing-takedown use-case page walks through the full flow.

Catch the next phishing domain before it goes live

Start free on one domain, or scan a domain now without an account.

Start free Scan a domain free

Free on 1 domain No credit card Cancel anytime