·
3 min read
How to monitor for lookalike domains and typosquats
How to spot lookalike domains impersonating your brand early, using certificate logs, new domain data and permutation tools, and what to do next.
ChainPatrol
To monitor for lookalike domains, watch three sources. Certificate transparency logs show new TLS certificates issued for names like yours. Newly registered domain data shows new registrations. Permutation tools generate the misspellings and swapped characters scammers use. Free tools cover a few brands with manual review. Ongoing monitoring across many variations needs automation and someone to review what it finds.
Here's what to watch, the free and paid options, and what to do when a lookalike appears. For takedowns, see how to take down a phishing site.
What lookalike domains look like
Type | Example for "brand.com" |
|---|---|
Typo | bramd.com, brnad.com |
Added word | brand-support.com, brand-login.app, brandverify.net |
Different ending | brand.co, brand.app, brand.help |
Lookalike characters | Letters from other alphabets that look identical, or "rn" for "m" |
Subdomain trick | brand.com.secure-login.app, where the real domain is the last part |
Where to watch
Certificate transparency logs. Most phishing sites use HTTPS, and every public certificate is logged. Searching logs for your brand name surfaces new sites, often before they go live.
Newly registered domains. Daily lists of new registrations can be searched for your name and its variations.
Permutation tools. Open-source tools generate likely variations of your domain and check which ones resolve.
Your own signals. Support tickets, customer screenshots, and ads appearing on your brand terms.
Free vs automated monitoring
Free tools and manual review | Automated monitoring service | |
|---|---|---|
Coverage | A handful of brands and variations | Many brands, languages and lookalike types |
Speed | As often as someone checks | Continuous, with alerts |
Triage | You decide what's malicious | The service reviews and confirms |
Action | You file every report | Depends on the service; some only alert |
Ask any service whether it only alerts or also files and follows up the takedown. An alert is just a notification that creates more manual work for your team.
When a lookalike appears
Check whether it's live and what it shows. Many lookalikes are registered and parked before they're used.
If it's phishing, get it blocked and taken down. Once a malicious website or phishing link is confirmed, ChainPatrol gets it flagged in 20+ wallets in about 5–10 minutes and in browsers in about 1–3 hours. Blocking applies to web domains and URLs; fake social profiles and chat accounts are removed through platform takedowns.
If it's parked, keep watching. Note the registrar and registration date in case it's activated later.
Consider registering the most obvious variations yourself, especially your name on common endings such as .app and .co.
Doing this at scale
ChainPatrol monitors for lookalike domains and other impersonation of your brand, confirms which are malicious, gets them blocked, and files and follows up the takedowns. You can follow every case in the ChainPatrol app as it moves. You also get regular reports on what's been removed, what's blocked with a takedown in progress, what's still live and why, and what's waiting on your approval.
Frequently asked questions
Is a lookalike domain illegal on its own?
Not necessarily. Registering a similar name isn't always abuse. Using it to impersonate you or phish your customers is, and that's what registrars and hosts act on.
Should we register every variation of our domain?
Not every one, since the list is endless. Register the most obvious ones on the endings your customers expect, and monitor the rest.
How early can monitoring catch a phishing domain?
Often before customers see it, because certificates and registrations appear before a phishing campaign starts. Timing depends on the source and how often it's checked.
See which lookalike domains are using your name today. Get a free scan, with results within 48 hours.
Sources
Accessed October 2026. Platform processes change; check each source for the latest.
Fakes of your brand already out there?
ChainPatrol finds them, blocks the links in wallets and browsers, and files the takedowns for you.
