Brand & domains
Lookalike domains
We spot the domain names that imitate yours from their registration or first certificate, before they are used for phishing. Lookalike-domain monitoring spots the domain names that imitate yours (typos, homoglyphs, neighbouring extensions, added keywords) from their registration or first certificate, before they are used for phishing.
The problem
A domain that imitates yours is registered days or weeks before it is used: time enough to obtain a certificate, copy your login page, configure a mail server. Then your customers, partners and teams receive plausible messages. From the inside, nothing shows. In certificate transparency logs and domain registrations, on the other hand, everything shows from day one.
Client area preview
What you see
Fictional data, for illustration only: no client, no real data.
What you get: this screen in your client area, refreshed at every synchronisation, with CSV and JSON export.
- 01
Each lookalike domain with its registration date, its registrar and how it resembles yours
- 02
Its record: DNS and MX entries, SPF and DMARC, certificate, page capture, change history
- 03
Its status: monitored, in review, takedown requested, removed
How it works
Our answer in three steps
VesperID generates the variants of your domains, watches registries and certificate logs, and shows you what each lookalike is preparing: DNS, mail server, certificate, screenshot. You request removal before the first campaign.
- 01
You declare your domains and brands; we derive the typos, homoglyphs, neighbouring extensions and added keywords.
- 02
Continuous collection of certificate transparency logs and domain registrations surfaces every variant as soon as it is registered; the platform then follows the activation of a mail server or a page.
- 03
An analyst qualifies the threat, discards legitimate homonyms and proposes removal when warranted.
Where this data comes from
Domains come from certificate transparency logs, domain registrations and DNS observations collected continuously; VesperID generates the variants of your brands, matches them and scores each domain by what it has already activated.
Our sources in detailCross analyses
What the platform computes on top
This service’s data is crossed with the others’: here are the analyses that come out of it, all visible in the client area.
Discover the platform- 01
Phishing-readiness index
Mail server, certificate, active page, SPF, registration date: the index says how ready the domain is to be used.
- 02
Classification
Unclassified, legitimate, monitored or malicious, revised at every synchronisation and by the analyst.
- 03
Matched against leaks
A lookalike registered shortly before a wave of leaks forms a chain with a “phishing campaign” origin and the response playbook.
What you receive
Lookalike domains
- 01
Alert at registration, certificate and activation
- 02
Complete record per domain, exportable
- 03
Takedown request written by our analysts, with the managed takedown credits
- 04
Monthly trend of registrations targeting your brand
Frequently asked questions
Can you block a lookalike domain?
We block nothing: we document and, if you activate it, we request removal from the registrar, the host or the platform. In parallel, the record lets your SOC block the domain in your own tools.
What about an inactive lookalike domain?
Watch it. A parked domain can go live in a few hours; the activation alert gives you time to act.
Do you also watch social networks?
Fake profiles and impersonated accounts belong to executive protection and managed takedown; this service covers domain names.
Request an exposure assessment.
One hour with an analyst, not a demo: what already circulates about your organisation, what to monitor, what is better left alone. Reply within one working day.
No public price list: bespoke offering, written proposal after scoping.