# Fraudulent Domain Monitoring

URL: https://www.deepinfo.com/platform/brp/fraudulent-domain-monitoring/

## Find the Domains Built to Pass for Yours.

Fraudulent Domain Monitoring, the domain side of Brand Risk Protection, matches domain and subdomain names against your brand keywords, including names spelled with letters borrowed from other alphabets. Your team decides which matches are fraudulent, and the ones you confirm stay under watch with a risk-score timeline.

[Request demo](https://www.deepinfo.com/request-demo/) · [Platform guide: Fraudulent domains](https://docs.deepinfo.com/guide/brp/fraudulent-domains/)

- **Same name** (`exact`): The name itself, on another TLD
- **Name inside** (`contains`): The name inside a longer label
- **Typo** (`fuzzy`): One edit away: a dropped, doubled, swapped or mistyped letter
- **Typo inside** (`fuzzy_contains`): A typo inside a longer label
- **Lookalike letters** (`confusable_exact`): Letters swapped for ones that look identical
- **Lookalike letters inside** (`confusable_contains`): Lookalike letters inside a longer label
- **Lookalike and typo** (`confusable_fuzzy`): A typo and a lookalike letter together
- **Lookalike and typo inside** (`confusable_fuzzy_contains`): Both, inside a longer label

### What Goes Into a Rule.

Detection starts from rules you write. Each rule pairs one brand keyword with one match type, so a brand is usually covered by several rules, one for each match type you care about.

- **Keyword**: The brand string the rule looks for: a company, product or service name (`keyword`)
- **Match type**: How a name can match the keyword, from `exact` to `confusable_fuzzy_contains` (`match_type`)
- **Scope**: Whether the rule looks at registered domains or at subdomains (`fqdn_type`)
- **Refinements**: Optional lists of helper and discard keywords, and of extensions to include or exclude (`helper_keywords`, `discard_keywords`, `included_extensions`, `excluded_extensions`)
- **Back-scan**: Also checks domains registered before the rule existed, not only new ones (`include_past`)
- **Auto-approval**: Skips review: every match becomes a fraudulent domain straight away (`auto_approval`)
- **Switch and labels**: Turns a rule off without deleting it, and tags it for filtering (`enabled`, `tags`)

Field names as the [Fraudulent Rule Create](https://docs.deepinfo.com/reference/brp/fraudulent-rule-create/) endpoint takes them.

### Suspicious Until Your Team Decides.

Matches arrive as suspicious domains, each with the rule that found it, the detection date, its monitoring indicators and a risk score, so review starts from evidence. Nothing is treated as fraudulent until someone approves it, or a rule you trust approves it for you.

#### Approve

The match becomes a fraudulent domain and stays under watch, with per-layer history and a risk-score timeline.

#### Ignore

The match leaves the queue and stays on record as ignored, with the date of the decision.

#### Revert

Any approval or ignore can be undone, and the domain goes back to its previous state.

#### In Bulk

Decisions take a search filter, so one request can clear a single record by its ID or all matches from one rule.

#### Ignore List

Domains you add to the ignore list in settings, such as your own and your partners’, are never reported.

### Watch What a Lookalike Starts Doing.

Plenty of matching names are harmless: a reseller, a fan page, a name someone parked years ago. The monitoring indicators show which ones are being put to work.

DNS

#### It Resolves

The name has DNS records and points somewhere. Many parked names stop here, and that is worth knowing too.

MX

#### It Can Receive Mail

A mail exchanger means replies to a phishing email have somewhere to go.

SSL

#### It Has a Certificate

Someone obtained a certificate for the name, which is what serving a login page over HTTPS requires.

HTTP

#### It Answers on the Web

A web server responds, and its page content goes on record with history, ready to support a takedown request.

### Each Change Stays on Record and in the API.

Each monitored lookalike keeps DNS, WHOIS, SSL, web data and port scan history, layer by layer, and records its risk score as a timeline. When a parked name picks up a certificate and a mail server, the history shows the day it happened.

These records are in the BRP API too, along with on-demand scans. Review actions take a search filter, and an empty filter matches everything, so run the search before the action.

[Suspicious Domain Approve reference](https://docs.deepinfo.com/reference/brp/suspicious-domain-approve/) · [Search and filter syntax](https://docs.deepinfo.com/getting-started/search-and-filters/)

Approve by filter:

```bash
curl -X POST \
  "https://api.deepinfo.com/v1/brp/suspicious-domains/search:approve" \
  -H "apikey: YOUR_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
    "filters": {
      "must": [
        { "name": "detection_history.id", "type": "eq",
          "value": "RULE_ID" },
        { "name": "fraudulent", "type": "wildcard",
          "value": "*acme-login*" }
      ]
    }
  }'
```

Risk-score timeline:

```bash
curl "https://api.deepinfo.com/v1/brp/fraudulent-domains/FRAUDULENT_ID/risk-score-timeline?interval=weekly" \
  -H "apikey: YOUR_API_KEY"
```

Response:

```json
[
  { "date": "2026-09-21", "score": 50 },
  { "date": "2026-09-14", "score": 0 }
]
```

### What Happens After a Match.

- [Managed Takedown](https://www.deepinfo.com/platform/brp/managed-takedown/) (BRP): Hand a confirmed lookalike to the takedown desk, with its evidence attached.
- [Phishing Detection and Prevention](https://www.deepinfo.com/solutions/use-cases/phishing-detection-and-prevention/) (Use case): How security teams put lookalike detection to work against phishing.
- [Detecting typosquats at scale](https://www.deepinfo.com/blog/detecting-typosquats-at-scale/) (Blog): The match types explained on two axes, with a rule you can copy.

### Query This Data Through the API

Lookalike matching runs over the domains the index sees each day. Data teams can take these domains as a feed and run their own matching.

- [Daily Registered Domains Feed](https://www.deepinfo.com/data-api/feeds/daily-registered-domain-names/)
- [Domain Search API](https://www.deepinfo.com/data-api/apis/domain-search/)
- [Same-Time Registered Domain Finder API](https://www.deepinfo.com/data-api/apis/same-time-registered-domain-finder/)

### Questions About Fraudulent Domain Monitoring

**What counts as a lookalike domain?**

Any domain or subdomain whose name imitates yours closely enough to fool a reader: your brand on another extension, inside a longer name, one typo away, or spelled with letters from another alphabet that look identical. The match types cover each of those cases and their combinations.

**What is the difference between a suspicious and a fraudulent domain?**

A suspicious domain is a candidate: a rule matched it and it waits for review. A fraudulent domain is one your team approved, or one a rule with auto-approval approved for you. It stays under watch from then on, with per-layer history, a risk-score timeline and on-demand scans.

**How do confusable matches work?**

Some letters in other scripts are drawn the same as Latin ones: a Cyrillic “а” and a Latin “a” are different characters that look identical. The browser resolves such a name in its `xn--` form, and the Deepinfo Platform keeps both forms, so your team sees what a victim would see and what the registry holds.

**Does a rule only look at new registrations?**

By default a rule matches names as they come into the index. Turn on `include_past` and it also runs against domains registered before the rule existed, so your first review covers what is already out there.

**Can we be alerted to new fraudulent domains?**

Yes. A notification rule on `new_fraudulent_domain_detected` emails the team members you choose when a match becomes a fraudulent domain, instantly or as an hourly to monthly digest.

**How do we stop watching a lookalike?**

Remove it from the fraudulent domain list, by ID or by filter, and its monitoring stops. Until then it stays under watch, after a takedown as well.

**Where do the domains come from?**

From Deepinfo’s own index, the one behind all the platform’s modules: 400M+ domains, 2B+ subdomains, 200B+ DNS records and 30B+ SSL certificates.

### See Who Has Registered Names Like Yours.

Book a walk-through with rules built on your brand keywords.

[Request demo](https://www.deepinfo.com/request-demo/)