Request demo

Fraudulent Domain Monitoring

Find the Domains Built to Pass for Yours.

Fraudulent Domain Monitoring, the domain side of Brand Risk Protection, matches domain and subdomain names against your brand keywords, including names spelled with letters borrowed from other alphabets. Your team decides which matches are fraudulent, and the ones you confirm stay under watch with a risk-score timeline.

Request demoPlatform guide: Fraudulent domains

  1. acme.example

    Your keyword

    Each rule pairs it with one match type

  2. acme.test

    Same name · exact

    The name itself, on another TLD

  3. acme-login.example

    Name inside · contains

    The name inside a longer label

  4. acrne.example

    Typo · fuzzy

    One edit away: a dropped, doubled, swapped or mistyped letter

  5. acem-verify.example

    Typo inside · fuzzy_contains

    A typo inside a longer label

  6. аcme.example

    resolves as xn--cme-5cd.example

    Lookalike letters · confusable_exact

    Letters swapped for ones that look identical

  7. аcme-login.example

    resolves as xn--cme-login-zyh.example

    Lookalike letters inside · confusable_contains

    Lookalike letters inside a longer label

  8. aсem.example

    resolves as xn--aem-4ed.example

    Lookalike and typo · confusable_fuzzy

    A typo and a lookalike letter together

  9. secure-aсem.example

    resolves as xn--secure-aem-jwi.example

    Lookalike and typo inside · confusable_fuzzy_contains

    Both, inside a longer label

What Goes Into a Rule.

Detection starts from rules you write. Each rule pairs one brand keyword with one match type, so a brand is usually covered by several rules, one for each match type you care about.

KeywordThe brand string the rule looks for: a company, product or service name (keyword)
Match typeHow a name can match the keyword, from exact to confusable_fuzzy_contains (match_type)
ScopeWhether the rule looks at registered domains or at subdomains (fqdn_type)
RefinementsOptional lists of helper and discard keywords, and of extensions to include or exclude (helper_keywords, discard_keywords, included_extensions, excluded_extensions)
Back-scanAlso checks domains registered before the rule existed, not only new ones (include_past)
Auto-approvalSkips review: every match becomes a fraudulent domain straight away (auto_approval)
Switch and labelsTurns a rule off without deleting it, and tags it for filtering (enabled, tags)

Field names as the Fraudulent Rule Create endpoint takes them.

Suspicious Until Your Team Decides.

Matches arrive as suspicious domains, each with the rule that found it, the detection date, its monitoring indicators and a risk score, so review starts from evidence. Nothing is treated as fraudulent until someone approves it, or a rule you trust approves it for you.

Approve

The match becomes a fraudulent domain and stays under watch, with per-layer history and a risk-score timeline.

Ignore

The match leaves the queue and stays on record as ignored, with the date of the decision.

Revert

Any approval or ignore can be undone, and the domain goes back to its previous state.

In Bulk

Decisions take a search filter, so one request can clear a single record by its ID or all matches from one rule.

Ignore List

Domains you add to the ignore list in settings, such as your own and your partners’, are never reported.

Watch What a Lookalike Starts Doing.

Plenty of matching names are harmless: a reseller, a fan page, a name someone parked years ago. The monitoring indicators show which ones are being put to work.

DNS

It Resolves

The name has DNS records and points somewhere. Many parked names stop here, and that is worth knowing too.

MX

It Can Receive Mail

A mail exchanger means replies to a phishing email have somewhere to go.

SSL

It Has a Certificate

Someone obtained a certificate for the name, which is what serving a login page over HTTPS requires.

HTTP

It Answers on the Web

A web server responds, and its page content goes on record with history, ready to support a takedown request.

Fraudulent domain · approved

acme-login.example

risk-score-timeline?interval=weekly

  1. 0

    2026-09-14

  2. 50

    2026-09-21

    Indicators on

    • dns
    • dns_mx
    • ssl
    • http

Each Change Stays on Record and in the API.

Each monitored lookalike keeps DNS, WHOIS, SSL, web data and port scan history, layer by layer, and records its risk score as a timeline. When a parked name picks up a certificate and a mail server, the history shows the day it happened.

These records are in the BRP API too, along with on-demand scans. Review actions take a search filter, and an empty filter matches everything, so run the search before the action.

Suspicious Domain Approve referenceSearch and filter syntax
curl -X POST \
  "https://api.deepinfo.com/v1/brp/suspicious-domains/search:approve" \
  -H "apikey: YOUR_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
    "filters": {
      "must": [
        { "name": "detection_history.id", "type": "eq",
          "value": "RULE_ID" },
        { "name": "fraudulent", "type": "wildcard",
          "value": "*acme-login*" }
      ]
    }
  }'

What Happens After a Match.

BRP Managed Takedown Hand a confirmed lookalike to the takedown desk, with its evidence attached. Read Use case Phishing Detection and Prevention How security teams put lookalike detection to work against phishing. Read Blog Detecting typosquats at scale The match types explained on two axes, with a rule you can copy. Read

Query This Data Through the API

Lookalike matching runs over the domains the index sees each day. Data teams can take these domains as a feed and run their own matching.

Questions About Fraudulent Domain Monitoring

What counts as a lookalike domain?

Any domain or subdomain whose name imitates yours closely enough to fool a reader: your brand on another extension, inside a longer name, one typo away, or spelled with letters from another alphabet that look identical. The match types cover each of those cases and their combinations.

What is the difference between a suspicious and a fraudulent domain?

A suspicious domain is a candidate: a rule matched it and it waits for review. A fraudulent domain is one your team approved, or one a rule with auto-approval approved for you. It stays under watch from then on, with per-layer history, a risk-score timeline and on-demand scans.

How do confusable matches work?

Some letters in other scripts are drawn the same as Latin ones: a Cyrillic “а” and a Latin “a” are different characters that look identical. The browser resolves such a name in its xn-- form, and the Deepinfo Platform keeps both forms, so your team sees what a victim would see and what the registry holds.

Does a rule only look at new registrations?

By default a rule matches names as they come into the index. Turn on include_past and it also runs against domains registered before the rule existed, so your first review covers what is already out there.

Can we be alerted to new fraudulent domains?

Yes. A notification rule on new_fraudulent_domain_detected emails the team members you choose when a match becomes a fraudulent domain, instantly or as an hourly to monthly digest.

How do we stop watching a lookalike?

Remove it from the fraudulent domain list, by ID or by filter, and its monitoring stops. Until then it stays under watch, after a takedown as well.

Where do the domains come from?

From Deepinfo’s own index, the one behind all the platform’s modules: 400M+ domains, 2B+ subdomains, 200B+ DNS records and 30B+ SSL certificates.

See Who Has Registered Names Like Yours.

Book a walk-through with rules built on your brand keywords.

Request demo