Impostor domains (Lookalike Watch)

Somebody registers a name one letter off yours, points a mail server at it, and sends your customers an invoice with new bank details. Lookalike Watch finds those names before the invoice goes out, tells you which ones can already receive mail, and keeps checking.

Articles

• The lookalike check - how variations are generated, how many are checked and examined, and why "nothing found" always comes with a count.
• Lookalike watch and alerts - the re-check (weekly on Starter, daily on Pro and Enterprise), candidate budgets per plan, what alerts, and the alert switches, which start off.
• Risk bands and signals - no concern, watch, suspicious and active threat; every signal and its weight, shared hosting platforms, and the new-registration feed.
• Verdicts, change events and the evidence pack - ours, unrelated or known; appeared, gained mail, escalated; and the pack for a registrar complaint.

Where

• Web: Security, Impostor domains, then pick the domain; the public tool at nhmohio.com/lookalike-domain-check.
• iOS: the Impostor domains module on a domain's page, with Needs review, Watching and Dismissed groups.
• API/MCP: POST /api/lookalike-check (public), GET /api/domains/:id/lookalikes, POST /api/domains/:id/lookalike-scan, PUT …/lookalike-watch, PUT …/lookalike-verdict, GET …/lookalike-events, GET …/lookalike-evidence; tools list_lookalikes, run_lookalike_scan, set_lookalike_watch, set_lookalike_verdict, get_lookalike_events, act_on_lookalike_event, get_lookalike_evidence, get_lookalike_alert_settings, update_lookalike_alert_settings.

What DomainGuard does not do here

It does not take a domain down. A lookalike is a registrar abuse complaint or a UDRP filing; DomainGuard assembles the evidence and you file.

How the pieces fit

1. The check generates variations of your name and finds the ones that exist. Free, on every plan, and public on the website.
2. Each hit is scored from what it can do (receive mail, serve HTTPS, resolve) and what has been done with it (copied title, copied favicon), never from how similar it looks.
3. The watch re-runs the check weekly (Starter) or daily (Pro and Enterprise) and, once you turn alerts on, raises one only when a lookalike can receive mail or becomes an active threat.
4. A verdict is your word on what a hit is, and it stops the noise without hiding an escalation.
5. The evidence pack is what you hand to the registrar or file with a complaint.

Common questions

Is this the same as DMARC? No. DMARC stops someone sending mail as yourdomain.com. A lookalike is yourdomain.co or your-domain.com, which DMARC cannot touch; the only defences are noticing it early and filing.

Does the check touch the impostor's server? DNS, registry and certificate log reads do not. The homepage title, site-icon comparison and screenshot do. They run only in the account, once the domain you are protecting is verified, never from the public tool.