Lookalike watch and alerts

The check is a snapshot. The watch re-runs it on a schedule and tells you when something changes: a name that was parked now has a mail server, a name that did not exist now does.

Plan: the lookalike_monitoring capability, Starter and up. The check itself stays free.

Cadence and budget

The nightly sweep selects the watches that are due and runs them within the Worker's request budget, a few inline per tick and the rest through a queue. A domain added on a paid plan gets its watch created automatically on the first sweep after it is added.

Where

• Web: the domain's Impostor domains module, Watch on/off; Settings, Lookalike alerts for delivery.
• iOS: the setup guide's "Impostor check" step and the module's Watch control.
• API/MCP: PUT /api/domains/:id/lookalike-watch (enabled); GET/PUT /api/settings/lookalike-alerts (email, push); tools set_lookalike_watch, get_lookalike_alert_settings, update_lookalike_alert_settings.

Turning it off is always allowed

The watch route is deliberately not plan-gated at the route level, because an account that downgrades must still be able to turn its own watch off. The capability is checked only on the enabling path.

What alerts

Only a change pushes a notification: a lookalike appearing, gaining MX, gaining a certificate, starting to resolve, or escalating into the active-threat band. The alert names the lookalike and the change ("acme-plumbing.co now receives mail"). Delivery is push to the app and, on paid plans, email, each switchable under Lookalike alerts.

The stored list

Between runs the module shows the last result with its date and coverage. GET /api/domains/:id/lookalikes (tool list_lookalikes) returns each lookalike with its risk band, the evidence behind it, and how much of the variation space the scan covered.

Common questions

Can I watch a domain I do not own? Yes. The watch reads public records only, so it needs no ownership proof. Watching a client's brand, or a competitor's, is fine.

Does the watch cost credits? No. It costs DNS lookups on our side, which is what the per-plan budget bounds.