Lookalike watch and alerts

The check is a snapshot. The watch re-runs it on a schedule and tells you when something changes: a name that was parked now has a mail server, a name that did not exist now does.

Plan: Starter and up. The check itself stays free.

Cadence and budget

The candidate figure is a ceiling: a run checks every variation the name generates, up to it, so a short name checks fewer (on 2026-09-24 an Enterprise account's runs checked between 573 and 1,790). The watch sweep runs every hour and picks up the watches that are due, oldest first: a daily watch once 20 hours have passed since its last run, a weekly one after six and a half days. Up to 40 due watches are started each hour, each as its own job, so watches spread across the day rather than all running at midnight.

Every domain, on every plan, gets one first check automatically if it has never had one (a few domains per hour). On Free that first check is all that runs until you run it again by hand. A domain whose automatic scans are paused is skipped by the watch too.

Starter and up also get the daily new-registration feed matched against the names they watch; see Risk bands and signals.

Where

• Web: Security, Impostor domains, pick the domain, Watch this domain or Stop watching. Alerts are switched on through the API or MCP; there is no switch for them on the web or in the app yet.
• iOS: the setup guide's "Impostor check" step and the module's Watch control.
• API/MCP: PUT /api/domains/:id/lookalike-watch (enabled); GET/PUT /api/settings/lookalike-alerts (push); tools set_lookalike_watch, get_lookalike_alert_settings, update_lookalike_alert_settings.

Turning it off is always allowed

The watch route is deliberately not plan-gated, because an account that downgrades must still be able to turn its own watch off. The plan is checked only when turning the watch on.

What alerts

Every change is recorded in the lookalike's history (see change events), but only three kinds send an alert:

• a new lookalike that is already able to receive mail, or already an Active threat, when first found;
• an existing lookalike that gains mail (MX records);
• a lookalike that rises into Active threat.

A certificate being issued, a site going live, or a rise into Suspicious is recorded and shown, but does not alert on its own. It can still add up to an Active threat, which does.

Alerts are off until you turn them on. Switch them on with PUT /api/settings/lookalike-alerts or the update_lookalike_alert_settings tool (or ask your assistant through MCP). The setting covers every domain on the account and needs Starter or above. Each alert lands in the Alerts feed and is pushed to the app. Each event alerts once, within a day of being found, and never twice. A lookalike you marked ours never alerts; one marked unrelated alerts only if it rises into Active threat; one marked known is recorded but does not alert.

The alert names the lookalike and the change ("acme-plumbing.co can now receive email").

The stored list

Between runs the list shows the last result with its date and coverage. GET /api/domains/:id/lookalikes (tool list_lookalikes) returns each lookalike with its risk band and score, and the last scan's coverage: variations generated and checked, lookalikes found and examined, and whether the certificate search ran.

Common questions

Can I watch a domain I do not own? The check and the watch read public records and run on any domain on your account. Comparing each lookalike's homepage with yours reaches other servers, so it runs only once the domain you are protecting is verified. See Verifying a domain for deep scans.

Does the watch cost credits? No. It costs DNS lookups on our side, which is what the per-plan budget bounds.

I turned the watch on but got no alert for a lookalike that appeared. Check that lookalike alerts are switched on (get_lookalike_alert_settings); they start off. Then check whether the lookalike could receive mail when it was found. One that could not is recorded without an alert until it gains mail or becomes an Active threat.