Impostor domains
Risk bands and signals
How a lookalike is scored: the four bands, the signals that raise or lower the score (mail, certificate, age, copied title and favicon), and what is not scored.
Updated · 2 min read
Every lookalike carries a score and a band. The score is built from what the domain can do and what somebody has already done with it, never from how similar the string looks. A one-letter typo that is parked is noise; a two-letter variant that receives mail and serves your logo is a threat.
The bands
| Band | Score | Meaning |
|---|---|---|
| Benign | 0 | Ended the assessment early: it is yours, it is a well-known unrelated business, or it predates your brand by years |
| Watch | 1 to 39 | Registered, but nothing points at you yet |
| Suspicious | 40 to 69 | Capable of harm: mail or a live site, recently registered |
| Active threat | 70 and up | Evidence of intent. The only band that pushes a notification |
Signals
Highest weight first; each is listed on the lookalike with its reason.
| Signal | Weight | Why |
|---|---|---|
| Serves a page whose title copies yours | +60 | Somebody copied your site. Evidence of intent, not resemblance |
| Serves your favicon (hash match) | +40 | Same |
| Has MX records | +40 | It can receive replies, which is what an invoice scam needs |
| Registered recently | +30 | Squats are set up shortly before use |
| Has a certificate | +25 | Somebody intends it to serve HTTPS |
| Resolves to a live site | +20 | |
| Registered through a privacy proxy at a registrar favoured by abuse | +10 to +15 | |
| Same registrar as you | -25 | More likely defensive registration by you or a sister company |
Anything that matches your own registrant data, or that the registry shows is older than your domain, ends the assessment as benign.
What needs clearance
DNS, RDAP and certificate reads are public. The homepage fetch and favicon comparison reach the other party's server, so they run only when the account has proven ownership of the domain being protected (see Scan clearance). Without clearance the score is built from registry signals alone and the lookalike says so.
The newly-registered feed
A domain registered this morning has no DNS and no certificate, so neither of the other two vectors would see it. The daily new-registration feed is matched against your brand names and a match enters the list at the moment it is most useful: before the mail server is configured.
Common questions
A lookalike scored 0 but it looks exactly like my domain. Read the reasons. It probably predates you or shares your registrant. Resemblance alone is not a score.
Why is "same registrar" negative? Because the most common owner of a lookalike at your registrar is you, or whoever registered your domain defensively.
Keep reading
Related articles
- The quick accessibility scoreThe static accessibility pass that runs with every domain scan and in the Check tab: what it judges from HTML alone, how it is scored, and what it cannot see.Accessibility ·Updated
- Lookalike watch and alertsKeeping the check running: weekly on Starter, daily on Pro and Enterprise, with an alert when a lookalike appears, gains mail or escalates. Off is always free.Impostor domains ·Updated
- Certificate monitoringWhere certificate data comes from, what the Certificate module shows, subdomain certificates, and the quiet rule for certificates that renew themselves.Domains ·Updated