Risk bands and signals

Every lookalike carries a score and a band. The score is built from what the domain can do and what somebody has already done with it, never from how similar the string looks. A one-letter typo that is parked is noise; a two-letter variant that receives mail and serves your homepage title is a threat.

Is it a threat to you?

Every lookalike opens with a one-line answer, and the list is sorted by it:

Likely threat. It shows intent: it copies your homepage title or icon, puts your business name in its page title, runs a login or payment page, is spelled with lookalike characters, or was registered in the last 90 days and has just been given mail and its first certificate.
Possible threat. It can do something (usually receive email) on a name like yours, but shows no sign of copying you.
Not a threat right now. It is parked or listed for sale, it has been owned by someone else for two years or more, or it runs its own website that neither copies yours nor uses your name. These stay on the list and are rescored every run, so if one starts to look like you, it moves up.

Without one of those signs of intent, a lookalike never reaches Active threat and never sends a notification. Almost every registered domain can receive mail and has a certificate, so capability alone is not enough. On 2026-09-24 this rule moved dozens of ordinary businesses (a boat restorer registered in 1999, a packaging company, a 2006 insurance agency) out of Suspicious and Active threat. Stored lookalikes are rescored against the current rules every time you open the list, so no new scan is needed.

The bands

Band	Score	Meaning
No concern (benign)	0 to 14	Nothing here: it is older than your domain, it redirects to your site, it is not registered, or nobody has done anything with it
Watch	15 to 39	Registered by someone else, but not doing anything that points at you yet
Suspicious	40 to 69	Doing more than sitting there, for example it can receive mail. Worth a look this week
Active threat	70 and up	Set up to fool your customers. Deal with it today

Reaching Active threat takes a sign of intent plus enough signals to score 70: a copied homepage title on a live site (60 + 10), your name or a login page on a mail-capable site, or a brand-new registration with mail and a first certificate issued in the last 30 days (40 + 30). Without intent the score stops at 69. Parked, long-established and unrelated-business lookalikes stop at 30 (Watch).

Signals

Highest weight first. Each signal that applies is listed on the lookalike with its reason.

Signal	Weight	Why
Its homepage has the same title as yours	+60	Somebody copied your site. The only signal that is evidence of intent rather than capability
Can receive email (has MX records)	+40	It can take replies, which is what an invoice or password-reset scam needs. A "null MX" (`0 .`), which declares that the domain accepts no mail, does not count
Serves the same site icon as yours, byte for byte	+40	Usually a copied site, though two sites on the same stock theme can share an icon, so it cannot reach Active threat by itself
Got its first HTTPS certificate in the last 30 days	+30	Somebody is setting a site up now. Only the first certificate ever logged counts: certificates renew automatically every 60 to 90 days, so a renewal on a site that has had HTTPS for years is not new activity
Has an HTTPS certificate	+10	Replaces the +30 when the first certificate is more than 30 days old
Shares nameservers with other lookalikes of your domain	+25	Several lookalikes run by one operator is a campaign, not a coincidence
Built from non-Latin characters that look like Latin letters	+20	A homoglyph is never a typo
Found in certificate logs rather than by guessing	+15	Somebody requested a certificate that contains your name
Registered in the last 90 days	+15	Impostor domains are registered shortly before use
Resolves to a live server	+10	Something is being served there
Adds a word such as "login" or "billing" to your name	+10	The usual shape of a phishing domain
Its homepage uses your business name	+30	A word from your own page title (not a generic word like "home" or "services") appears in theirs
Its homepage asks visitors to sign in or pay	+30	Login, account, invoice, payment and webmail pages are what phishing sends people to
Shows a registrar parking page, with no mail, and the certificate logs confirmed it has no certificate	−25	It is being held, not used. A lookalike whose certificate was not checked does not get this discount
Parked with a domain marketplace, or a "coming soon" or "for sale" page	capped at 30	Afternic, ParkingCrew, Sedo, Bodis, Dan.com and similar hold names for sale with catch-all mail and automatic certificates, which say nothing about who will use it
Registered two or more years ago, or runs its own unrelated website	capped at 30	Another business with a similar name, not an impostor, unless it also shows a sign of intent

The score never goes below 0. Similarity to your name is not scored at all.

Shared nameservers only count when they are the operator's own. The default nameservers of large registrars and DNS hosts, and parking services' nameservers, are shared by millions of unrelated domains, so they are ignored when grouping lookalikes into a campaign.

What ends the assessment early

Three findings end the assessment at a score of 0 (No concern), whatever else is true:

It was registered before your domain, so it cannot have been registered to imitate you.
Its homepage redirects to your own site, which almost always means it is a protective registration you or a predecessor bought. It is flagged as likely yours so you can mark it ours.
It is not registered.

Names on shared hosting platforms

A name such as yourbrand.pages.dev, yourbrand.vercel.app or yourbrand.myshopify.com is a project on somebody else's hosting service, not a registration. Anyone can claim one without buying anything, the registry holds no record of it, and its certificate is issued automatically by the platform. DomainGuard therefore skips the registry and certificate lookups for these names, does not group them into campaigns by nameserver, and describes them as "set up on a shared hosting service" rather than "registered". They are still scored on what they can do, such as serving a copy of your homepage.

What needs clearance

DNS, registry and certificate log reads are public. The homepage title, the redirect check and the site-icon comparison reach the other party's server, so they run only when the domain being protected is verified (see Verifying a domain for deep scans). The public tool never runs them: its score is built from public records alone, and it says it did not check homepages. In the account the scan also takes a screenshot of up to three of the worst (Suspicious or Active threat) lookalikes.

Certificates the scan could not check

Certificate lookups are limited to 10 per scan, and go only to lookalikes that resolve, receive mail, or were found in certificate logs. A lookalike that was not looked up this run keeps the certificate result from the last run that did look. "No certificate" is recorded only when the certificate logs actually answered with none, so a skipped or failed lookup never reads as a lookalike that has just gained a certificate, and never earns the −25 parking discount.

The new-registration feed

A domain registered in the last few days may have no DNS and no certificate yet, so neither of the other two ways of finding lookalikes would see it. Once a day, DomainGuard reads a public list of newly registered domains and matches it against the names you watch. The list is published with a delay, so a match is typically about two days after registration, not the same day. It covers most common domain endings, not all of them, so a name missing from it may still have been registered.

Feed matching needs an active watch (Starter and up), and a domain name (the part before the ending) of at least 6 characters, because shorter names match too many unrelated registrations. If one of your names matches more than 8 new registrations in a single day, it is treated as a common word and that day's matches are dropped. A feed match enters the list at the Watch band and is scored properly on the next scheduled run of the watch.

Common questions

A lookalike scored 0 but it looks exactly like my domain. Read the reason. It was probably registered before your domain, or it redirects to your site. Resemblance alone is not a score.

Why is a lookalike that can receive mail only Suspicious, or Watch? Most registered domains can receive mail. Without a sign that it is aimed at you, it is a Possible threat at most, and a parked, old or clearly unrelated one is Not a threat right now.

Can I see why, and report it? Click (or tap) the domain. It opens the reasons, the registration date, the registrar and its abuse address, a ready-made abuse report to copy or email, and a link to visit the site. The link always opens the plain (punycode) address in a new tab; don't sign in or download anything there.

A scan said nothing about certificates. If the certificate logs could not be read at all during a run, the scan says so, and no result from that run says anything about certificates.