Spot the domains pretending to be you
Criminals register names like y0urcompany.co.uk or yourcompany-invoices.com and send email from them. That email passes SPF, DKIM and DMARC, because they own the domain. FlashFortify finds these domains and tells you which ones look dangerous.
Every likely imitation of your domains
Each day, FlashFortify works out the names an attacker is likely to use for each of your sending and parked domains, and checks which ones have been registered.
- Lookalike characters, such as o replaced by 0, or m by rn
- Typing mistakes: missing, doubled or swapped letters
- Other endings, such as .com for a .co.uk domain
- Added words, such as -invoices, -login or -secure
- New certificates naming your brand, from public certificate transparency logs
| Lookalike | Risk |
|---|---|
| y0urcompany.co.uk Registered 3 days ago, set up for email, login page | High |
| yourcompany-invoices.com Set up for email, no website | Medium |
| yourcompnay.co.uk Parked for sale | Low |
Illustration with example data
The signs that a domain is being used against you
For every registered lookalike, FlashFortify gathers the facts that show whether it's a threat, then scores it from 0 to 100.
Set up for email
Mail servers, SPF and DMARC records show the domain can send or receive email, the usual sign of a phishing or invoice fraud set-up.
Newly registered
The registration date and registrar come from the domain registry. We never keep the registrant's personal details.
What the website shows
Whether it redirects to your own site, is parked for sale, or shows a login form using your brand.
Known for abuse
Whether threat intelligence services from abuse.ch already list the domain for malware.
Scored by published rules
Every score is made of fixed points that you can see, so you know exactly why a domain is rated high, medium or low.
Alerts and review
You're alerted when a new high or medium risk domain appears, or one rises to high. Mark each one as yours or ignore it, and export the list as CSV.
Questions
Why doesn't DMARC stop this?
DMARC protects the exact domain you publish it on. A lookalike is a different domain, owned by the attacker, so its email can pass every check. The defence is knowing about it early: warn your staff and customers, and report it to the registrar or host.
Does FlashFortify decide that a domain is malicious?
No. A high score means "possible impersonation, worth a look". A person decides what to do about it, with the evidence in front of them.
Which plans include it?
Lookalike monitoring is included from the Professional plan upwards. See pricing.
Find out who's imitating your domains
Lookalike monitoring is included from the Professional plan.