Resources / Lookalike monitoring
I have a suspicious lookalike. Now what?
You have a lookalike that a tool, or a person, calls suspicious. Heuristics say it might be bad. That is a reason to look, and it is not yet an answer. The work has three parts: collect what can be known, judge it, then act.
1. Reconnaissance: collect the evidence
Do not open the site in your own browser. A hostile page may attack whoever visits, and it may notice that you looked. Everything below works from a distance.
- Read its digital footprint. Who registered it and when, who runs its DNS, whether it can receive or send mail, and what else sits on the same servers. A domain registered last week with mail set up and no website deserves a closer look.
- See if others have called it. Check whether threat intelligence services and blocklists already know the name, for example VirusTotal.
- Have something else visit it. urlscan.io opens a page for you and shows a screenshot and what it loaded. Remember that a public scan is visible to others, including the attacker. We run our own capture application for this.
- Look at its past. The Internet Archive shows whether the name had an honest life before today.
- Check its scripts. The hash of a script can be looked up without running the script. A hash that known-bad sites share is strong evidence.
2. Evaluate: make a judgment
Put what you collected together and decide. Could this be somebody's honest business, or a parked name waiting for a buyer? Does the page copy yours? Does it take passwords? Can it send mail, and did that start recently? No single answer settles it. A new domain can be legitimate, and a hostile one can look quiet until the day it is used. If you cannot decide, keep watching it: a change to the name is new evidence.
3. Act: block, take down, or both
| Blocklisting | Takedown | |
|---|---|---|
| How fast | Immediately after a list accepts it, often minutes | Often days |
| How much it stops | Part of it: only people whose tools read the list | All of it, when it works |
| Who decides | The list operators, on the evidence | The registrar or host, who owes you nothing |
| What can go wrong | A listing can lapse | No guarantee of success. It can also be partial, such as stopping only the mail |
The two are not exclusive. Block to protect people today, and ask for a takedown to end it. Then keep watching, because a removed attacker can come back under the next name. Why we block first goes further.
Watch your domain for lookalikes each week for free.