Resources  / Lookalike monitoring

How we know a name is live

When we know which addresses could copy yours, the next question is: which of them has somebody bought and switched on? That looks like a simple lookup. It is not. A wrong answer costs you in two ways. A false alarm wastes your time. A registration that we miss is the one that an attacker uses.

Why asking once gives the wrong answer

• Old answers

  Many of the servers that answer “does this address exist?” remember old answers. A name that the registry deleted last month can still look alive.

• Answers that are always yes

  Some servers answer every question with an advertising page of their own. To them, every name exists.

• Failures that look like “no”

  A server that is busy or broken can reply with something that reads exactly like “this name does not exist”.

• Endings that answer for everything

  A few domain endings reply for every possible name, registered or not.

How we get the right one

1. 1 Never trust one answer One server never decides a change. When anything looks different, we send the same question to many independent servers at the same time. The other answers outvote one wrong answer.
2. 2 Ask them from different places Servers run by the same network often share a memory, so their agreement proves nothing. We choose servers from different networks.
3. 3 Go to the source when it matters A registry runs each domain ending and keeps the official record of the names that exist. When the answers do not agree, or when something looks different, we ask the registry.
4. 4 A failure is not an answer An error or a silence counts as “we do not know yet”, never as “not registered”.
5. 5 Hear it twice A name changes from quiet to live (or back) only when we get the same answer two times in sequence. The official record can also decide it. One stray answer never becomes an alert.
6. 6 Check the checkers We test our servers regularly with questions whose answers we know. When a server gives a wrong answer, we stop using it.

Registered is not the same as dangerous

A registered name can stay empty for years, parked with a registrar. We find the names that have a website or can receive mail. An attacker can use those names against you today. The other names are only a possible danger in the future. The risk score starts from that difference.

Why this works

No single source on the internet tells the truth about every name. Many independent sources that agree do tell the truth. When they do not agree, we ask the official record. This is slower than one question. But when we tell you that a name is live, it is live.