A look-alike is a domain registered to pass for yours: one letter changed, a hyphen added, another extension, or your brand next to a word such as “login”. The audits of a proved domain look for them; when one sends mail or shows a sign-in page, the Look-alike domains page of the domain helps you get it taken down.

The takedown kit is included from the Solo plan, like the look-alike watch itself. On Free, the page says what it brings and links to the plans.

Open a takedown case

Open a proved domain. The Look-alike domains card says how many the latest audit found; follow its link (or Prepare a takedown under a look-alike finding).
The page lists each look-alike with why it is listed (the kind of typo, a mail server, a website, or your brand in a certificate) and when it was registered. The riskiest come first. Names you marked as yours in the domain’s settings are left out.
Press Prepare a takedown on the one that impersonates you.

The case opens and the evidence is collected in about a minute; the page updates by itself.

The evidence

We collect it passively, as an investigator would, without ever filling in a form or clicking on the look-alike:

its DNS: addresses, mail servers, name servers;
its registration (RDAP): the registrar, its IANA number and abuse contact, the creation date and status. Nothing about the holder: their name, address and e-mail are never read, even when the registry publishes them;
the network of its addresses (RDAP of the regional registries): the host and its abuse contact;
the certificates issued for it, from the public Certificate Transparency logs;
one request for its home page, with the Perimetry user agent: its title, an excerpt, whether it shows a sign-in or payment form, names your brand, loads resources from your own site, and how close its title and text are to yours.

Each element carries the time it was read and its SHA-256 fingerprint, and the whole file has its own fingerprint, printed on the page and in the letters. Download it as Evidence (PDF), in the language of the workspace, or Evidence (JSON): the JSON file has exactly that fingerprint. Collect again (once every 10 minutes at most) is useful before a second report.

Send the letters

The Letters ready to send section has three letters, in English, French or German (the workspace’s language first; switch with the links above them):

To the registrar: the facts, the fingerprint of the evidence, and the request to suspend the domain and keep its records;
To the host: the same, asking to remove the content and suspend the account;
To the reporting services: a short report to paste into their forms, and the list of official services with their addresses: Google Safe Browsing, Microsoft, Netcraft, APWG (for a phishing e-mail), and for France PHAROS and Signal Spam.

Add your name, role and contact at the bottom, then send them from your own mailbox. Copy the letter, Download .txt, or Download .eml: a draft your mail program opens with the address, the subject and the evidence (PDF and JSON) already attached. We never send anything to the registrar, the host or anyone else on your behalf.

If no abuse address is published, the letter says so: look for the abuse form on their website.

Follow it up

Under Record a report, note each report you sent: to whom and on which day, with a ticket number if you have one. The case then shows “Reported to … on …”.

While the case is open, we check the look-alike every 6 hours: is its page still answering, does its name still resolve? Your alert channels are told when it goes down and when it comes back. The case shows Taken down once its name no longer resolves.

Close the case when it is resolved, or if the domain turns out to be harmless or yours: checks stop, and you can reopen it. If it is yours, also add it to the owned names in the domain’s settings so that audits stop listing it.

Viewers can read the cases and download the evidence and the letters; members, admins and owners open, record and close them.

Pages that copy your brand (urlscan.io)

Look-alike domains are found by their names. A phishing page can also live on a domain that looks nothing like yours. To catch those, paste your own urlscan.io key in Settings › Impersonation watch (a free urlscan account is enough for most workspaces; the searches count against its quota, not ours). Every day, for each proved domain, the public analyses of urlscan are searched for pages on other domains that load files from your domain (a phishing kit often keeps your logo and scripts) or carry its name in their address. Nothing is ever submitted to urlscan in your name.

The pages found appear in the Impersonation watch card of the domain page, with urlscan’s verdict and a link to its report and screenshot. The first search is a reference and alerts no one; new pages after that go to your alert channels. Dismiss a page you have dealt with, or mark its whole site as legitimate (a partner that shows your logo, one of your other sites) so that it is never reported again for this domain. For a real copy, the letters of this page work the same way: write to the host and to the registrar of the domain that serves it.