Skip to main content
Typosquatting finds domains registered to resemble yours, then collects enough evidence for you to tell a parked misspelling from an active phishing site. Candidates are raised against the domains and brands in your inventory, so the detector improves as the inventory does. A brand_name asset with terms, aliases, and favicons attached gives it more to match than a bare domain.

​
Sort by how close it is

Every candidate carries an edit distance from the protected name, bucketed so you can triage without reading character by character: Distance is a starting point, not a verdict. A single-character swap on a domain that resolves nowhere is less urgent than a distant name serving a copy of your login page.

​
Look at what it serves

This is what separates a real queue from a list of registrations. Each finding carries the evidence needed to make the call:
  • A screenshot of the site, as a thumbnail in the table and a gallery you can page through.
  • The page it settled on, including final URL and title after redirects.
  • A favicon fingerprint, which catches a copied site even when the page text has been changed.
  • Registration detail: registrar, and when the domain was registered.
  • Where it resolves: A, AAAA, and CNAME records, IP addresses, and nameservers, plus the hosting provider.
Sort by registration date. A look-alike registered this week and already serving a copy of your login page is an active campaign; one registered six years ago and parked is somebody’s expired portfolio.

​
Trace it back

Each finding lists the protected domains it was raised against, so when a candidate matches several of your brands you can see which parts of the inventory it threatens rather than guessing.

​
Work the finding

Typosquatting candidates are detector-owned. You cannot create one by hand, and you work them through the shared lifecycle: accept, resolve, ignore, mark false positive, or reopen. Marking one as a false positive is worth doing properly. It is the signal that keeps a legitimate partner domain or a name you own yourself out of next week’s queue.

Add a brand asset

Terms, aliases, and favicons give the detector more to match.

Understand the taxonomy

Phishing and impersonation categories used across Infrawatch.