> ## Documentation Index > Fetch the complete documentation index at: https://docs.infrawatch.com/llms.txt > Use this file to discover all available pages before exploring further. # Typosquatting > Find look-alike domains registered against your brands, and see what they are actually serving Typosquatting finds domains registered to resemble yours, then collects enough evidence for you to tell a parked misspelling from an active phishing site. Candidates are raised against the domains and brands in your inventory, so the detector improves as the inventory does. A `brand_name` asset with terms, aliases, and favicons attached gives it more to match than a bare domain. ## Sort by how close it is Every candidate carries an edit distance from the protected name, bucketed so you can triage without reading character by character: | Bucket | Distance | | ----------------- | -------- | | Very similar | 1 | | Highly similar | 2 | | Similar | 3 to 4 | | Partially similar | 5 to 6 | | Low similarity | 7 to 10 | Distance is a starting point, not a verdict. A single-character swap on a domain that resolves nowhere is less urgent than a distant name serving a copy of your login page. ## Look at what it serves This is what separates a real queue from a list of registrations. Each finding carries the evidence needed to make the call: * **A screenshot** of the site, as a thumbnail in the table and a gallery you can page through. * **The page** it settled on, including final URL and title after redirects. * **A favicon** fingerprint, which catches a copied site even when the page text has been changed. * **Registration** detail: registrar, and when the domain was registered. * **Where it resolves**: A, AAAA, and CNAME records, IP addresses, and nameservers, plus the hosting provider. Sort by registration date. A look-alike registered this week and already serving a copy of your login page is an active campaign; one registered six years ago and parked is somebody's expired portfolio. ## Trace it back Each finding lists the protected domains it was raised against, so when a candidate matches several of your brands you can see which parts of the inventory it threatens rather than guessing. ## Work the finding Typosquatting candidates are detector-owned. You cannot create one by hand, and you work them through the shared lifecycle: accept, resolve, ignore, mark false positive, or reopen. Marking one as a false positive is worth doing properly. It is the signal that keeps a legitimate partner domain or a name you own yourself out of next week's queue. Terms, aliases, and favicons give the detector more to match. Phishing and impersonation categories used across Infrawatch.