A lookalike domain imitates yours closely enough to fool a reader: seabnac.io, seabhac-login.com, or seаbhac.io with a Cyrillic а. They are used for phishing pages and for invoice fraud, and they never show up in your DMARC reports, because they send as themselves.
Almost every phishing site needs a TLS certificate, and every publicly trusted certificate is published in a Certificate Transparency (CT) log, usually before the site is in use. Seabhac.io follows all public CT logs and matches every new certificate against the domains you watch.
Plans
| Free | Pro | Business | Enterprise | |
|---|---|---|---|---|
| Watched domains | – | 2 | 10 | Custom |
Watching a domain
Go to Lookalikes in the sidebar and fill in:
- Domain: the domain to protect, for example
example.com. If you enter a subdomain, its registrable domain is watched (mail.example.comwatchesexample.com). - Extra brand words (optional): other names to look for, such as a product or an old company name. The first label of the domain (
example) is always a brand word. Brand words need at least 4 characters, so short words do not match half the internet. - Domains you own (optional): your other domains, for example
example.netorexample-mail.com. They are never reported.
Separate several values with commas. Owners and admins of the organization can add, change and remove watches; other members can see them.
Matching starts within 5 minutes and covers certificates logged from then on. Certificates issued before you added the domain are not searched yet.
What is matched
Every name in a certificate (the subject and all DNS names, with a leading *. removed) is compared with each watched domain:
| Type | Example for example.com | How it is found |
|---|---|---|
| Typo | exmaple.com, examplle.com, exampke.com, ex-ample.com, example.co | One edit of the name: a missing, doubled or swapped letter, a neighbouring key, a bit flip, a hyphen, or the same name under another common TLD. |
| Look-alike characters | exаmple.com (Cyrillic а), exarnple.com | The name contains a brand word after both are reduced to how they look, using the Unicode confusables table (UTS #39). |
| Brand | example-billing.com, example.secure-login.net | A brand word appears literally anywhere in the name. |
Matches are grouped by the lookalike’s registrable domain. When one domain matches in several ways, the strongest (typo, then look-alike characters, then brand) is shown.
Your watched domain, its subdomains and your owned domains are excluded. Names are matched on the domain itself, so a CDN or SaaS host such as example.herokuapp.com is reported as a brand match on herokuapp.com; mark it Ours if it is yours.
The lookalike pages
The Lookalikes page shows totals for all watched domains, and a row per domain with its counts. Click a domain to open its page.
Each watched domain’s page shows:
- New lookalikes: domains you have not reviewed yet.
- Found in the last 7 days.
- Can receive mail: new lookalikes with MX records.
- Certificates, last 24 hours.
Then the list of lookalike domains, with tabs for New, Ours, Ignored and All. For each domain you see why it matched, the certificate names, when it was first and last seen, and a link to the certificates on crt.sh.
Is it live?
Each new lookalike is looked up straight away, then once a day for a month:
| Shown as | Meaning |
|---|---|
| Website | The domain has A or AAAA records. |
| Receives mail | The domain has MX records. A null MX (.) counts as no mail. |
| SPF, DMARC | The domain publishes them, so its own mail is more likely to be delivered. |
| Registered … | The creation date from WHOIS, looked up once. |
Screenshots
New lookalikes with a website get a screenshot of https://<domain>/ (or http:// if HTTPS does not load), taken from one of our probe locations at 1280×800. The page shows a thumbnail, the page title, the host it redirected to if that is somewhere else, and when the screenshot was taken. Click the thumbnail for the full image.
Screenshots are refreshed every 3 days during the month after a lookalike is first seen, and kept for 30 days. A failed attempt is retried after a few hours; hover over No screenshot to see why it failed.
The browser that takes screenshots can only reach public addresses on ports 80 and 443, so a lookalike cannot use it to reach internal systems.
Reviewing lookalikes
Use the buttons on each row:
- Ours: the domain is yours. It is added to the watch’s owned domains, so new certificates for it are no longer reported.
- Ignore: not a threat. It moves to Ignored, and later certificates for the same domain arrive as ignored too.
- Restore: move it back to New. Restoring an Ours domain also removes it from the owned domains.
Domains marked Ours or Ignored do not count as new, are not alerted, and do not get screenshots.
Alerts
Owners and admins of the organization are notified through their notification channels and alert email:
- 🎣 New lookalike domains: one message listing up to 10 new lookalikes, with why each matched and what it can already do (receives mail · has a website · registered 2 days ago). The alert waits up to 10 minutes for the DNS lookup, so it can include that.
- 📬 Lookalike domain can now receive mail: sent once, when a lookalike that had no MX records gets them. A lookalike that can receive mail is ready for invoice fraud: replies to a fake invoice go to the attacker.
To stop alerts for one watched domain, click Edit on its page and clear Alert owners and admins. Matches are still recorded.
Limits
- Only domains with a publicly trusted certificate are found. A lookalike used only for sending mail, or served over plain HTTP, has no certificate and does not appear in CT logs.
- Matching covers certificates logged after you add a domain.
- A popular brand word can match a lot of unrelated names. Use Ignore, or choose more specific brand words.