Find the Domains Pretending to Be You
seabnac.io, seabhac-login.com, seаbhac.io with a Cyrillic а. Lookalike domains are the raw material of phishing and invoice fraud, and you never see them in your DMARC reports: they are someone else’s domains, sending as themselves.
What they almost always need is a TLS certificate, and every publicly trusted certificate is recorded in Certificate Transparency (CT) logs, usually before the site goes live. Seabhac.io follows every public CT log and tells you when a certificate appears for a name that looks like yours.
How it works
- Add the domains you want to protect: Your domain’s name is always watched as a brand word; add others (a product name, an old company name) and the domains you already own, so your own certificates never show up.
- Every new certificate is checked: We read every public CT log as it grows and match each certificate name against your domains in real time: typos, other endings, look-alike characters, and your brand inside another name.
- Each lookalike is looked up: Does it have a website? Can it receive mail? Does it publish SPF or DMARC? When was it registered? We take a screenshot of the site, so you can see whether it is a parked page or a copy of your login form.
- You are told, once: Owners and admins get one alert listing the new lookalikes and what each can already do, and another when a lookalike starts receiving mail.
What Counts as a Lookalike
- Typos: one letter missing, doubled, swapped, or replaced by a neighbouring key (
seabhca.io,seabhacc.io,seabnac.io), bit flips, and an added hyphen. - Other endings: your exact name under another TLD, such as
seabhac.com,seabhac.coorseabhac.co.uk. - Look-alike characters:
seаbhacwith a Cyrillicа, orrnstanding in form, matched with the Unicode confusables table (UTS #39). These are the hardest to spot by eye, so we show both the decoded name and itsxn--form. - Your brand in another name:
secure-seabhac-billing.com,seabhac.account-verify.net.
Your own domain, its subdomains, and the domains you mark as yours are never reported.
Know Which Ones Are Dangerous
A lookalike that only has a certificate is a warning. One that serves a copy of your login page, or has MX records so it can receive replies to a fake invoice, is a problem. Every lookalike is shown with:
- Website and a screenshot of what it serves, including where it redirects to.
- Receives mail when it has MX records, plus whether it publishes SPF and DMARC, which make its own mail more likely to land in an inbox.
- Registration date from WHOIS: a domain registered yesterday deserves more attention than one from 2009.
Each lookalike is checked daily during its first month, and you get a separate alert the day one of them starts receiving mail.
Triage in One Click
Every watched domain has its own page with counts (new lookalikes, found in the last 7 days, able to receive mail) and a list you can work through:
- Ours for a domain that belongs to you. It is added to your owned domains and never reported again.
- Ignore for one that is not a threat. Later certificates for it stay ignored.
- Restore if you change your mind.
Plans
Lookalike domain monitoring is included in the Pro plan (2 watched domains) and Business plan (10 watched domains). Enterprise plans can watch as many as they need. See the lookalike domains documentation for details.