# Brand protection: lookalike domains | Precursor Intelligence

**Find the fake websites using your name. And get them taken down.**

> Brand protection finds web addresses made to look like yours, such as acme-payro11.com, by keeping watch over every domain you add. It shows which ones are registered, can receive email or put up a fake sign-in page, and drafts takedown emails for you to send. It is for any business whose customers could be fooled.

Canonical page: https://www.precursorintelligence.com/features/brand-protection
Breadcrumb: [Home](https://www.precursorintelligence.com/) > [Features](https://www.precursorintelligence.com/features) > Brand protection
Start free: https://www.precursorintelligence.com/register · Book a demo: https://www.precursorintelligence.com/contact

Watched continuously. Takedown emails drafted. Nothing to install.

Example data on this page uses the fictional company Acme (acme.co.uk, acme-payro11.com, documentation-range IP addresses such as 198.51.100.17).

## Contents

1. [What do we look for?](#what-do-we-look-for)
2. [How does it work?](#how-does-it-work)
3. [Which lookalikes are dangerous?](#which-lookalikes-are-dangerous)
4. [How do I get a fake site taken down?](#how-do-i-get-a-fake-site-taken-down)
5. [Who is behind it?](#who-is-behind-it)
6. [Could someone send email as you?](#could-someone-send-email-as-you)
7. [Can I block them on my own network?](#can-i-block-them-on-my-own-network)
8. [Questions](#questions)
9. [Related features](#related-features)

## What do we look for?

Add a domain and we keep watching for addresses that imitate it, then look closely at every one we find. These are the twelve things brand protection records:

1. **Typos.** Addresses one slip of the keyboard away from yours, such as acmme.co.uk.
2. **Swapped and lookalike characters.** An "rn" that reads as "m", a "1" in place of an "l", or a dot turned into a hyphen.
3. **Added words.** Your name with a word bolted on, such as acme-payroll or acme-login.
4. **Registered, and what changes.** Whether each lookalike is registered, and how it changes over time.
5. **Can receive email.** Lookalikes with mail servers set up, so mail sent to a name close to yours can arrive.
6. **A screenshot of the page.** What each live lookalike shows, captured so you never have to visit it.
7. **What the page does.** Whether it has a login form, uses your brand or takes payments.
8. **Risk and triage.** Each finding ranked by risk, with a status, relevance, assignee, notes and a timeline.
9. **Campaigns.** Lookalikes run by the same people, grouped so you can see the whole operation.
10. **New domains with your name.** Newly registered domains that contain your brand name, using watch rules you set. See [new domain monitoring](https://www.precursorintelligence.com/features/domain-monitoring).
11. **Your email set-up.** Whether SPF and DMARC on your own domains stop other people sending mail as you.
12. **Your certificates.** A warning before the SSL certificate on one of your domains expires. See [SSL certificate monitoring](https://www.precursorintelligence.com/features/ssl-certificate-monitoring).

## How does it work?

There is nothing to install. We work from public information about your domain and the lookalikes around it, and you decide what happens to each one.

1. **Add your domains** (once per domain). Add the domains you own. If you have several, group them into brands so they sit together.
2. **We look for lookalikes** (continuously). Each domain is checked for typos, swapped or lookalike characters and added words. Each lookalike is checked for registration and mail servers.
3. **We capture and rank it** (when one is found). Its page is captured and analysed for login forms, use of your brand and payments, then ranked by risk. You get an alert for new lookalikes and for changes.
4. **You decide and act** (when you are ready). Set a status, assign it and add notes. For a real threat, download the takedown emails to send yourself, or export a blocklist.

## Which lookalikes are dangerous?

Some lookalikes sit parked or up for sale. Others go live with a page that copies yours. We capture each page, check what it does and rank the list by risk, so the dangerous ones are at the top.

- **A screenshot of each lookalike page,** so you can see what your customers would see without visiting it yourself.
- **Findings in plain words,** such as "Asks visitors to sign in or pay". You never get an unexplained number.
- **Ranked by risk,** with checks for login forms, use of your brand and pages that take payments.
- **Triage as a team.** Set a status, mark relevance, assign it to someone and add notes. Every change lands on the finding's timeline.

New lookalikes and changes to known ones also arrive as alerts. See [alerts and reporting](https://www.precursorintelligence.com/features/alerts-and-reporting).

Example: acme-payro11.com, a lookalike of acme.co.uk with an added word and a "1" in place of an "l", is marked Critical risk. Its captured page is a fake "Acme Payroll" sign-in form. Our analysis found that it presents itself as your brand and asks visitors to sign in or pay. It is registered, can receive email, is assigned to Sam and set to Investigating.

## How do I get a fake site taken down?

Getting a lookalike removed means writing to the company it was registered through and the company hosting it. We draft both emails for you, with the evidence and a technical record, so you only have to read them and press send.

- **One email for the registrar and one for the host,** written in your name.
- **Evidence and a technical record included,** so the abuse team has what it needs to act.
- **Download it as an .eml file** and send it from your own mailbox.
- **We never send or submit anything for you,** so you stay in control of what is said in your name.

## Who is behind it?

When the same people run several lookalikes, we group them into a campaign. When one needs a closer look, an AI investigator examines it and writes you a report.

- **Campaigns.** Lookalikes run by the same people are grouped into one campaign, so you can see the whole operation instead of chasing addresses one at a time.
- **AI deep dive.** An AI investigator examines one lookalike and writes a report you can download as a PDF or Markdown. You can ask for up to 20 a day.

## Could someone send email as you?

A lookalike is one way to fake your email. Another is mail that claims to come from your real domain. Each domain's hub shows its email set-up beside its certificate, its lookalikes and its activity.

- **Email set-up at a glance:** whether SPF and DMARC are published, and whether they stop spoofed mail.
- **Group domains into brands,** so acme.co.uk and your other names sit together under one brand.
- **A warning before a certificate expires,** for every domain you add.
- **Activity per domain,** so you can see what changed and when.

## Can I block them on my own network?

Once you know a lookalike is dangerous, stop your own people reaching it. Export the list in a format your tools already read.

- **A DNS firewall file (RPZ)** to load into your own resolvers.
- **A Microsoft 365 block list** to import into the Tenant Allow/Block List.
- **STIX 2.1 indicators and a CSV** for a SIEM, a threat-intel platform or a spreadsheet.
- **Evidence packs and a monthly PDF report** for anyone who needs the paper trail.

Brand alerts can also go to your own tools by webhook, formatted for Slack, Microsoft Teams, Splunk or Microsoft Sentinel. See [integrations](https://www.precursorintelligence.com/features/integrations).

## Questions

### What is a lookalike domain?

A web address made to look like yours, with a typo, a swapped or lookalike character, or an extra word, such as acme-payro11.com instead of acme.co.uk. Scammers use them for fake websites and emails that fool customers and staff.

### How often do you check?

We keep watching each domain you add, and tell you as soon as we spot something. You get alerts for new lookalikes and for changes to the ones we already know about.

### Do you take fake sites down for us?

We prepare the takedown emails to the registrar and the host, with the evidence and a technical record, and you send them yourself as an .eml file. We never send or submit anything for you.

### Will you show me a similarity score?

No. You see plain-language labels such as "Uses your brand name" or "Asks for a password" and a risk level, never a numeric similarity or AI score.

### Can I use the results in my own tools?

Yes. Export a CSV, STIX 2.1 indicators, a DNS blocklist (RPZ) or a Microsoft 365 block list, and download evidence packs and a monthly PDF report. Brand alerts can also go out by webhook, formatted for Slack, Microsoft Teams, Splunk or Microsoft Sentinel.

### What about brand new domains that contain our name?

Set brand watch rules and we pick up newly registered domains containing your name from registry changes and certificate logs as they appear. See new domain monitoring for how it works.

## Related features

- [New domain monitoring](https://www.precursorintelligence.com/features/domain-monitoring): newly registered domains containing your brand name, picked up from registry changes and certificate logs as they appear.
- [SSL certificate monitoring](https://www.precursorintelligence.com/features/ssl-certificate-monitoring): get a warning before your own SSL certificates expire, with every domain's certificate in one place.
- [Alerts and reporting](https://www.precursorintelligence.com/features/alerts-and-reporting): alerts by email, in the app or by webhook as soon as we spot something, plus PDF reports you can share.
- [Attack surface management](https://www.precursorintelligence.com/features/attack-surface-management): map everything of yours that anyone online can reach, and see what changed since your last scan.
- [All features](https://www.precursorintelligence.com/features)

## Get started

Spot fake sites using your name early, and get them taken down. Add your domains and we keep watching for lookalikes, show you which ones are dangerous, draft the takedown emails and give you block lists for your own network.

- Start free: https://www.precursorintelligence.com/register
- Book a demo: https://www.precursorintelligence.com/contact
- Nothing to install · Unlimited team members · Data stored in London · Two-factor sign-in for everyone