> ## Knowledge Base Index
> Fetch the complete knowledge base index at: https://help.autophish.io/sitemap.xml
> Use this file to discover available pages before exploring further.
> Pure-Markdown content can be obtained by appending a '.md' suffix to the content URLs listed in the sitemap (without the trailing slash).

# Look-alike Domain Monitoring and Security Alerts

Attackers often register domains that look almost like yours – `yourcornpany.com` instead of `yourcompany.com` – to send convincing phishing e-mails to your staff, customers and suppliers. AutoPhish watches for such look-alike domains and shows them in the Security Center, so you can react before they are used against you.

## How it works

For every verified domain in the Security Center, AutoPhish checks up to 200 variations once a day, for example:

- missing, swapped, doubled or replaced characters
- characters from other alphabets that look the same (e.g. a Cyrillic "а" instead of a Latin "a")
- added hyphens, subdomain tricks and other common top-level domains

Only variants that are actually **registered and in use** are reported. Monitoring starts automatically once a domain is verified – see "How to set up the Security Scan for your Domain".

## Risk levels

| Level | Meaning |
| ---- | ---- |
| **Critical** | The domain has a mail server (MX record) – it can send and receive e-mail |
| **High** | Active, and uses look-alike characters or a subdomain trick |
| **Medium** | Other active variants |
| **Low** | Everything else |

## Where to see look-alike domains

- **Dashboard** – the tile **Active Threats** shows how many look-alike domains were detected.
- **Security → Issues → Domain threats** – the full list of detected look-alike domains with their risk level. Expand an entry for details.
- The Security Center **PDF report** includes a section on look-alike domains.

![Security - Issues - Domain threats](https://storage.crisp.chat/users/helpdesk/website/-/4/3/7/4/437439cedb096800/security-domain-threats_6s7i53.png)


## What to do with a finding

1. **Check the domain** – is it yours (e.g. bought for brand protection) or a partner's? Then click **Dismiss**. Dismissed domains no longer count as active threats and can be restored anytime with **Show dismissed** → **Restore**.
2. **Warn your people** – especially for Critical findings: tell staff, finance and key suppliers about the domain and ask them to report e-mails coming from it.
3. **Block it** – add the domain to the block list of your e-mail security and web filter.
4. **Consider a takedown** – your registrar, the domain's hosting provider or a legal advisor can help with abusive registrations.

Do not delete suspicious e-mails from a look-alike domain – report them and keep them, so they can be analysed.

## Security alerts and digests

Admins can control how AutoPhish notifies them about security findings in **Settings → Account**:

- **Company security alert threshold** – new or recurring issues at or above this severity (default: High) are bundled into one alert e-mail a few minutes after detection. Applies to domains with **Email Alerts** switched on (Security → Domains → your domain → Settings).
- **Security digest frequency** – Daily, Weekly (default) or Monthly summary of non-urgent changes, such as new and resolved issues.
- **Security notifications** – your personal notifications about phishing reports and overdue training.

The company-wide settings can only be changed by company administrators.

## Good to know

- Unverified domains are not monitored.
- A newly registered look-alike domain is usually picked up by the next daily check.
- Look-alike monitoring complements the DNS and vulnerability checks described in "Security Scan: DNS, E-Mail & Web Vulnerability Checks".