Look-alike Domain Monitoring and Security Alerts
Attackers often register domains that look almost like yours – yourcornpany.com instead of yourcompany.com – to send convincing phishing e-mails to your staff, customers and suppliers. AutoPhish watches for such look-alike domains and shows them in the Security Center, so you can react before they are used against you.
How it works
For every verified domain in the Security Center, AutoPhish checks up to 200 variations once a day, for example:
- missing, swapped, doubled or replaced characters
- characters from other alphabets that look the same (e.g. a Cyrillic "а" instead of a Latin "a")
- added hyphens, subdomain tricks and other common top-level domains
Only variants that are actually registered and in use are reported. Monitoring starts automatically once a domain is verified – see "How to set up the Security Scan for your Domain".
Risk levels
Level | Meaning |
|---|---|
Critical | The domain has a mail server (MX record) – it can send and receive e-mail |
High | Active, and uses look-alike characters or a subdomain trick |
Medium | Other active variants |
Low | Everything else |
Where to see look-alike domains
- Dashboard – the tile Active Threats shows how many look-alike domains were detected.
- Security → Issues → Domain threats – the full list of detected look-alike domains with their risk level. Expand an entry for details.
- The Security Center PDF report includes a section on look-alike domains.
What to do with a finding
- Check the domain – is it yours (e.g. bought for brand protection) or a partner's? Then click Dismiss. Dismissed domains no longer count as active threats and can be restored anytime with Show dismissed → Restore.
- Warn your people – especially for Critical findings: tell staff, finance and key suppliers about the domain and ask them to report e-mails coming from it.
- Block it – add the domain to the block list of your e-mail security and web filter.
- Consider a takedown – your registrar, the domain's hosting provider or a legal advisor can help with abusive registrations.
Do not delete suspicious e-mails from a look-alike domain – report them and keep them, so they can be analysed.
Security alerts and digests
Admins can control how AutoPhish notifies them about security findings in Settings → Account:
- Company security alert threshold – new or recurring issues at or above this severity (default: High) are bundled into one alert e-mail a few minutes after detection. Applies to domains with Email Alerts switched on (Security → Domains → your domain → Settings).
- Security digest frequency – Daily, Weekly (default) or Monthly summary of non-urgent changes, such as new and resolved issues.
- Security notifications – your personal notifications about phishing reports and overdue training.
The company-wide settings can only be changed by company administrators.
Good to know
- Unverified domains are not monitored.
- A newly registered look-alike domain is usually picked up by the next daily check.
- Look-alike monitoring complements the DNS and vulnerability checks described in "Security Scan: DNS, E-Mail & Web Vulnerability Checks".
Updated on: 27/10/2026
Thank you!