FakeWatch
Start free

How does FakeWatch find lookalike and phishing domains?

Scam sites need a domain and almost always an SSL certificate. We watch both and open every suspicious page in an isolated browser.

Last updated: · By the FakeWatch team

What we watch

  • New SSL certificates. Every certificate published in public Certificate Transparency logs, checked in real time on paid plans. A phishing site usually gets its certificate shortly before it goes live.
  • Newly registered domains. Daily lists of new domains, matched against your project's name and keywords.
  • Typo and lookalike variants. Thousands of variants of your own domain: typos, swapped and doubled letters, homoglyphs, extra words such as claim or airdrop, and other endings.
  • Scam blocklists. Public lists of phishing domains, checked for anything that targets you.

How a suspicious site is checked

  1. The domain is resolved. Parked domains stay on watch in case they go live later.
  2. A live site is opened in an isolated browser, without a real wallet.
  3. We compare it with your site: logo match, copied text, wallet connection prompts and known drainer code.
  4. The site gets a risk score from 0 to 100 with every reason listed. A score of 80 or more is urgent and alerted right away.

What you get in an alert

The domain, the reasons for its score and the evidence. One click opens a ready takedown report addressed to the right registrar or host. Mark any domain as yours or a partner's and it is not flagged again.

By plan

From our current plans. See all plans and prices.
What is includedFreeProAgencyManaged
Website domains per project1101010
New SSL certificatesNot includedReal timeReal timeReal time
Newly registered domainsNot includedDailyDailyDaily
Typo and look-alike domainsOne-time scanEvery hourEvery hourEvery hour
Scam blocklistsOne-time scanEvery hourEvery hourEvery hour

Frequently asked questions

Which lookalike domains does FakeWatch check?

Typos, swapped and doubled letters, homoglyphs, extra words such as claim or airdrop, and other endings of your domain.

What happens to parked domains?

They stay on watch. If a parked domain starts serving a page, it is checked again and you get an alert if it copies your site.

Is domain monitoring included in the free plan?

The free plan runs a one-time scan of lookalike domains. Continuous monitoring and real-time certificate checks start on Pro.

  • Lookalike domainsLookalike domains copy a real domain with typos, swapped letters, other TLDs, extra words or Unicode characters. How each type works and how to find them.
  • Certificate TransparencyEvery public HTTPS certificate is logged in Certificate Transparency logs. How the logs work, why Chrome requires them, and how they reveal new fake domains.
  • Lookalike domain checkerFree tool: enter your domain and see which typo, homoglyph and keyword variants of it are already registered. No sign-up.
  • Takedown reportsFakeWatch finds where to report each fake, fills in the report with evidence and rechecks until the fake is down. You send it; no contract needed.