FakeWatch
Start free

Data sources

Where our findings come from, and the credits and licenses for the data and tools we use.

FakeWatch combines public lists, public APIs and its own checks. None of these sources is ours, and none of them endorses FakeWatch. We only send them the public addresses and names we need to check, never data about you or your team. What we share is described in the Privacy Policy.

Domains and phishing lists

  • Certificate Transparency logs. Public logs of new TLS certificates, read through a local certstream-server-go. This is how we see most new look-alike sites within minutes.
  • WhoisDS daily list of newly registered domains, which WhoisDS allows to be reused, including for commercial purposes.
  • ScamSniffer scam-database, a list of known crypto phishing domains, licensed under GPL-3.0. We read the public version, which is published with a 7-day delay.
  • MetaMask eth-phishing-detect, the phishing blocklist used by the MetaMask wallet, licensed under the DBAD Public License. The list is the work of MetaMask and its contributors, not ours.
  • Phishing.Database Phishing.Database, a list of active phishing domains, licensed under the MIT License. The list is the work of Mitchell Krog, Nissar Chababy and contributors, not ours.
  • Majestic Million by Majestic, licensed under CC BY 3.0. We use it to recognize popular, long-standing sites, so they are not flagged as new fakes.
  • RDAP registration data, found through the IANA bootstrap files, to see when a domain was registered and which registrar to report it to.

Site checks

  • Google Web Risk. When a finding says "Google Web Risk", the advisory is provided by Google. Google works to provide the most accurate and up-to-date information about unsafe web resources, but cannot guarantee that its information is comprehensive and error-free: some risky sites may not be identified, and some safe sites may be identified in error.
  • Wayback Machine by the Internet Archive. We ask it to save a public copy of a fake site, so the evidence survives after the site goes down.
  • Our own isolated browser, which opens suspected sites and takes screenshots. It runs on our server and is never connected to your accounts.

Token data

Social platforms

We search X, Telegram and Discord through their APIs for public accounts, channels, groups and servers that use your project's names and handles. We never read private messages.

App and extension stores

  • Apple App Store, through Apple's public iTunes Search API, for apps in the US App Store that use your project's name. App data belongs to Apple and the app developers.
  • Google Play public search and app pages, read at a low rate, for apps that use your project's name. App data belongs to Google and the app developers.
  • Firefox Add-ons, through Mozilla's public add-ons API, for browser extensions that use your project's name. Add-on data belongs to Mozilla and the add-on developers.
  • Chrome Web Store public search and extension pages, read at a low rate, for browser extensions that use your project's name. Extension data belongs to Google and the extension developers.

We never install, download or run the apps or extensions we list. Their icons are shown from a small copy kept on our server, so your browser never loads anything from the stores.

Code registries

  • GitHub, through GitHub's public REST API, for new repositories that use your project's name.
  • npm, through the public npm registry API, for packages that use your project's name.
  • PyPI, through its public Simple and JSON APIs, for Python packages that use your project's name.

Package and repository data belongs to their authors and the registries. We never install, download or run the code we list.

YouTube

We find fake channels and scam live streams with YouTube API Services, through the official YouTube Data API. We search for channels and streams that use your project's name and do not read YouTube pages directly. Channel and video data belongs to YouTube and the channel owners. We keep it for 30 days at most and refresh it on every check. Using these results means you agree to the YouTube Terms of Service; Google's handling of data is described in the Google Privacy Policy.

Bluesky

We find fake accounts and scam posts through Bluesky's public AT Protocol API, without an account and without reading bsky.app pages. We search for accounts and recent posts that use your project's name. Account and post data belongs to their authors. When an account or post is deleted, we drop its text on the next check, and we drop all of it after 30 days without a check.

AI checks

Borderline findings are reviewed by language models from Google (Gemini API), called directly or through OpenRouter. They see only public data about the suspected fake and your brand's public name and logo. An AI answer is one signal in the score, never the only one.

Payments

We confirm crypto payments by reading public blockchain nodes and do not use a payment processor. The networks we accept are listed on the payments page.

Open-source software

  • dnstwist (Apache-2.0) generates look-alike spellings of your domain to check.
  • certstream-server-go (MIT) reads Certificate Transparency logs.
  • The rest of FakeWatch is built on open-source software such as Python, FastAPI, PostgreSQL and Playwright. We thank their authors.

Accuracy and corrections

Lists and APIs can be wrong or out of date, and so can our scores. If FakeWatch flags your site or account by mistake, or you maintain one of these sources and want us to change how we credit or use it, email [email protected].