Brand Impersonation Check
How exposed is your brand to impersonation? Registered lookalike domains, exposed dev and admin subdomains and wildcard certificates, from DNS and CT logs.
Detected
A registered lookalike domain is not proof of impersonation — it may be a legitimate third party or your own. Verify ownership of each domain yourself. DechoNet only reports the exposure; it never labels an individual domain as an impersonator.
Pro Watch this exposure every day
Today's exposure is only this moment. A newly registered typosquat domain or a newly exposed operational subdomain only appears over time. A watch re-checks this domain daily and records each change on a watch page.
Start watching this domain →Related Guides
What is the Brand Impersonation Exposure check
It checks, in one lookup, which typosquat (lookalike-spelling) domains targeting your domain actually exist, which operational subdomains (dev, staging, admin, …) are exposed in CT logs, and whether a wildcard certificate exists. It works from public DNS and Certificate Transparency logs. Nothing is sent to your domain; for up to 24 lookalikes that exist, one HEAD request each checks whether they redirect to you (your own defensive registrations).
How it works
It generates the variants phishers actually use (homoglyph, omission, transposition, TLD swap), confirms which ones are delegated in DNS, reads their registration dates (RDAP) — a lookalike registered before this domain or over three years ago counts as an established name and is not scored — and lists subdomains and wildcard certificates from Certificate Transparency logs (crt.sh, with Cert Spotter as a fallback). There is no port scanning or crawling.
FAQ
Is every live lookalike domain an impersonator?
No. The mere fact that a lookalike-spelling domain is registered does not make it an impersonator — it may be a legitimate business or your own. This check only reports the exposure; you must verify the ownership and use of each domain yourself.
Does this check harm the target?
No. Nothing is sent to your domain — the check uses public DNS and Certificate Transparency logs. For up to 24 existing lookalikes we send one HEAD request each to see whether they redirect to your site, which marks them as your own defensive registrations.
How do I learn about new impersonation domains?
A one-time check shows only the current moment. Start a watch and DechoNet re-checks the domain daily and records newly live lookalike domains or newly exposed subdomains on the watch page.