Request demo

Phishing Detection and Prevention

Catch Phishing Infrastructure at the Registration Stage.

A phishing campaign needs an address before it needs anything else, and every step of setting one up leaves a trace in data the platform already collects. Brand Risk Protection matches new names against your brand and watches each match until it is ready to send.

Request demo

lookalikeacme-login.example

  1. Registered

    matched by your rule

  2. Resolves

    dns: the name answers in DNS

  3. Takes mail

    dns_mx: a mail exchanger is configured

  4. Has a certificate

    ssl: it serves an SSL certificate

  5. Goes live

    http: it answers on the web

A Phishing Domain Announces Itself Early.

By the time a customer reports a phishing page, the campaign has already run. The stages before it are quieter but visible: a name that matches your brand, then a DNS record, a mail exchanger, a certificate.

Detection that starts at registration leaves your team time to act.

RegisteredMatched by one of your rules against a brand keyword
Resolvesdns: the name answers in DNS
Takes maildns_mx: a mail exchanger is configured
Has a certificatessl: it serves an SSL certificate
Goes livehttp: it answers on the web

The Ways a Name Can Pass for Yours.

Each rule pairs a brand keyword with one match type. Below, one name and a domain each type would catch: the confusable types add the substitutions a typo list never checks.

  1. acme.example

    Your keyword

    Each rule pairs it with one match type

  2. acme.test

    Same name · exact

    The name itself, on another TLD

  3. acme-login.example

    Name inside · contains

    The name inside a longer label

  4. acrne.example

    Typo · fuzzy

    One edit away: a dropped, doubled, swapped or mistyped letter

  5. acem-verify.example

    Typo inside · fuzzy_contains

    A typo inside a longer label

  6. аcme.example

    resolves as xn--cme-5cd.example

    Lookalike letters · confusable_exact

    Letters swapped for ones that look identical

  7. аcme-login.example

    resolves as xn--cme-login-zyh.example

    Lookalike letters inside · confusable_contains

    Lookalike letters inside a longer label

  8. aсem.example

    resolves as xn--aem-4ed.example

    Lookalike and typo · confusable_fuzzy

    A typo and a lookalike letter together

  9. secure-aсem.example

    resolves as xn--secure-aem-jwi.example

    Lookalike and typo inside · confusable_fuzzy_contains

    Both, inside a longer label

Follow One Lookalike From Start to Finish.

  1. 01

    Rule

    Pick brand keywords and match types in Fraudulent Domain Monitoring, then narrow each rule: domains or subdomains, extensions, words that discard a match.

  2. 02

    Triage

    Suspicious domains arrive with the rule that matched them. Your team approves or ignores them in bulk, by filter.

  3. 03

    Watch

    Approved names are monitored for DNS, mail, certificate and web activity, and their risk score is kept as a timeline.

  4. 04

    Investigate

    Pivot through Domain Search to the campaign’s other domains: same IP, same name servers, or the same registrant within minutes.

  5. 05

    Act

    File with the evidence yourself or hand the case to Managed Takedown, then confirm the result on the next scan.

Script the Rules and the Review.

Rules, suspicious domains, review actions and monitored lookalikes, with their history and risk-score timelines, are available through the BRP API.

Review actions take a search filter, so one request can approve every match from a rule your team trusts.

Suspicious Domain Approve reference
Approve by filter 
curl -X POST \
  "https://api.deepinfo.com/v1/brp/suspicious-domains/search:approve" \
  -H "apikey: YOUR_API_KEY" \
  -H "Content-Type: application/json" \
  -d @filter.json

Registration-Stage Detection in the Field.

Customer story A leading research university Phishing portals around application and donor cycles, caught and routed to Managed Takedown. Read Customer story A regional municipality Lookalike domains registered around tax filing and permit renewal, caught and removed. Read Use case Brand Impersonation Protection This watch, extended to accounts, apps and search results. Read

Use This Data in Your Tools

The domains the index sees each day are also a stream and a search API, for teams that run their own lookalike matching or enrich alerts in a SIEM.

Questions About Phishing Detection and Prevention

How is this different from email filtering?

Email filtering inspects messages as they arrive. This workflow looks at the infrastructure behind them: the lookalike domain, its mail server and its certificate, often before the first message is sent. The two work at different stages and complement each other.

Where do the domains come from?

From Deepinfo’s own index: 400M+ domains, 2B+ subdomains, 200B+ DNS records and 30B+ SSL certificates. Rules match names as they come into it.

Does it only catch typos?

No. Besides exact, contains, fuzzy and fuzzy contains matches, each type has a confusable variant that catches letters from other alphabets that look identical to Latin ones.

What about a brand name inside a subdomain?

Rules can target subdomains as well as registered domains, so your brand placed in a subdomain of an unrelated domain is matched too.

Can a new rule check names registered before it existed?

Yes. With include_past on, a new rule also checks names already in the index, not only new registrations.

Can we be alerted when a new lookalike appears?

Yes, once a match is confirmed. A new fraudulent domain, approved by your team or by a rule set to auto-approve, is a notification event, emailed to the team members a rule names instantly or as an hourly, daily, weekly or monthly digest.

How do we keep our own domains out of the results?

List them as ignored domains in the brand protection settings. A name on that list is never reported, whichever rule matches it.

Find the Lookalikes Registered Against You.

Book a demo and we’ll run match rules against your brand names with your team.

Request demo