PHISHING STARTS WITH A LOOKALIKE DOMAIN

Is someone squatting on your brand right now?

Phishing campaigns start with a domain that looks like yours: one letter swapped, a hyphen added, a lookalike character. Every one of those domains leaves a public trace in certificate transparency logs. Search those logs for your brand in 30 seconds. No signup, nothing installed.

The 30-second brand check

Search certificate transparency logs. Open crt.sh and search for certificates containing your brand name:

https://crt.sh/?q=%25yourbrand%25
(replace "yourbrand" with your brand or domain name, no spaces)

Scan the results for anything you don't recognize — especially domains with swapped letters, extra hyphens, or odd TLDs.

Unfamiliar lookalike domains with recent certificates → INVESTIGATE. Visit carefully (don't log in to anything) or check the domain's age and registrar.

Check the classic typos by hand. The most-abused tricks, using example brand "acme":

acme.com      → acme-login.com, acme-secure.com   (hyphen tricks)
acme.com      → acrne.com, acem.com              (letter swaps / drops)
acme.com      → acme.net, acme.io, acme.co        (TLD swaps)
acme.com      → аcme.com                          (lookalike Unicode chars)

Search crt.sh for each variant the same way as step 1.

Any variant registered recently that isn't yours → assume hostile until proven otherwise. Phishers register days before the campaign.

Nothing suspicious → clean today. Squatters register new domains constantly — this check needs repeating.

crt.sh is a free public log operated for the security community. A domain having a certificate doesn't prove malice — but a lookalike you didn't register deserves a look.

If you found a squat, do this now

Don't visit it from a work machine — use a sandboxed browser or a URL scanner.
Document everything — screenshots, WHOIS, certificate dates. You'll need it for takedown.
File abuse reports with the registrar and hosting provider; report phishing URLs to Google Safe Browsing.
Warn your customers — a short "we will never ask you to log in at this domain" notice kills most phish.
Watch continuously — takedown one domain and the attacker registers three more.

Scan your brand free → DomainGuard

This page showed you the manual check. DomainGuard automates it — watching certificate transparency logs and new registrations for lookalikes and alerting you the moment one appears.