How it works
Transparent by construction
Every step below is deterministic and bounded. Your plan sets the budget per scan; the scan report shows exactly how much of that budget was used and which sources answered.
1. Brand profile
You give us your brand name, alternative spellings (for example বিকাশ written as bkash, bikash), official domains, social profiles and any partner domains to allow-list. Everything else is derived from this profile.
2. Candidate generation
We generate lookalike hosts in priority order: the same name on other extensions (.com, .net, .xyz, .com.bd …), keyboard and visual lookalikes (rn for m, 0 for o), characters removed, swapped or doubled, hyphenation, and keyword combinations such as brand-bd, brandpay, brand-login. Generation is deterministic, so results are reproducible.
3. Existence checks
Each candidate is resolved through public DNS-over-HTTPS resolvers. Hosts that do not exist are discarded. Hosts that resolve or can receive email become preliminary findings. In parallel, certificate transparency logs are searched for certificates issued to names containing your brand.
4. Safe inspection
The most suspicious hosts are fetched with a hardened client: private and internal addresses are blocked, redirects are re-validated hop by hop, the connection is pinned to the checked IP address, downloads are capped in size and time, and no script is ever executed. The HTML is analysed for login forms, OTP or PIN fields, payment and mobile-money words, urgency language, phone numbers and brand mentions.
5. Registration data
For generic top-level domains, RDAP provides registration and expiry dates and the registrar. Recently registered lookalikes score higher. Note: .bd domains have no public RDAP or WHOIS, so registration dates are unavailable for them.
6. Scoring
Signals are combined into a risk score (0–100) and a separate confidence score (0–100). Risk answers 'how harmful could this be?'; confidence answers 'how much evidence supports this?'. A name match alone stays inconclusive. Human review can mark a finding confirmed or false positive, and those decisions are never overwritten by later scans.
7. Dedupe, alerts and re-checks
Findings are keyed by host per brand, so a host seen in ten scans is one finding with a timeline, not ten alerts. Alerts fire only for new high or critical findings and for escalations. Scheduled scans re-check existing findings and record changes.
Scoring reference
Signals and weights (scoring version 2026.10-r3)
Weights are published so your team can explain any score. We revise them with feedback from false-positive marks and confirmed cases; the version is recorded on every finding.
| Signal | Risk | Confidence |
|---|---|---|
| Name resembles the brand | +15 to +30 risk depending on technique (homoglyph highest) | +12 confidence |
| Domain resolves (A record) | +10 | +22 |
| Mail-capable domain (MX) | +5 | +5 |
| Registered in the last 30 / 90 / 365 days | +18 / +14 / +8 | +14 |
| In the public daily list of newly registered domains (not added again for the registration date) | +18 | +14 |
| Certificate issued (CT logs) | +8 (+7 if recent) | +14 |
| Live website | +10 | +20 |
| Page title mentions brand | +15 | +20 |
| Login / password form (brand mentioned / not mentioned) | +20 / +5 | +12 / +6 |
| OTP or PIN requested | +15 | +10 |
| Mobile-money or payment-collection keywords (generic payment words) | +14 (+4) | +10 (+4) |
| Urgency language (two or more phrases / one) | +6 / +3 | +4 / +2 |
| Live page does not mention the brand | −20 | −10 |
| Form posts to another host | +8 | +6 |
| Redirects to your official domain | −25 | +15 (classified likely benign) |
| Parked / for-sale page | −10 | +8 |
Risk levels: low 0–24 · medium 25–49 · high 50–74 · critical 75–100.
Confidence levels: low 0–34 · medium 35–69 · high 70–100.
What is covered
- Lookalike domain candidates generated from your brand names (typos, homoglyphs, keyword combinations, alternative extensions) and checked against public DNS.
- Certificate Transparency logs (crt.sh) searched for certificates issued to names containing your brand (best effort; the public service is rate-limited and sometimes unavailable).
- Publicly served web content of suspicious hosts fetched safely (no scripts executed) and analysed for login forms, payment keywords and brand mentions.
- Registration dates via RDAP for generic domains (.com, .net ...). Not available for .bd domains.
- Newly registered domains: a free public daily list (WhoisDS, about 70,000 new generic-TLD names a day) is matched against your brand names; new matches are checked the same day when capacity allows, otherwise at the next scheduled scan. It is a sample, not every registration, and has no .bd names.
- Links your team submits (including Facebook, Instagram, Telegram, app-store links) assessed individually.
Known limitations
- Facebook, Instagram and other social platforms are NOT scanned automatically; only links you submit are assessed.
- Candidate generation is bounded by your plan's budget; not every possible lookalike is checked on every scan.
- A finding is a suspicion with a confidence level, not a legal determination of fraud.
- Sites that hide content from automated visitors may not be fully analysed.
- Registration data for .bd domains is unavailable (no public RDAP/WHOIS).
See what is already using your brand name
Run a limited, real check of lookalike domains and certificate logs. Results in minutes, with sources and limitations stated plainly.