DomainRadar · Brand monitor

Catch lookalike domains as soon as they get a certificate

A convincing phishing page needs HTTPS, and every TLS certificate is published to public Certificate Transparency logs. Brand monitor reads those logs continuously, flags domains that use or nearly use your brand, scores each one and can have AI check the page before it emails you.

Start free Read the docs →

Certificate Transparency logsTypos and homoglyphsRisk score from 0 to 100Optional AI page checkEmail alertsOne watcher free

DomainRadar · Brand monitor

Detections Watching acme

acme-support-billing.com 78/100 Impersonation

acme substring Let's Encrypt

Brand impersonation likely AI analysis · 3 min ago · high risk

acmecloud.dev 42/100

acme substring 2 hours ago

From a new certificate to an alert in your inbox

Every certificate issued for a public HTTPS site lands in append-only Certificate Transparency logs. Brand monitor streams those logs and runs each new certificate through the same five steps.

1 · Match

Your words against every new certificate

Each domain on the certificate is compared with your watched words: an exact match anywhere in the domain, or a near miss one edit away for words of five characters or more. Lookalike characters such as 0 for o are folded first, and your allowlist is skipped.

2 · Score

A risk score from 0 to 100

Exact use of your word scores higher than a near miss. Free certificate authorities and free hosting platforms such as pages.dev or vercel.app raise it, and so does a domain registered in the last few days.

3 · Enrich

Registration data, included

For registrable domains, DomainRadar runs a full domain check on its own and adds the registration date to the hit. Fresh registrations are a classic phishing signal.

4 · Verify (optional)

AI reads the page

With the AI check on, DomainRadar fetches the site and asks AI whether it impersonates your brand or just shares a word. If the page isn't live yet, it retries every hour for up to 48 hours.

5 · Alert

An email when it matters

If the final score reaches the watcher's threshold, you get an email with the domain, score, match reason, certificate details and the AI verdict. Everything else waits in Detections.

Everything you need to act on a hit

Each detection carries the evidence for a takedown request or a block rule, so triage rarely needs another tool.

Risk score and level

A score out of 100, shown as high from 60 and medium from 30, so the feed sorts itself by urgency.

Match reason

Whether the domain contains your word outright or is a near miss, with the keyword that matched.

Certificate details

The issuing certificate authority, the Certificate Transparency log it came from and every other domain on the same certificate, which exposes bulk phishing setups.

AI verdict

Brand impersonation likely, or no impersonation detected, with the risk level, the indicators the AI saw and its reasoning.

Registration date

Filled in by the automatic domain check, so you can see at a glance whether the domain is days or years old.

A link to share

Each hit has its own page. Alert emails link straight to it, so the person handling the takedown sees what you saw.

Who it is built for

SOC analysts · Threat intel · Incident response

Security teams

Get lookalike domains while the attack is still being set up. The certificate details and the other domains on each certificate help you trace infrastructure and block it in mail and proxy filters.

Banks · Enterprises · Online stores

Brand owners

Know when someone gets a certificate for a domain built on your name. AI content checks separate real impersonation from parked pages and unrelated businesses that happen to share a word.

Agencies · Freelancers · MSPs

Agencies

Watch each client's brand with its own watcher, threshold and alert address, all from one account, and hand over the hit page as evidence.

Set up a watcher in a minute

Create a watcher, point the alerts somewhere sensible and tune it over the first few days.

About 2 min

Open Brand monitor
In DomainRadar, open Brand Monitor, then Watchers, and click New Watcher.
Enter your keyword
Use a distinctive term of at least three characters, like your brand name. Near-miss matching starts at five characters. A generic word like "cube" will be noisy; a distinctive one like "norcube" works well.
Choose where alerts go
Add a notification email, ideally a shared security inbox or a ticketing address. Leave it empty to collect hits without emails.
Set the threshold and allowlist
Keep the minimum notification score at the default 30 to start, and list the domains you own so they never trigger a hit.
Turn on the AI content check
Recommended for any keyword that isn't rare. It's the strongest filter against false alarms. The watcher is live within about half a minute and matches new certificates from then on.

One watcher free. Pay per hour after that

Watchers are billed per hour while enabled, and paused watchers cost nothing. Hits, alert emails and the registration lookup are included. The optional AI content check is billed per check.

Free tier: 1 watcher

Hits, notifications and WHOIS enrichment are included at no extra cost. The AI content check runs only when a hit triggers it.

Watcher : Billed per active watcher, prorated by the hours it is active. Your first watcher is free.

First watcher Free

Each additional watcher $5 / month

AI content analysis : Optional AI visits flagged domains to confirm impersonation vs. false alarm.

First 10 / month Free

11 – 100 / month $0.20 / check

101 – 250 / month $0.15 / check

251 – 1,000 / month $0.10 / check

Over 1,000 / month $0.05 / check

Brand monitor, answered

How detection works, what it can and cannot see, and how to keep the alerts useful.

How fast will I hear about a lookalike domain?

Brand monitor reads Certificate Transparency logs continuously, so a hit is usually recorded within moments of the certificate being logged. Without the AI check, the email goes out right away if the score reaches your threshold. With the AI check on, the email waits for the AI verdict, and if the site isn't live yet that can take up to 48 hours of hourly retries.

What can it not see?

Only domains that get a publicly logged TLS certificate. A lookalike domain that's registered but never gets a certificate, or that only serves plain HTTP, won't appear. Watchers also look forward: a new watcher matches certificates issued after it was created and doesn't scan the past.

Which lookalikes does it catch?

Domains that contain your word anywhere (norcube-login.com, mynorcube.app), domains that spell it across a dot (norcu.be), and near misses one edit away in any part of the domain (norcbue, n0rcube) for words of five characters or more. Lookalike characters and internationalized domain names are normalized before matching.

Will my own domains trigger alerts?

Not if you add them to the watcher's allowlist. Allowlisted domains and their subdomains are skipped entirely, so your own certificate renewals never page anyone.

How do I cut down false alarms?

Raise the minimum notification score, add recurring harmless matches to the allowlist, turn on the AI content check, or narrow the keyword, for example by watching "norcube-" with the hyphen. Hits below the threshold still appear in Detections, so you lose interruptions, not visibility.

Will a burst of certificates flood my inbox?

No. The same certificate is never processed twice, and the same domain won't create another hit for the same watcher within 24 hours, so you get one email per lookalike.

Can my AI assistant read the hits?

Yes. With the Norcube MCP server, an assistant like Claude or Cursor can list your watchers and recent hits, scores and AI verdicts included. See the DomainRadar MCP page.

Know about the lookalike before your customers do

One watcher is free every month. No credit card required. Add your brand name and let the next suspicious certificate come to you.

Start free Read the docs

One watcher free
No credit card
AI page checks
Email alerts