Most security tooling is pointed inward: at your servers, your code, your exposed services. But some of the most damaging attacks never touch your infrastructure at all. Someone registers a domain one character off from yours, clones your sign-in page, emails it to your customers, and harvests credentials while your perimeter stays perfectly secure. You'll often hear about it only when the complaints start.

Brand Protection is the threat-intelligence layer that watches for exactly this: domains someone else registered to impersonate you. While the rest of SynScan maps your assets, Brand Protection hunts for the look-alikes (typosquats, homoglyphs, combosquats and certificate-transparency clones), then proves which ones are actively phishing and gives you the evidence to shut them down.


Key Takeaways

  • Two discovery sources (algorithmic domain permutations and certificate-transparency monitoring) catch both generated and in-the-wild look-alikes.
  • Every candidate is enriched automatically: is it live, does it copy your site, does it ask for credentials?
  • A deterministic threat score dominated by impersonation evidence separates parked noise from active phishing. Reputation feeds corroborate but never convict alone.
  • Confirmed threats become findings with a full evidence trail, and rogue infrastructure is kept completely separate from your real inventory.

Why Look-Alike Domains Are So Effective

A customer who sees a familiar logo, a padlock and a domain that's one character off from the real thing has very little reason to be suspicious. And because the attack lives on infrastructure you don't own, none of your internal monitoring will ever see it.

A phishing domain doesn't need to break anything. It borrows your credibility.

The only way to catch it is to look outward: actively search for the domains that pair your brand with the telltale signs of impersonation, and keep searching, because attackers register new ones constantly.


The Anatomy of a Look-Alike

"Look-alike" covers a handful of distinct tricks, and they don't all get caught the same way. Knowing the shapes they take is half the battle (examples use yourbrand as a stand-in for your real domain):

  • Typosquat. A fat-finger away from the real thing, like yourbrnad.com — betting on the one visitor in a thousand who mistypes the address.
  • Homoglyph. A character that looks identical but isn't, such as a Cyrillic "а" dropped into yourbrand.com. Indistinguishable to the eye, a different domain entirely.
  • Combosquat. Your brand pasted next to a trust word: secure-yourbrand-login.com. No misspelling at all, just borrowed legitimacy.
  • TLD swap. The exact name on a different extension — yourbrand.co instead of .com — cheap to register and easy to overlook.
  • Bit-flip. A single bit of memory error away, like yournrand.com, catching the rare hardware fault that resolves your name to theirs.

How Discovery Works

Two complementary sources feed a dedicated Rogue Domains inventory, kept entirely separate from your real assets:

Permutation Icon

Domain Permutations

Starting from your real domains, SynScan generates the look-alikes an attacker would: character swaps, typos, homoglyphs, TLD variations and bit-flips. Only the permutations that actually resolve are kept, so you're looking at domains that exist, not a theoretical list of thousands.

Certificate Transparency Icon

Certificate-Transparency Monitoring

Every TLS certificate issued on the internet is logged publicly. SynScan watches those logs for your brand keywords, catching combinations like secure-yourbrand-support.net that a permutation engine would never generate. The moment an attacker issues a certificate for their phishing site, it becomes visible.


From Hostname to Verdict

A newly discovered domain is just a hostname. It might be a phishing kit, or it might be a parked page nobody will ever visit. SynScan enriches each one with a native pipeline that reproduces what a service like urlscan would extract, without spending an external lookup, and answers the questions that decide which it is:

  • Is it live? Does it resolve and respond, and where do its redirects (including JavaScript and meta-refresh hops) ultimately land?
  • Is it copying you? Favicon matches, hot-linked brand assets, brand mentions and source-code similarity to your real site, rendered with a headless browser so single-page apps are captured too.
  • Is it after credentials? Login paths and forms that POST off-domain, the signature of a harvesting page.
  • What's behind it? DNS, resolved IPs, MX records, TLS certificate age and issuer, WHOIS registration, plus threat-intel feeds as corroborating signals.

Scoring That Doesn't Cry Wolf

Each rogue domain carries a deterministic 0–100 threat score, and the scorer deliberately favors impersonation evidence. Signals that prove someone is copying you (a matching favicon, your brand assets, source similarity, credential paths) weigh heavily. Reputation feeds can corroborate but cannot, on their own, push a domain into the threat band. A feed flagging something "malicious" is a hint, not a conviction.

Domains land in clear bands (benign, suspicious, or threat) and only the high-confidence ones escalate. When a domain crosses into threat, SynScan files a finding against it, so it shows up in your vulnerabilities and reports with the full evidence attached. If the domain later goes dark, the finding resolves itself.


Parked Page vs. Active Phishing

Most look-alike domains never do anything; someone squats the name and leaves it parked. The scoring exists to tell those apart from the ones actively coming after your customers. Here's what separates the two:

Signal Benign / parked Active phishing threat
Resolves & responds Often a registrar holding page or nothing Live site, sometimes behind redirect hops
Copies your site No favicon or source similarity Matching favicon, hot-linked assets, cloned source
Credential form None Login form that POSTs off-domain
TLS certificate age Old or absent Freshly issued, right before the campaign
Threat-score band Benign or suspicious Threat
SynScan's action Tracked in the Rogue Domains inventory Escalated to a finding with full evidence

An Extra AI Set of Eyes

With AI enabled, a dedicated agent actively re-tests every enriched rogue domain: it fetches the site, follows client-side redirects, renders the page and probes credential paths, then writes an evidence-backed verdict of confirmed, dismissed, or inconclusive for a human to review. A real AI verdict freezes the domain's status so later re-scoring doesn't flip it back and forth. And because this validation probes third-party rogue domains rather than your own assets, it runs independently of the project's intrusiveness setting.


Evidence You Can Act On

SynScan detects and reports; it doesn't file takedowns for you. What it gives you instead is the thing that makes a takedown fast: a complete evidence package, already assembled and ready to hand to a registrar or hosting abuse desk. Every confirmed threat carries:

  • A screenshot of the live site, rendered as a visitor would see it.
  • Every impersonation signal that fired: favicon match, copied source, brand assets, credential paths.
  • The DNS, WHOIS and TLS records — resolved IPs, registrar, certificate issuer and age.
  • The child phishing URLs discovered behind the domain.
  • The AI audit trail, showing exactly how the verdict was reached.

That's precisely what an abuse desk needs to act, and having it ready is the difference between a domain down in hours and one that phishes your customers for weeks.


SynScan Logo

SynScan adds Brand Protection to continuous attack surface monitoring: it discovers, scores and proves the look-alike domains impersonating your brand, with the evidence to take them down. See the platform →

Frequently Asked Questions

Brand protection is a threat-intelligence capability that watches for domains registered to impersonate your organization: typosquats, homoglyphs, combosquats and certificate-transparency clones. It discovers these look-alike domains, enriches them to detect impersonation, scores the threat, and escalates confirmed phishing sites to findings with a full evidence trail.

SynScan uses two complementary sources: algorithmic permutations of your real domains (typos, character swaps, homoglyphs, TLD variations) that actually resolve, and certificate-transparency monitoring of your brand keywords, which catches combinations a permutation engine would never generate. Both feed a dedicated Rogue Domains inventory kept separate from your real assets.

Each rogue domain gets a deterministic 0–100 threat score dominated by first-party impersonation evidence — favicon matches, copied source code, hot-linked brand assets and credential-harvesting forms. Third-party reputation feeds can corroborate but cannot convict on their own. Only high-confidence threats are escalated to findings.

SynScan detects and reports rogue domains but does not file takedowns itself. Instead it assembles a complete evidence package (screenshots, impersonation signals, DNS, WHOIS and TLS records, child phishing URLs and the AI audit trail), which is exactly what a registrar or hosting abuse desk needs to action a takedown quickly.

No. Discovered look-alikes live in a dedicated Rogue Domains inventory kept completely separate from your real assets. A phishing domain never pollutes your attack-surface data, never counts toward your asset totals, and is never scanned as if you owned it. Brand Protection only enriches and scores it as external, third-party infrastructure.