Typosquatting Monitoring

A Typosquatting monitor watches for domains registered to look like yours — the raw material for phishing pages, fake login forms and invoice fraud — and alerts you when a new one appears, often before it's put to use.

On every check it generates up to 1,000 lookalike variations of your domain and resolves each one in DNS:

For every registered lookalike it records where it resolves, whether it has mail servers (MX) — a lookalike that can send email in your name is the most urgent kind — and, for newly appeared ones, the WHOIS registration date where the registry exposes it. A lookalike that resolves to one of your own domain's IP addresses is flagged as likely being your own defensive registration.

Availability

Requires a plan with Typosquatting Monitoring (Professional and above).

How it works

curl -X POST https://api.monsphere.com/api/v1/organizations/{orgId}/monitors \
  -H "X-Api-Key: msph_live_..." -H "Content-Type: application/json" \
  -d '{
    "name": "Brand Lookalikes",
    "type": "typosquatting",
    "target": "example.com",
    "intervalSeconds": 21600,
    "config": { "typosquatIgnoreDomains": ["example.net", "example-login.com"] }
  }'

• target — your registrable domain itself (example.com, example.co.uk), without www, https:// or a path.
• typosquatIgnoreDomains — optional: lookalikes you own yourself. They're never reported or alerted on.
• The first check records the lookalikes that already exist as the baseline — it doesn't alert on them, but lists them all. From then on, each check compares against the previous one and a newly registered lookalike fires the monitor's default "New Lookalike Domain Detected" alert, no setup needed — e.g. 1 new lookalike domain(s): exarnple.com.
• The monitor itself only goes down when the scan can't run (for example, DNS resolution is failing) — finding lookalikes is a result, not an outage.
• Scans run at most every 6 hours; new registrations take hours to show up in DNS anyway. Changing the monitored domain resets the baseline.

How it runs

Lookups run from the central worker; WHOIS is queried only for newly appeared lookalikes, a few per scan, to stay within registries' rate limits. There's no region to pick.