Registering the look-alike is trivial. Knowing which one is about to be used is not.
ShadowMap generates the permutation space around your brand, matches it against registration and certificate feeds daily, and then scores each hit by what the domain has been observed doing — mail configured, certificate issued, your login page served. The queue you work is the domains that have started moving, not every string that resembles yours.
Reference
The permutation classes, with worked examples
Registering a domain that resembles yours costs about the price of a coffee and takes under a minute, and the space that results is arithmetic rather than mystery: the candidate set for a brand is generated, not guessed. These are the classes it is generated from, each shown against a synthetic brand, acmecorp.com. Detection built on edit distance alone handles the middle of this list well and misses the bottom of it entirely — a TLD swap has an edit distance of zero on the name itself, and a subdomain-squat is not your domain at all.
| Class | How it is constructed | Against acmecorp.com |
|---|---|---|
| Homoglyph / IDN | A character is replaced by one that looks identical — either a glyph pair inside Latin, or a codepoint borrowed from another script. | acrnecorp.com |
| The Latin form here substitutes "rn" for "m" and survives being read carefully, not just quickly. The internationalised form is registered as a punycode label beginning xn-- and is rendered back to the deceptive form by some clients and not others, so whether a person can see the substitution depends on the software in front of them. | ||
| Typo — transposition | Two adjacent characters are swapped. | acemcorp.com |
| Transposition preserves the overall shape and length of the word, which is what a reader actually pattern-matches on. It is the class most likely to be missed in a link that is skimmed rather than read. | ||
| Typo — omission | A single character is dropped. | acmecrp.com |
| The most frequently mistyped variant, and the one that matters most for mail rather than for clicks: an omission squat with a mail exchanger configured quietly receives everything anyone misaddresses, including invoices and password resets. | ||
| Typo — insertion | A character is added or doubled. | acmeccorp.com |
| Cheap enough to register across a whole class at once, which is why insertion squats are commonly held parked for years before anything is served from them. Registration date tells you almost nothing here; the intent signals do. | ||
| Typo — adjacent key | A character is replaced by its neighbour on the keyboard layout. | scmecorp.com |
| The candidate set depends on which layout your customers type on. A set generated for QWERTY alone will not contain the AZERTY or QWERTZ neighbours, and mobile keyboards produce a different adjacency again — worth checking against where your traffic actually comes from. | ||
| Hyphenation | A separator is inserted at, or removed from, a word boundary. | acme-corp.com |
| Reads as a legitimate corporate variant, which is exactly why it is favoured for invoice and supplier fraud. It is also the class most likely to turn out to be genuinely yours, so it is the one that most often converts a suspected squat into an inventory correction. | ||
| Combo-squat | Your brand string is kept intact and a plausible word is attached — login, secure, pay, support, hr, careers. | acmecorp-payments.com |
| The largest class by volume, because the attached word supplies the pretext the message needs. It is also the class with the highest legitimate rate — regional distributors, partners and agencies register these constantly — so string matching cannot adjudicate it and the intent state has to. | ||
| TLD swap | The name is left untouched and moved into a different namespace. | acmecorp.co · acmecorp.app |
| There is no string distance to measure, so a detector tuned on edit distance returns nothing at all. Each new gTLD delegation opens a fresh window on a name you already own elsewhere, which is why the class list rather than a distance threshold is the unit of work. | ||
| Subdomain-squat | Your brand is placed in the left-hand labels of a domain the other party controls. | acmecorp.com.secure-login.net |
| The registrable domain is secure-login.net, which has nothing to do with your brand — so this never appears in a registration feed keyed on your name, and a registrar notice runs against a name that is not infringing anything. It surfaces from certificate transparency and from served content instead, and it is the class a narrow address bar flatters most. | ||
Homoglyph / IDN
- How it is constructed
- A character is replaced by one that looks identical — either a glyph pair inside Latin, or a codepoint borrowed from another script.
- Against acmecorp.com
- acrnecorp.com
The Latin form here substitutes "rn" for "m" and survives being read carefully, not just quickly. The internationalised form is registered as a punycode label beginning xn-- and is rendered back to the deceptive form by some clients and not others, so whether a person can see the substitution depends on the software in front of them.
Typo — transposition
- How it is constructed
- Two adjacent characters are swapped.
- Against acmecorp.com
- acemcorp.com
Transposition preserves the overall shape and length of the word, which is what a reader actually pattern-matches on. It is the class most likely to be missed in a link that is skimmed rather than read.
Typo — omission
- How it is constructed
- A single character is dropped.
- Against acmecorp.com
- acmecrp.com
The most frequently mistyped variant, and the one that matters most for mail rather than for clicks: an omission squat with a mail exchanger configured quietly receives everything anyone misaddresses, including invoices and password resets.
Typo — insertion
- How it is constructed
- A character is added or doubled.
- Against acmecorp.com
- acmeccorp.com
Cheap enough to register across a whole class at once, which is why insertion squats are commonly held parked for years before anything is served from them. Registration date tells you almost nothing here; the intent signals do.
Typo — adjacent key
- How it is constructed
- A character is replaced by its neighbour on the keyboard layout.
- Against acmecorp.com
- scmecorp.com
The candidate set depends on which layout your customers type on. A set generated for QWERTY alone will not contain the AZERTY or QWERTZ neighbours, and mobile keyboards produce a different adjacency again — worth checking against where your traffic actually comes from.
Hyphenation
- How it is constructed
- A separator is inserted at, or removed from, a word boundary.
- Against acmecorp.com
- acme-corp.com
Reads as a legitimate corporate variant, which is exactly why it is favoured for invoice and supplier fraud. It is also the class most likely to turn out to be genuinely yours, so it is the one that most often converts a suspected squat into an inventory correction.
Combo-squat
- How it is constructed
- Your brand string is kept intact and a plausible word is attached — login, secure, pay, support, hr, careers.
- Against acmecorp.com
- acmecorp-payments.com
The largest class by volume, because the attached word supplies the pretext the message needs. It is also the class with the highest legitimate rate — regional distributors, partners and agencies register these constantly — so string matching cannot adjudicate it and the intent state has to.
TLD swap
- How it is constructed
- The name is left untouched and moved into a different namespace.
- Against acmecorp.com
- acmecorp.co · acmecorp.app
There is no string distance to measure, so a detector tuned on edit distance returns nothing at all. Each new gTLD delegation opens a fresh window on a name you already own elsewhere, which is why the class list rather than a distance threshold is the unit of work.
Subdomain-squat
- How it is constructed
- Your brand is placed in the left-hand labels of a domain the other party controls.
- Against acmecorp.com
- acmecorp.com.secure-login.net
The registrable domain is secure-login.net, which has nothing to do with your brand — so this never appears in a registration feed keyed on your name, and a registrar notice runs against a name that is not infringing anything. It surfaces from certificate transparency and from served content instead, and it is the class a narrow address bar flatters most.
What the set contains
A registered look-alike is not yet a threat
Most of that space is already taken, and only a small part of it was ever aimed at you. Finding that part — and not filing the rest — is the work.
Some of those registrations belong to defensive registrars acting for other brands. Some belong to domain investors who will hold a name for a decade and never point it anywhere. Some belong to your own marketing team, bought for a campaign years ago and never recorded in any inventory. And a small number belong to someone who intends to send mail as you, or to serve your login page from an address your customers cannot tell apart from the real one. Typosquatting, combo-squatting and cybersquatting are all names for the same underlying act — registering a string close enough to yours to be mistaken for it — and which name you use matters far less than what happens next. Treating every one of them as a finding produces a queue nobody works. Treating none of them as findings means your first signal is a call to the contact centre about a payment made into an account that was never yours. The useful question is not which domains resemble yours, because that set is generable and largely fixed. It is which of them have started doing something. Everything below is about separating the second set from the first.
Intent scoring
Detection is not the finding
Each candidate is held against the strongest intent signal observed on it, and that signal — not the resemblance — decides whether it enters your queue. Signals are re-checked as the domain changes: a name that sat parked for two years can be serving your sign-in page by the afternoon.
| State | What it means | What follows |
|---|---|---|
| Parked | Resolves to a registrar holding page, an ad network, or nothing at all. No mail exchanger, no certificate, none of your content. | Held under monitoring rather than filed. Someone is holding an asset; holding is not yet acting. |
| MX configured | A mail exchanger has been published for the domain. It can now send and receive mail under a name close to yours. | Tell the people who approve payments and the people who reset passwords. Mail capability is used for redirection long before any web page exists. |
| Certificate issued | A TLS certificate naming the domain has appeared in certificate transparency logs, often before any content is served. | Treat as pre-launch and assign an owner now. A certificate is obtained when a page is about to be served over HTTPS, which is what a credential form requires. |
| Content cloned | The page being served reproduces your markup, your logo or the layout of your sign-in screen. | File. Cloned content is the evidence a registrar or host will actually act on, and it is captured with the record rather than described in it. |
| Actively phishing | A live credential or payment form is collecting on the domain, confirmed by probing where it is safe and authorised to do so. | Route for removal, and brief fraud and communications before the notice goes out rather than after. Not every candidate can be probed, and the ones that cannot say so instead of being scored as clean. |
| Attributed to you Terminal | The registrant turns out to be your own marketing team, a subsidiary, or a named partner operating with permission. | Leaves the queue and joins your inventory. On a first run this accounts for a meaningful share of what is found, and that is a result rather than a wasted cycle. |
- File for removal
- Escalating — assign an owner
- Monitored, not filed
- Yours after all
- TerminalNo state follows this one
Routing
Removal is filed against a party that can act
A scored domain is routed to a party with the power to act on it — on the registration, or on what is being served from it. Not a link in an alert for somebody else to chase.
How removal is routed for a domain, and what that routing cannot reach As of August 2026
- Eighty-six provider relationships sit behind removal and sort into twelve types. Each one is a route filed through in production — a monitored abuse mailbox, an authenticated abuse API, or a form a named analyst submits — rather than an abuse address published on a provider website.
- Four of those types can act on a domain, and they act on different things. The registrar suspends or locks the registration but touches nothing being served. The host removes the page, the site or the account behind it. A CDN or reverse proxy in front of the origin is a step towards the host rather than a destination. A search engine removes nothing at all and only cuts the route to it.
- Which of the four is filed is decided per domain, and they are filed in parallel rather than in sequence. Waiting on a registrar to answer before notifying the host is how a live credential form stays up for the length of an abuse queue.
- Takedowns are unlimited, subject to fair use. The fair-use boundary sits in the licence itself; it is not a credit pack bought on top, and it is not consumed per notice.
Deliberately excluded
- No completion time and no response window. Removal and response commitments are contractual and belong in your agreement, where they can be read in full rather than in a headline.
- Social handles, mobile applications and executive identity are not domain findings. They are detected and removed too, under brand protection, and are deliberately not counted here.
- A domain with no reachable filing party — no responsive registrar of record, no responsive host — is reported as unfiled, with the attempts recorded. It is never quietly dropped to keep a queue looking tidy.
- UDRP, trademark enforcement and litigation are instruments your counsel runs on a different timeline. What routes through here is provider-level enforcement, and the evidence pack is built so that counsel can use it if you escalate.
The sequence
From a day of registrations to a filed notice
Each step depends on the one before it, and the order is the argument: nothing is scored that was not matched, and nothing is filed that was not scored.
-
Observe
Registration and certificate feeds, daily
New registrations across gTLD and ccTLD namespaces, read alongside certificate transparency logs. The two sources cover different failures: registration data catches the name on day one, certificates catch the names that registration data never publishes.
-
Match
The permutation set, not a distance threshold
Your brand tokens are expanded across every class in the table above, then matched against the day of observations. This is why the class list is the unit of work — a threshold that catches transpositions will never catch a TLD swap, because there is nothing for it to measure.
-
Score
What it is doing, not what it looks like
Each match is checked for the signals that carry intent — mail exchanger, certificate, served content, redirect behaviour — where it is safe and authorised. AI Review then writes a verdict, a priority score and tags onto the record, so the queue can be filtered and ordered by class before anyone opens it.
-
Route
Into removal, or into monitoring
A scored domain becomes either a takedown record carrying its own evidence, or a monitored candidate whose signals are re-checked. Both are outcomes. Only one of them is an alert, and it is the one nobody needs.
Where this gets sharper
Domain Monitoring works from one correlated exposure model
Questions buyers actually ask
Before you evaluate this
How is this different from a registrar alert or a trademark watch?
A trademark watch tells you a mark similar to yours has been filed. A registrar alert tells you a name adjacent to yours has been registered. Neither tells you whether that domain now has a mail exchanger, a certificate in transparency logs, or your sign-in page rendered on it — and that is the difference between a list and a queue. This capability is built around the second question, and the enforcement it drives is provider-level rather than legal.
Do you monitor every TLD?
We read registration feeds across gTLD and ccTLD namespaces, and we read certificate transparency alongside them precisely because registration data is uneven — some namespaces publish late, some publish partially, and some do not publish in any usable form. Where a namespace is opaque to us, we say so rather than implying coverage: the domain surfaces when it obtains a certificate or serves content instead of on the day it is registered. That is later than we would like, and it is still well before anyone clicks it.
What stops this drowning us in look-alikes we will never act on?
Intent does most of it. A candidate with no intent signal against it is held under monitoring and never enters your queue, and it is promoted the moment a signal appears rather than on a schedule. What reaches an analyst is the set that has started moving, already carrying a verdict and tags so it can be filtered and ordered before anyone opens a record. We do not publish a noise-reduction percentage, because the honest version of that number depends entirely on how permissive your previous tool was.
Find out which look-alikes of your domain already have mail servers
One apex domain, and a written list of the permutations that exist today, with the intent signal found against each. No call required.