Look-alike Domains

this category will monitor any ssl certificates registered with one of https //certificate transparency dev/ before that, we will apply fuzzy match algorithms in order to generate permutation on the domain you saved in https //app archbee io/docs/ 9l92jwr4tn n9nrzw7pt/tktcmyqd0n1 kybe4qabb#we domain the objective is to find out whether anyone registered domains that are similar to yours, preventing https //en wikipedia org/wiki/typosquatting and phishing flare applies a wide range of fuzzy match algorithms and heuristics to identify possible impersonators we look at things like homoglyphs, insertions, deletions, omissions, repetitions, transpositions, vowels swap and bitsquatting if your organization is the owner of example com , flare will spot the following look alike domains (and many others) examp1e com exemple com exqmple com exanple com exmaple com exampl com examples com example ca example io ex ample com example payment com we will not detect look alike domains that combine multiple strategies for example, flare1 co uk would not match flare com since it includes permutation of both a character addition and a tld swap identifier matching if you have two domain identifiers abc ca and aabc ca , we will not create lookalike domain events for abc ca or aabc ca , even though they are both lookalikes of each other note that if the aabc ca domain identifier is added after a lookalike event has already been added to the feed of abc ca , we will not remove the event from the feed certstream only detects newly registered domains in real time, and we do not have historical data from this source we also cannot backfill matches from certstream on new domains dnstwist will detect domains that are currently registered, no matter how long ago it was first registered however, if a domain was registered in the past, then expired and is no longer registered, dnstwist will not pick it up scoring the default severity score for most ssl certificates registration found is low however, multiple factors enter in our risk classification algorithm, possibly pushing the risk score either way; factors leading to lower scores are whether flare suspects the domain registered to belong to you, looking among other things, at the domain and tld in the case of a subdomain registration various trustworthy cloud and hosting services automatically register domains that follow a specific pattern factors leading to higher severity score include the registration authority, the similarity between domains and how many domains were registered at once related articles