---
title: Lookalike Domains Browser
slug: lookalike-domains-browser
docTags:
createdAt: 2026-08-25T17:10:46.168Z
---
The Lookalike Domains browser lists all lookalike domains detected for your organization in one place. Each domain is shown as a single record that brings together all its events, so instead of tracking individual events in your feed, you can view every detected domain and its relevant events in a single view.
You can browse, sort, filter, and search every detected domain, open a consolidated profile for any one of them, and act by viewing a site in the sandbox or submitting a takedown request.
# Key Features
- **Broad Detection Coverage:** Lookalike domains are discovered from a broad set of sources, including open-source tooling and specialized external providers. Detected domains are enriched with additional attributes such as whois records, MX records, and DNS records, giving you more context on each domain. For more information on how domains are detected, see [Lookalike Domains Event Category](docId\:acMt78DjtN8vkUzeLRMFW).
- **Domain Intelligence Profile: **Each lookalike domain has a Domain Intelligence Profile that gathers everything known about it in one place: the screenshot, favicon, and metadata, the enrichment collected from parent and update events, the full event history, and a severity timeline. From the profile you can see a timeline of how a domain's severity has changed over time and which events drove the change.
- **Visual Similarity Detection:** Lookalike domains are also detected by visual similarity, which finds sites that resemble your brand even when the domain name is not similar. This catches impersonation that text-based domain matching alone would miss.
- **Managed Takedowns:** When you confirm that a lookalike domain is malicious, you can submit a takedown request and track it through to resolution. For more information on takedowns, see [Takedown Services](docId\:s0I_jaVXqNHTXDhXRdSR_).
***
# Using the Lookalike Domains Browser
Click through the following product tour to learn how to use the Lookalike Domains browser.
:::Iframe{iframeHeight="0" code="
Extended Lookalike Domain Monitoring detects and tracks lookalike domains using visual similarity detection in addition to URL matching. Each detected domain is enriched with metadata including MX records and WHOIS data. The system supports triage workflows and monitoring tools for prioritizing and acting on threats.
In the Events feed, filtering by Domain Identifier and selecting the Lookalike Domains category displays only lookalike domain events. A parent event marks the first detection of a domain. Subsequent changes, such as a new IP address, page title, or certificate, each generate their own update event, creating a timeline of domain activity. Individual events can be opened to view what changed and how severity was determined, along with advanced raw event data.
The Lookalike Domains Browser provides a per-domain view, consolidating all events for each lookalike domain into a single entry rather than listing individual events separately. Each entry shows severity, detection sources, registrar, related Domain Identifier, and first discovered and last updated dates. Metrics at the top display recently detected domains and the total count of lookalike domains detected. Filters allow narrowing results by specific domain, time period, severity level, and other criteria.
Selecting a domain opens its Domain Intelligence profile, which includes the most recent screenshot of the domain, MX and WHOIS metadata, a severity level timeline with date range controls, a full event history from first detection through all updates, and available actions. From this profile, users can submit a Takedown Request or open the domain in a Sandbox to inspect it in an isolated environment without visiting it directly. Individual events in the history can be opened in the Events feed to review full metadata and severity details.
"}
:::
:::::WorkflowBlock
:::WorkflowBlockItem
**View Lookalike Domains**
Navigate to the **Lookalike Domains** browser from the left navigation. Each row in the browser represents one lookalike domain, not a single event, and shows the following information:
- **Severity**: The severity assigned to the domain, from `Info` to `Critical`, reflecting how closely it resembles your domain and how likely it is to be a threat.
- **Domain**: The URL of the detected lookalike domain.
- **Registered At**: The date the domain was registered, where known.
- **Registrar**: The registrar the domain was registered through, where known.
- **Related Domain**: The Domain Identifier that the Lookalike domain resembles.
- **Sources**: The detection sources that surfaced the domain, such as certificate transparency logs, domain fuzzing, or other domain intelligence feeds.
- **MX Records**: The mail exchange records configured for the domain, where present. MX records indicate the domain is set up to send or receive mail.
- **Discovered At**: The date the domain was first detected for you.
- **Updated At**: The date of the most recent event on the domain.
:::
:::WorkflowBlockItem
**Sort, Filter, and Search**
Use **Filters** to focus on the domains that matter to you, for example the most recently discovered domains, the domains updated most recently, or the domains registered within a recent time period. You can also search to find a specific lookalike domain.
:::
:::WorkflowBlockItem
**View the Domain Intelligence profile**
Select a lookalike domain to open its **Domain Intelligence** profile. The profile brings together the parent event and all related update events, along with any screenshots, its metadata, and its severity history.
:::
::::WorkflowBlockItem
**Take Action and View Severity Timeline**
In the **Domain Actions **section, select **Submit a Takedown Request **to open a takedown request for the domain.
Select **View in Sandbox** to investigate the domain. Because a lookalike domain may host malicious content, this opens the site in an isolated environment so you can see how it looks and behaves without visiting it directly.
:::hint{type="info"}
Takedown Services and Sandbox require an add-on. Please contact your CSM for more information.
:::
::::
:::WorkflowBlockItem
**View Event History**
In **Event History**, you can see all the events detected for this domain. Click **View Event** to see the details in the Events feed.
:::
:::::
***
# Ignoring a Lookalike Domain
To stop receiving events for a lookalike domain, ignore its Discovery Event. Future update events for that domain will no longer appear in your Events Feed. This is useful when a detected domain is legitimate or is not considered a threat.
Follow these steps to ignore a lookalike domain:
::::WorkflowBlock
:::WorkflowBlockItem
In the Lookalike Domains Browser, click a domain to open its **Domain Intelligence** profile.
:::
:::WorkflowBlockItem
In the **Event History** section, find the **Domain Discovered** event.
:::
:::WorkflowBlockItem
Click **View Event** to open the event in the Events feed.
:::
:::WorkflowBlockItem
From the **Actions** menu, click **Ignore this Event**. Future update Events for this domain will no longer appear in your Events feed.
:::
::::
***
# Best Practices
1. **Start from the browser to investigate lookalike domains**
:::Paragraph{indent="1"}
When you are reviewing lookalike domains, start from the Lookalike Domains Browser rather than the Events feed. The browser lets you work from the domain level down to individual changes. Identify the domains relevant to you, open the Domain Intelligence profile to see the summary, and drill into specific events when you need to view additional details. Before acting on a domain, review its metadata, such as the WHOIS contact and any MX records, to judge whether it represents a real threat.
:::
2. **Exclude a legitimate lookalike domain**
:::Paragraph{indent="1"}
If a detected lookalike domain is legitimate and you do not want to receive further updates about it, create an [Ignored Terms Tenant policy](docId\:dWZgZXapb6REJZ4MoUy6e) that excludes the domain and is restricted to the Lookalike Category. This stops future updates for that domain across the Tenant.
:::
:::Paragraph{indent="1"}
Ignoring or remediating a single update event affects only that event. It does not stop future updates for the domain. Please note that the ignore terms must exactly match the domain name for the policy to work.
:::
::Image[]{src="https://api.archbee.com/api/optimize/wtmLmyh6YG71yn5qVtkMM/NDY6lJQ7hpeUKJMjuRK5D_image.png" size="70" isUploading="false" width="984" height="886" darkWidth="984" darkHeight="886" position="flex-start" showCaption="false" indent="1"}