--- title: Lookalike Domains Event Category slug: lookalike-domains-event-category image: https://api.archbee.com/api/optimize/wtmLmyh6YG71yn5qVtkMM/0FbKb1OHn9UHv8OCCZbnd_flare-logomark-full-color-1.png docTags: createdAt: 2026-08-25T17:07:43.272Z --- Lookalike domains imitate your organization's real domains using tactics such as typosquatting, homoglyphs, and combosquatting. They are a primary vector for phishing and brand impersonation. Flare monitors such domains continuously across several detection sources. Detection covers newly issued SSL certificates, domains that resolve in DNS, and domain intelligence from domain intelligence feeds. Because DNS-based detection evaluates all currently registered domains rather than only new ones, lookalike domains that were registered long before you added your Domain Identifier are surfaced. Visual similarity detection is also available in the extended tier. The Lookalike Domains event category covers every event generated for a domain imitating one of your Domain Identifiers. These events appear in your Tenant Feed under the Lookalike Domains category. ![](https://api.archbee.com/api/optimize/wtmLmyh6YG71yn5qVtkMM/O0c-hbUdVMEi0q2F0ionX_image.png) *** ## Lookalike Domains in the Tenant Feed A lookalike domain typically moves through two stages. It is first registered, and often sits dormant on a parking page. It later becomes active, and its content and hosting infrastructure begin to change. Both stages are represented as separate events in the Tenant Feed. ### Discovery Events A Discovery Event is generated the first time a lookalike domain is identified for one of your Domain Identifiers. These events state that a new lookalike domain was found and include the details detected for it. ![](https://api.archbee.com/api/optimize/wtmLmyh6YG71yn5qVtkMM/mLkVqwmpEkJqfDMYPkRHV_image.png) Discovery Events come from the following detection sources: - **Certificate Transparency Logs**: Certificate transparency logs are monitored in real time and newly issued SSL certificates whose subject resembles one of your Domain Identifiers are flagged. Because this is a live stream, it does not return certificates issued before your Identifier was created. - **Domain Fuzzing**: Generates permutations of your Domain Identifier and checks each one for active DNS records. It detects domains regardless of how long ago they were registered. - **Domain Intelligence Feeds**: Domain Identifiers are also matched against intelligence from domain intelligence feeds to surface possible lookalikes, extending coverage beyond permutation-based and certificate-based detection. - Visual Similarity Detection**:** Visual similarity detection surfaces sites resembling your own, even when the domain name itself is not similar. :::hint{type="info"} **Ignore a Lookalike Domain** If a detected domain is legitimate or is not considered a threat, you can stop receiving future updates for it by ignoring its Discovery Event. This can be done either from the Tenant Feed or the details of the event. 1. In the Tenant Feed, find the Discovery Event and click the **Ignore this event** icon. ![](https://api.archbee.com/api/optimize/wtmLmyh6YG71yn5qVtkMM/QYKNsJjISV2zYbWKwdzi5_image.png) 2. View details of an event and select **Ignore** **this** **Event** from the **Actions** menu. ::Image[]{src="https://api.archbee.com/api/optimize/wtmLmyh6YG71yn5qVtkMM/1ELvyKTlKIhUMoayXxgYE_image.png" size="70" isUploading="false" width="1170" height="546" darkWidth="1170" darkHeight="546" position="flex-start" showCaption="true"} ::: ### Update Events An Update Event is generated when a tracked attribute of a known lookalike domain changes. Each change generates a new event with its own severity assessment, so a domain that was low priority as a parked page is re-evaluated as soon as it begins to resemble your own. Because each change is a separate event, you can get [Alerts](docId\:eQFoSNLszdT49_kdW6Xts) on changes as they happen. :::hint{type="warning"} Update Events are currently being enabled progressively. If you do not see them yet and would like them enabled sooner, please contact your CSM. ::: ![](https://api.archbee.com/api/optimize/wtmLmyh6YG71yn5qVtkMM/CcZKegYHbfRqUfQEeavKX_image.png) **What's Included in Update Events** Update Events are generated for the following attributes: - **Standard Lookalike Domain Monitoring:** Base tracking covers following updates to a domain: - **Title Update**: The domain's page title changes. - **Favicon Update**: The domain's favicon changes. - **Screenshot Update**: The domain's landing page screenshot changes. - **IP Address Update**: The domain resolves to a new IP address. - **Extended Lookalike Domain Monitoring:** With the extended tier, the following additional fields are also tracked: - **DNS Records Update**: The domain's DNS records change, including MX records. - **WHOIS/RDAP Update**: The domain's registration data changes, such as the registrar or registrant. - **SSL Certificate Update**: A new SSL certificate is issued for the domain. :::hint{type="info"} **Extended Lookalike Domain Monitoring** Extended Lookalike Domain Monitoring includes access to the [Lookalike Domains Browser](docId\:JuORfpuO86X2FD80CgmKw), where you can view all detected lookalike domains and their related events in one place. ::: *** ## Configuring Events for Lookalike Domains To see Lookalike Domain Events in your Tenant Feed, enable them for your Domain Identifiers, then select them in the Tenant Feed filters and configure Alerts for them. ### Step 1: Enable Lookalike Domain Events for an Identifier Follow these steps when creating a Domain Identifier: :::::WorkflowBlock :::WorkflowBlockItem Navigate to the [Identifiers page](https://app.flare.io/#/identifiers) and click **Create Identifier**. For complete instructions on how to create an Identifier, see [Configure Identifiers](docId\:BpcMrPdOHzER0cC83VCdn). ::: :::WorkflowBlockItem Select **Domain** as the type and enter a domain name. ::: ::::WorkflowBlockItem From **Threat Categories**, select **Domain Impersonation**. :::hint{type="info"} All Lookalike Domain sub-categories, including Discovery and Update Events, are selected by default. Clear any sub-categories you do not want to receive. ::: ::Image[]{src="https://api.archbee.com/api/optimize/wtmLmyh6YG71yn5qVtkMM/HX9yHJ_g5orIu-BOd0gmU_lookalike-identifiers.png" size="70" isUploading="false" position="flex-start" width="934" height="1116" darkWidth="934" darkHeight="1116" showCaption="false"} :::: :::WorkflowBlockItem Complete the Identifier configuration and click **Create Identifier**. ::: ::::: ### Step 2: View Lookalike Domain Events in the Tenant Feed Follow these steps to view events for lookalike domains in the Tenant Feed: :::::WorkflowBlock :::WorkflowBlockItem Navigate to the **Events **page and click the **Categories **filter in your Tenant Feed. ::: ::::WorkflowBlockItem Expand the **Lookalike Domains** category and select the events you want to surface. :::hint{type="info"} In the Tenant Feed, only the **Domain** **Discovery** event is enabled by default. Select one or more sub-categories to receive relevant Update Events. ::: ![](https://api.archbee.com/api/optimize/wtmLmyh6YG71yn5qVtkMM/0k7q_ywUWHBzOe2yjerFp_lookalike-events.png) :::: :::WorkflowBlockItem Click **Apply**. ::: ::::: ### Step 3: Configuring Alerts for Lookalike Domains Follow these steps to configure Alerts for lookalike domains: :::::WorkflowBlock :::WorkflowBlockItem Navigate to the [Alerts page](https://app.flare.io/#/alerts) and create a new Alert. For complete instructions on how to create an Alert, see [Alert Central](docId\:eQFoSNLszdT49_kdW6Xts). ::: ::::WorkflowBlockItem In the **Categories** setting, select one or more Lookalike Domains categories. :::hint{type="info"} For Alerts, only the **Domain** **Discovery** event is enabled by default. Select one or more sub-categories to receive relevant Update Events. ::: ::Image[]{src="https://api.archbee.com/api/optimize/wtmLmyh6YG71yn5qVtkMM/mTouO5SXyXZZ_F4lGHK5f_lookalike-alerts.png" size="70" isUploading="false" position="flex-start" width="910" height="1026" darkWidth="910" darkHeight="1026" showCaption="false"} :::: ::::: *** ## How Detection Works Lookalike domains are detected using the following methodology. Each pipeline runs on its own cadence, daily or weekly by strategy complexity. Certificate transparency logs are the exception, running continuously against the live certificate stream ![](https://api.archbee.com/api/optimize/wtmLmyh6YG71yn5qVtkMM/eEfjN0flVf-EcFtW9ERRV_image.png) :::hint{type="info"} For complete details on lookalike domain detection, including permutation strategies and scoring, see [Lookalike Domains Data Source](docId:5A9wiXcgd5bLfI9KDZ6ii). :::