It refers to a domain that visually or semantically resembles a legitimate brand or organization’s domain. Such domains are commonly created using typosquatting, homoglyph, or substitution techniques to deceive users or security systems.
Three questions every analyst asks before acting on this signal.
It refers to a domain that visually or semantically resembles a legitimate brand or organization’s domain. Such domains are commonly created using typosquatting, homoglyph, or substitution techniques to deceive users or security systems.
The system identifies naming similarities with legitimate domains using lexical analysis, Levenshtein distance, or visual similarity algorithms. If additional behavioral or infrastructure-based indicators (e.g., risky hosting, SSL anomalies, recent registration) are present, the domain is flagged as potentially fraudulent.
Because lookalike or impersonating domains are frequently used in phishing, credential harvesting, or brand-abuse campaigns. Early detection helps prevent users and organizations from interacting with these fraudulent assets.
A realistic shape of the entry the engine appends to the risk_signals array when this signal fires. Evidence keys are subgroup-default; per-signal overrides documented in the API reference.
{
"slug": "potentially_fraud_domain",
"name": "Brand-Impersonating Domain Detected",
"group": "threat_intelligence_feed",
"subgroup": "fraud_abuse",
"direction": "malicious",
"evidence": {
"category": "phishing",
"tld_trust": "untrusted",
"tld": ".zip",
"fraud_indicators": [
"typo_squatting",
"brand_impersonation"
]
}
}2 other signals share the same subgroup. They detect related behaviors and often co-fire on the same IOC.
It indicates that the domain belongs to a top-level domain (TLD) frequently associated with malicious or fraudulent acti…
It indicates that before being classified as malicious, the domain was previously categorized under a risky or suspiciou…
The Verdict Gallery is a curated stream of real verdicts. Filter by this signal to see exactly which IOCs it caught, what other signals fired alongside it, and what the engine recommended.
100 IOCs/day on the free tier, LLM layer included. No card required.