Skip to content
TakedownHunter
Sign inRequest access

We find lookalike domains and help take down the harmful ones.

We watch certificate logs and new .com, .net and .xyz registrations for lookalikes of your brand, and say in one sentence why each was flagged.

Request accessSee pricing

A person reviews each request.

TakedownHunter

Northlake Group (fictional) Your role: Owner

OverviewFindingsCases

Findings

Confirmed and likelyWatchDismissed

  1. northlake-support.exampleLikely

    'northlake' combined with another word. Also: registered 2 days ago

    First seen Case: New

  2. northlake-verify.exampleLikely

    'northlake' combined with another word. Also: mail is configured, which a credential-harvest kit needs

    First seen

  3. xn--nrthlake-nbh.exampledisplays as "nоrthlake.example"Likely

    Uses a character that is visually near-identical to one in 'northlake'. Also: registered 12 days ago

    First seen Case: Waiting for approval

Our customer portal's findings view, in development, shown with fictional findings for a fictional brand. Scoring weights are not yet tuned against labelled data.

We contact the host first and keep the registrar for escalation.

Host action removes content; the attacker can move it. Behind a proxy, we first ask it to disclose the host. An unidentified host gets no notice, not a guess.

Where automation stops: bot protection, which we do not defeat, and copyright or trademark claims, which a human signs.

  1. DigitalOcean

    Droplet suspension and content removal.

    abuse@digitalocean.com

  2. NameSilo, LLC

    Domain suspension, if they act.

    abuse@namesilo.com

Fictional brand. Notice routing for northlake-secure-login.top.

Coverage and limits

We see

  • Domains issued a TLS certificate:minutes
  • New .com, .net, .xyz domains:~24 hours
  • Confirmed-malicious domains and URLs:hours
  • Content changes, tracked domains:per monitoring tier

We don't

  • Country-code TLDs (.de, .io):seen only after certificate issuance.
  • Dormant domains, no certificate:invisible until they act.
  • Wildcard-certificate subdomains:not disclosed in certificate logs.
  • Attacks using no lookalike domain (compromised sites):partial, reactive only.
  • Social accounts, app stores, ads, marketplaces, messaging:not monitored.
  • Cloaking and CAPTCHAs:we do not bypass; benign-looking pages are inconclusive, never clean.
  • Internationalised domains:coverage is uneven and TLD-dependent.
  • Some ccTLDs lack registry records:takedown unprovable, so unbilled.
  • Pages we check:the operator can see our visit and learn we found it.

We cannot promise removal. Some registrars ignore notices; some hosts require a court order.

Pricing

See pricing

Monitoring starts at $49 per brand per month.

Takedowns are $295 for subscribers, $425 otherwise, charged only on a verified removal.