Lookalike search results

Lookalike Search results help you assess whether a domain may pose a brand, phishing, or impersonation risk.

Matching Domains

The Matching Domains table lists domains that closely resemble your search input:

Investigate recent activity

Select any value in Recent DNS State (for example: A (1) or NS (2)) to open a DNS record detail slide-out panel.

This panel lists the specific records seen for the domain:

• A records show the IPv4 address where the domain resolves
• AAAA records show IPv6 hosting
• NS records reveal the authoritative name servers

The number shown in parentheses (for example: A (2)) indicates that multiple observations are available. Select the record to review each observation.

👍

Locate parked domains

Use Recent DNS State to quickly determine whether the lookalike is actively hosted or simply registered and parked.

Investigate a domain indicator

1. Click on a hyperlinked indicator to execute a Core Search.
2. Click anywhere in the result to open its indicator panel.

This view includes:

• Reputation Factors: Evidence of threat activity such as suspicious classification or malware sightings
• Usage: How the indicator has been observed (for example: FQDN, Domain, eTLD)
• Search on Other Platforms: Links to enrichment sources such as VirusTotal, Google, urlscan.io, and crt.sh