Live · updated 3 min ago
Threat Pulse — live lookalike-domain detections
Don't take our word for it — watch. Every time DomainGuard's monitors detect a registered lookalike domain targeting a watched brand, it lands here. Anonymized, in real time, with nothing to hide and nothing to fake.
No lookalike domains detected in the last hour — that's the point.
How this feed works — the methodology note
This page is itself a trust asset. Here's exactly what Threat Pulse shows, what it deliberately hides, and why.
What we show
- Counts of lookalike domains we detect each hour, day, week and all-time.
- The impersonation technique behind each detection (typo-squat, combosquat, wrong TLD, etc.) — never the domain strings themselves.
- The risk band our scoring assigned (critical / high / medium) — never the raw score.
- When each detection happened, as a relative time ("2 h ago") — never exact timestamps.
What we deliberately hide
- The lookalike domain names themselves (publishing them would name-and-shame domains that may be innocent, and would tell attackers which of their registrations we see).
- Which of our customers' brands each detection targeted, and any workspace, IP or account data.
- Exact timestamps, DNS records (A/MX), and registration details.
- Rare technique classes seen on fewer than 3 watched domains — bucketed as "other" so a class alone can't identify a customer.
Our honesty rules
- We show detections — lookalike domains found registered — never takedowns. Our scanners don't take domains down, so nothing here claims they did.
- Quiet is honest: an empty hour shows as an empty hour. We never synthesize activity.
- The feed is labeled "live" only when the underlying data is under 5 minutes old; otherwise we show the real refresh age.