How it works

From a new domain to a finding

DomainSpoof reads every public certificate log and new domain registrations. It resolves every new hostname and checks each one against phishing reports and bad-address lists. New findings publish every hour.

  1. Watch new domainsWe follow every public certificate-transparency log and new domain registrations, and inspect each new name once.
  2. Resolve namesOur own resolver looks up every new hostname, including IPv6 for brand lookalikes.
  3. Check sourcesNames are matched to PhishTank and PhishDestroy reports and to the CERT Polska, USOM and MetaMask phishing lists. Addresses are matched to Spamhaus DROP and to hosts of confirmed phishing.
  4. Publish findingsEach finding carries its source, its addresses and the brand it imitates. The site updates every hour.

Four kinds of finding

  • Reported A hostname in a new certificate that PhishTank or PhishDestroy reports as phishing, or that CERT Polska, MetaMask, USOM, MODA, NPA 165, JPCERT/CC, the AMF, the FSMA or BaFin lists. The finding shows any brand or category the listing source names.
  • Phishing host A brand lookalike resolving to an address that hosted confirmed phishing in the last 48 hours.
  • Spamhaus DROP A brand lookalike resolving to an address on the Spamhaus Don't Route Or Peer list.
  • Same certificate Another name on a finding's TLS certificate that resolves to an address on Spamhaus DROP. It names the finding and why that one was found. Other names on the certificate, such as hosting aliases and lookalikes, appear on the live page under Suspicious, rated by their own signals.

How a name gets a brand

We monitor the 1,000 brands phishing campaigns impersonate most. Each brand comes with its verified official domains and the words attackers use for it.

  • A brand word counts where it starts a label or follows a hyphen: secure-paypal, paypal-login.
  • Short names and everyday words count beside a lure word such as "login", "verify" or "refund": dhl-tracking, amazon-login.
  • A brand's official domains and everything under them belong to the brand itself.
  • On platforms a brand runs for customers, such as github.io, each customer site is its own name.

Reading a finding

  • First seen is when we first saw the name in a certificate log or a new domain registration.
  • Addresses show the network's country flag, its AS number and its operator.
  • Mail records show whether the domain publishes MX, SPF and DMARC, which tells you if it can send or receive mail.
  • Registered gives the domain's registration date and registrar from RDAP.

Hostnames appear as plain text so you can copy them safely. See sources and coverage for each data source and its terms.