DomainDrift for brand and impersonation defense

Catch a lookalike domain before it arms.

A typosquat of your brand can sit parked and quiet until the day it stands up a mail server and a fresh certificate, the setup a phishing run needs. Name the lookalikes you worry about, resolving or not, and DomainDrift watches each one from before it answers. The switch-on lands as a dated, signed event, and the reading from before it resolved is the baseline that proves it.

Lookalike domains, watched from before they resolve

Brand impersonation and typosquats start as a name that answers nothing. A name that answers nothing is still a reading.

1. Name it. Add a lookalike to a watch group. Registered or not, resolving or not. The first signed reading lands in seconds; the five-minute watch lane runs under it from there.
2. The reading before. A resolver answering NXDOMAIN has answered. That answer is signed and dated like any other reading, and it is the baseline.
3. The reading after. The day the name starts answering, the change lands as a dated event: the empty side before, the nameservers, mail exchangers and certificate after. The alert carries the same event.

Takedown work wants an exhibit, not a screenshot. Both readings export as a dated evidence report, and the registrar or host who receives it re-checks every signature in the public verifier, offline, with no account. A signature proves who took a reading and that it has not been altered since. It does not make the reading correct.

Scope, plainly: DomainDrift reads a curated catalog plus the domains you name. It does not enumerate every lookalike of a brand, and it does not judge whether a site is phishing. It records what each name published, and when.

curl https://domaindrift.io/v1/domains/example.com