Before
Analysts likely had to generate possible spoofing variations, check each domain individually for registration and registrar details, and move between reputation, DNS, email-configuration, and infrastructure searches. They then had to reconcile the findings and write a separate assessment for each registered lookalike domain.
How it works
- Generate a broad set of spoofing-style domain variations for the scheduled target domain and retain only candidates confirmed as registered.
- Assess each registered domain's registrar, reputation, DNS and email configuration, and any public hosts or related IP addresses, applying conditional checks when MX or A records are present.
- Consolidate the findings into a contextualized report with maliciousness, suspiciousness, and safeness scores, rationale, and detailed evidence for analysts.
Workflow details
- Candidate generation: On a scheduled run, the workflow takes a target domain and uses known spoofing patterns such as typosquatting, homograph variations, character substitutions, Punycode, dotless domains, and subdomain-style deception to generate at least 15 similar-domain candidates.
- Registration and registrar assessment: Each candidate is checked to determine whether it is registered. Unregistered candidates are excluded, while registered domains are evaluated for registrar information and whether the registrar appears trusted or legitimate.
- Reputation and infrastructure analysis: Registered domains are reviewed for reputation findings and related DNS data. When MX records exist, the workflow checks email, DNS, SMTP, and SPF configuration for failures, warnings, passed tests, timeouts, errors, and other configuration concerns.
- Host and vulnerability checks: When A records identify public IP addresses, the associated hosts are examined for domains, hostnames, tags, location, ASN, open ports, and reported vulnerabilities. If no host information is available, the report records that no public infrastructure information was found rather than treating the absence as a confirmed vulnerability.
- Risk reporting: The collected findings are consolidated and analyzed for every registered similar domain. The final report provides maliciousness, suspiciousness, and safeness scores out of 100, along with a rationale and detailed assessment based on the registrar, reputation, email configuration, and host-scan results.
What changed
A scheduled run now performs the candidate generation, registration filtering, conditional DNS and infrastructure checks, and risk analysis in one workflow. Analysts receive a structured assessment for every registered similar domain, including explicit handling for missing MX records or unavailable host information, instead of assembling the evidence manually.
Work removed
Generating lookalike-domain candidates, checking registration status, reviewing registrar trust, performing repeated reputation lookups, checking MX and A records, running email-configuration tests, inspecting related hosts for vulnerabilities, copying findings between tools, and manually compiling per-domain assessments.
Expected outcome
Each scheduled target-domain run screens at least 15 spoofing-style candidates and produces a consistent per-domain assessment, reducing the recurring analyst work of coordinating multiple lookups and compiling the final report.
