A phishing domain monitor is a system that watches the stream of newly registered and newly activated domain names for ones that resemble a brand, scores each candidate by how close it is to becoming a working attack, and hands the dangerous ones to a person who can act. The purpose is timing. A lookalike domain registered on Monday typically gets mail records on Tuesday, a certificate on Wednesday and a cloned login page by Thursday, and the phishing emails go out on Friday. Phishing domain monitoring aims to find the name on Monday or Tuesday, while it is still an empty registration, rather than on Friday when the help desk starts receiving calls.
This page is part of our domain monitoring hub. It covers where the data comes from, which signals separate a real threat from the thousands of harmless near-matches, how to run triage, what to do once a phishing domain is confirmed, and how to tell whether the program is working.
Where the candidate domains come from
No single feed sees every registration, so a serious monitor draws from several. Zone files (the registry’s complete list of domains and their nameservers in a top-level domain, available for most gTLDs through ICANN’s Centralized Zone Data Service) are the most complete source but update once a day and exclude most country-code TLDs. Newly observed domain feeds, built from passive DNS, catch a name the first time anyone anywhere resolves it, which often precedes its appearance in a zone file and covers ccTLDs the zone files miss. Certificate transparency logs (the public, append-only records that certificate authorities must write every certificate to) reveal a lookalike the moment it obtains HTTPS, which for a phishing site is a required step. Passive DNS history shows where a candidate has resolved and what else shares its hosting.
Two sources come from inside the organization. DMARC aggregate reports (the daily XML summaries that receiving mail servers send to a domain owner about messages claiming to be from that domain) show which sending hosts are spoofing your exact domain and, by extension, which lookalikes are being used alongside the spoofing. The abuse mailbox and the help desk are the last and slowest source: when a customer forwards a suspicious email, the domain inside it is already live. A program that depends on that mailbox is detecting attacks, not preventing them.
The signals that separate noise from threat
Brand phishing domain detection fails when it alerts on every registration that contains a brand string. Most of them are coincidental, parked, or registered by a domain investor who will never build anything. The signals below are what move a candidate from the long list to the short one, and the pattern bears repeating: the monitor watches for the infrastructure of an attack, not merely the name.
An MX record (the DNS record that names the mail server for a domain) added to a lookalike is the single most telling signal, because a domain that can receive email can hold a conversation with a victim, and a domain that can send email can impersonate your staff. CSC reported that 80% of homoglyph domains resembling Forbes Global 2000 brands are owned by third parties and that 42% of those third-party domains had MX records in 2024, up from 40% the prior year, in its 2024 Domain Security Report. A certificate issued for the domain is the second signal, since browsers now warn on pages without HTTPS and attackers know a padlock is expected. Resolution to a commodity hosting provider rather than a parking page is the third. Cloned content, detected by fetching the page and comparing it to your own site’s logo, markup and login form, is the fourth and usually the last before the campaign starts.
Registrar and TLD reputation set the prior. Interisle’s 2025 phishing study counted 1,542,922 unique domain names used in phishing between May 2024 and April 2025, found that 77% of them were maliciously registered rather than compromised, and reported that new gTLDs hold 11% of the domain market but 51% of phishing domains, with .com leading on raw count followed by .top, .bond, .xyz and .shop, according to the Interisle Consulting Group’s 2025 phishing report. A brand lookalike registered at a low-cost registrar in one of those TLDs deserves a higher starting score than the same string registered in .com at an enterprise registrar. The scale of the problem is why the scoring matters: APWG recorded 892,494 phishing attacks in Q3 2025 against 427 unique brands, and the average business email compromise wire-transfer request was $48,115, according to the APWG Phishing Activity Trends Report for the third quarter of 2025.
A triage workflow
Triage runs in stages so that analyst time is spent only on candidates that have earned it. First, the generation step produces every variant worth watching: typosquatting permutations such as missing, doubled and transposed characters; homoglyphs such as a digit one for a lowercase L; added words such as “login”, “secure”, “support” and “pay”; and the brand in other TLDs. Our guide to lookalike domains covers the generation techniques in detail. Then each day’s new registrations and newly observed domains are matched against that list and against a fuzzy comparison for variants the list did not anticipate.
Each match is enriched automatically: creation date, registrar, nameservers, MX records, any certificate in the transparency logs, the hosting provider, and a fetched screenshot of the page. A score combines those fields. A parked name with no MX and no certificate goes on a watch list and is rechecked daily. A name with MX records and a certificate goes to an analyst within the hour. A name serving a cloned login page is an incident and goes to the security team immediately. Once a domain is on the watch list, every later change re-scores it, so a name that sat harmless for six months and then grew mail records is caught on the day it changed.
The response playbook
Response starts with evidence. Before anything is reported, capture the RDAP record, the DNS records, the certificate, a dated screenshot and the page source, because a takedown removes the evidence along with the threat and you may need it later for a UDRP (Uniform Domain-Name Dispute-Resolution Policy) filing or a referral to law enforcement. Then report in parallel rather than in sequence. The registrar’s abuse contact, published in the RDAP record, can suspend the domain. The hosting provider can take down the content. The certificate authority can revoke the certificate. Google Safe Browsing and Microsoft SmartScreen accept reports that cause browsers to warn visitors within hours, which protects customers while the slower channels work. For a name that clearly copies a registered trademark, the URS (Uniform Rapid Suspension, the fast and inexpensive procedure that suspends a new-gTLD domain for the rest of its registration term) or a UDRP complaint takes the name away from the attacker rather than merely switching it off.
Measuring the program
The metrics that matter are time-based. Measure the median hours from a lookalike’s registration to its first appearance in the monitor, from first appearance to triage decision, and from confirmation to takedown. Track the share of confirmed phishing domains that were found by the monitor before the abuse mailbox or a customer reported them, because that share is the program’s actual value. Track false positives as well, since an analyst who dismisses forty harmless alerts a day will eventually dismiss the one that mattered. A program that cannot report these numbers cannot say whether it is working.
How DNAccess monitors for phishing domains
DNShield, our domain name monitoring service, generates the variant list for each protected brand, matches it daily against zone files, newly observed domain feeds and certificate transparency logs, enriches every match with its registration, DNS, MX and certificate data, and alerts on the signals described above rather than on the name alone. Our online brand protection service takes over at the response stage, handling evidence capture, registrar and host abuse reports, blocklist submissions and URS or UDRP filings. For brands that would rather prevent the registration than chase it, domain blocking reserves the brand string and its variants across hundreds of TLDs before an attacker can register them. Contact us to discuss monitoring for your brand.