Why domain monitoring prevents fraud
Imagine a company that owns digitpol.com. A fraudster does not need to break into that domain. It is far easier to register a similar one, such as digitpol-secure.com, digitpo1.com or digitpol.co, and send emails that look as if they come from the genuine business. Customers, suppliers and staff see a familiar name and act on instructions to change bank details, pay an invoice or sign in to a fake portal.
These lookalike domains are usually registered shortly before an attack. Spotting a new registration early gives you time to warn customers, block the domain in your email filters, request a takedown and preserve evidence, all before any money moves.
What we monitor every week
Each registered domain is checked once a week against public registry data (WHOIS and RDAP). The new result is compared with the previous week, field by field, and every difference is recorded with the date it was observed.
- Registrar changes, which can signal a transfer or a hijacking attempt
- Domain status changes, such as removed transfer locks or a domain placed on hold
- Nameserver changes, which redirect where the website and email are served from
- Registrant and contact changes, where the registry publishes them
- Registration, expiry, transfer and last-changed dates, so an approaching expiry is never missed
- DNSSEC being switched on or off
Lookalike domain detection
Alongside your own domain, we generate the variants a fraudster is most likely to use: swapped or missing letters, look-alike characters such as 0 for o or rn for m, added words like secure, login, support or invoice, and the same name under other endings such as .net, .co or .eu. Each week we check which of these exist in public DNS and flag any that have newly appeared.
What monitoring can and cannot tell you
A change is a signal to look closer, not a verdict. Registrars update records for routine reasons, and many registries redact personal details. A newly registered lookalike may belong to a reseller or a defensive registration. When a registry cannot be reached in a given week, we say so and never report it as a change. Use the full investigation tool on any flagged domain to collect sealed evidence before acting.
How to start
Domain monitoring is included with the Unlimited plan. Add up to 20 domains from your account. The first check records a baseline straight away, and weekly comparisons follow automatically. All changes appear in your account under Domain monitoring.