Invoice fraud starts with a web address one letter away from yours. NameSignal watches every new website as it goes live, checks each lookalike of your name, and tells you only when one is set up to deceive your customers, suppliers or staff.
No dashboard to watch. You get an email when something is real, with the evidence and one button: take it down. We report it to the company it was registered with and track it until it is gone.
Free lookalike domain check
Enter your main website. We check common lookalike names against public DNS. A match is a reason to investigate, not proof of an attack.
Free, no account. We query DNS only — a suspected domain is never opened, fetched or followed.
In plain terms
Say northwind[.]com is yours. Someone registers northwlnd[.]com — a lowercase L where the i was — and sets up a mailbox on it. It costs about ten dollars. Then an email reaches one of your customers: “our bank details have changed, please pay this invoice to our new account.” In an inbox the two names are very hard to tell apart.
Every site with a padlock needs a certificate, and every certificate is published to public logs within seconds — millions a day. NameSignal reads all of them and compares each new name against yours.
Most names that look like yours belong to someone harmless. Our isolated scanner checks each one — is it set up to send email, is it brand new, does its page use your name or ask for a password — so you never have to open it. You hear about the real ones, with the proof and what to do today.
Five ways a name can be made to read like northwind[.]com
A fictional brand, to show the shapes. Suspect names are always written like this and are never clickable anywhere in NameSignal.
Two honest limits, worth knowing before you start. Our checks are evidence, not certainty: a site can hide from a scanner or change after we look, so we keep re-checking the ones we are unsure of and always show why we decided what we did. And monitoring is triggered by a certificate, so a lookalike that never gets one can be missed; the free DNS check covers a different slice. Coverage status is shown above rather than hidden.
What you get
Not a list of names to sort through. Each alert says what the lookalike can do, the facts behind that, and the one thing to do today.
Every new lookalike is checked: whether it has mailboxes, how new it is, and whether its page uses your name or asks for a password. Other businesses with similar names are set aside.
Adding a brand queues a historical certificate search and a broader DNS sweep. Results depend on source availability; an incomplete check is never an all-clear.
Press “Take it down” and we report it to the company it was registered with, from a real mailbox that answers their questions, then keep checking until it is gone.
Getting started
The free check needs no account and no card. If what it finds is useful, add your brand and NameSignal keeps watching from there.
We build the names most commonly used to impersonate a brand like yours, then check which of them already resolve in public DNS. Names we generated are labelled separately from names we actually observed.
List the ones you own. That is how your own certificate renewals get recognised as yours, instead of being reported back to you as threats.
We check every lookalike as it appears and email you only about the ones set up to deceive. Each comes with the evidence, what to do today, and a button to have it taken down.
For agencies and IT service businesses
Review lookalike domains across client brands in one account. Share a dated report that explains the evidence and next action. Agency includes up to 25 brands; separate client seats are not included.
Pricing
Try one brand and investigate three suspicious domains. Paid plans unlock all recorded findings and more brands. Free accounts never upgrade automatically.
US$0 / month
1 brand · 3 stable alert details · evidence reports · no card required
Start freeUS$99 / month
5 brands · all recorded alerts · evidence reports and case tracking
Choose ProUS$299 / month
25 brands in one account · all recorded alerts · reports to share with clients
Choose AgencyPrices in US dollars, billed monthly. Taxes may apply. Cancel future renewals from Billing. Payments are handled by Stripe. Registrars decide whether to remove a domain; removal is never guaranteed.
No. Most similar names belong to unrelated businesses. We check each one first and email you only when it is set up to deceive: mailboxes on a brand-new lookalike, your name on its page, or a password form. The rest stay in your account, with the reason we set them aside.
Our isolated scanner reads each suspect page as plain text: no script runs, nothing is submitted, and a suspect site is never shown to you as a link. That way you and your staff never have to open it.
Common lookalike names against public DNS. It checks a limited candidate set, not every registered domain. Shared nameservers and generated examples are labelled separately.
No. Certificate monitoring covers configured public logs and can be delayed or incomplete. Domains without a certificate can be absent. Historical searches and DNS checks have separate limits; coverage status stays visible.
Yes, when you ask. Press “Take it down” on an alert and confirm you act for the brand; we review the evidence, report it to the company it was registered with, and we track it until it is gone. The registrar decides whether to act, so removal cannot be guaranteed.
Agency puts up to 25 brands in your account. You can share downloaded reports; separate client seats and a white-label portal are not included.
Questions about fit? Talk to the founder.
Start with a domain you know
Type your domain and find out in about a minute, free. What comes back is a reason to investigate, not proof of an attack — read the evidence before you decide whether to monitor or report anything.
Monitor my brand free